biomejs/gritql

This system is an open-source code analysis and transformation engine that uses a custom query language (GritQL) to search, match, and rewrite source code across a wide variety of programming languages. It provides a CLI tool, language server protocol (LSP) integration, and bindings for JavaScript, Python, and WebAssembly, enabling both interactive and programmatic code manipulation. The platform also supports cloud-based workflows and authentication, allowing users to manage and execute pattern-based automation remotely.

This change introduces a complete C\# language grammar for tree-sitter, enabling syntax highlighting, code navigation, and parsing for C\# files. The addition includes the core grammar definition (grammar.js), generated parser code (parser.c, scanner.c), and bindings for multiple languages including C, Node.js, Python, Go, Rust, and Swift. It also provides syntax highlighting queries (highlights.scm) and tags queries (tags.scm) for IDE integration. The grammar supports C\# 1 through 13.0, with the exception that 'async', 'var', and 'await' cannot be used as identifiers everywhere they are valid.

resources/language-metavariables/tree-sitter-c-sharp, resources/language-metavariables/tree-sitter-kotlin, resources/language-metavariables/tree-sitter-toml · high confidence

This change introduces a new PHP language grammar for tree-sitter, providing two distinct parsing modes: a full \php\ dialect that includes HTML interleaving and text interpolation, and a \php\_only\ dialect for pure PHP code. The addition includes the core grammar definitions, external scanners for handling heredocs and string interpolation, and native bindings for Node.js, Rust, and Swift, enabling syntax highlighting and code analysis for PHP files in the editor.

_resources/language-metavariables/tree-sitter-php, resources/language-metavariables/tree-sitter-php/php, resources/language-metavariables/tree-sitter-php/php\only · high confidence

The \tree-sitter-html\ package has been added to the language metavariables resources, providing a complete grammar for parsing HTML documents. This includes the core parser logic, Node.js and Rust bindings, and syntax highlighting queries that map HTML elements, attributes, and entities to editor scopes. Additionally, injection queries are configured to enable syntax highlighting for JavaScript within \\<script\>\ tags and CSS within \\<style\>\ tags, allowing for nested language support in HTML files.

resources/language-metavariables/tree-sitter-typescript · high confidence

The \crates/cli\_bin/benchmark\ directory now includes a \bench.sh\ script that uses \hyperfine\ to measure the performance of various CLI commands (such as \apply\ and \patterns test\) against repository fixtures. The script supports output in Markdown or JSON formats, allows filtering specific tests, and integrates with Grafana for metric reporting when JSON output is selected. A sample configuration file (\apply.json\) and a \.gitignore\ for benchmark results are also added.

_crates/cli\bin/benchmark · high confidence

The \\_\generated\\_/grit-wasm-bindings\ package has been updated to expose new JavaScript/TypeScript bindings for running and matching patterns against LLM APIs. Users can now call \runPattern\ and \matchPattern\ with \llm\_api\_base\ and \llm\_api\_bearer\_token\ parameters, enabling browser-based pattern execution that integrates with external LLM services. The generated TypeScript definitions (\grit\_wasm\_bindings.d.ts\ and \marzano\_wasm\_bindings.d.ts\) and JavaScript implementations now include the necessary WebAssembly bindings to pass these credentials and handle the asynchronous responses.

\\generated\\_ · high confidence_

This update adds the Tree-sitter parser and associated bindings for the Elixir programming language, enabling syntax highlighting, code navigation, and semantic parsing for .ex and .exs files. The change includes the core grammar definition, a custom C scanner for handling Elixir-specific tokenization (such as quoted content and unary operators), and language bindings for Node.js, Python, Go, Rust, and Swift, along with the necessary build configurations and CI workflows to generate and test the parser.

resources/language-metavariables/tree-sitter-elixir, resources/language-metavariables/tree-sitter-ruby · high confidence

The LSP server now provides real-time pattern enforcement, diagnostics, and code actions for supported languages (including JavaScript, TypeScript, Python, Java, Kotlin, PHP, and others). Users will see diagnostics for enforced patterns, receive quick-fix actions to apply rewrites or suppress matches, and can use commands to fix files or search across the workspace. The server also supports live testing of patterns defined in Markdown files and handles document management and CPU-intensive pattern execution on a separate thread to maintain responsiveness.

crates/lsp · high confidence

This change introduces the \wasm-bindings\ crate, providing the foundational JavaScript interface for running Grit patterns in the browser. It exposes \initializeTreeSitter\ to set up the parser and \parseInputFiles\ to compile and execute patterns against target source files, supporting a wide range of languages including JavaScript, TypeScript, Python, Rust, and others via WebAssembly.

crates/wasm-bindings/src · high confidence

This change introduces the core authentication module (\crates/auth\) and testing utilities (\crates/test\_utils\) required to interact with Grit Cloud. It implements a device-code OAuth 2.0 flow with Auth0 (tenant \auth0.grit.io\, audience \api2.grit.io\) to obtain access and refresh tokens, and provides logic to parse JWT payloads for user identity and expiration. The module also supports environment-variable-based authentication via \GRIT\_AUTH\_TOKEN\ and \GRIT\_API\_URL\, and includes a testing helper that retrieves tokens via Doppler or client credentials for CI environments. These components enable the CLI to authenticate users and securely communicate with the Grit API.

crates/auth · high confidence

A new interactive web interface has been added to the WASM bindings crate, allowing users to run GRIT pattern matching directly in the browser. The demo page features two text inputs for entering a pattern and file content, along with a 'Match Pattern' button that triggers the underlying Rust logic via the \matchPattern\ function and displays the JSON result in a third text area.

crates/wasm-bindings · high confidence

This change introduces the \gritmodule\ crate, establishing the core infrastructure for managing Grit patterns as reusable modules. It adds the ability to define, fetch, and resolve patterns from external Git repositories (e.g., \github.com/...\), supporting both inline YAML definitions and external \.grit\/\.md\ pattern files. The implementation includes configuration parsing for \grit.yaml\/\grit.yml\, a module fetcher for retrieving repositories, and a resolver to aggregate patterns from local and remote sources into a unified configuration.

crates/gritmodule · high confidence

The \crates/language\ module now includes dedicated language implementations for C\#, CSS, Elixir, Go, HCL, HTML, Java, JSON, and Kotlin, alongside enhanced support for JavaScript/TypeScript and Vue files. Each language module registers its specific tree-sitter parser, defines node types, and configures snippet context strings to enable pattern matching and code analysis. Notable additions include Vue file parsing support within CSS and JavaScript modules, allowing styles and scripts to be correctly extracted and analyzed, and specific handling for Java and Kotlin comment types. This establishes the foundational language infrastructure required for the tool to understand and manipulate code across these popular ecosystems.

crates/language · high confidence

This release adds the \tree-sitter-css\ and \tree-sitter-hcl\ language grammars to the repository, enabling syntax parsing and highlighting for CSS and HCL files. The CSS grammar includes Node.js and Rust bindings, a highlight query file, and CI configuration, while the HCL grammar provides the core parser, scanner, and an Apache 2.0 license. These additions allow the editor to correctly parse and style code written in these two languages.

(repo-wide) · high confidence

The repository is now publicly available under the MIT license, providing the core GritQL query language for searching and modifying source code. This release includes the Rust-based engine (targeting Rust 1.82.0 and WebAssembly), a comprehensive set of language support submodules (including TypeScript, Python, Java, C\#, Kotlin, PHP, and more), and full contributor documentation detailing setup, grammar patching, and testing workflows.

(repo-wide) · high confidence

This release adds the initial source code for the \tree-sitter-sql\ and \tree-sitter-hcl\ (Terraform dialect) language grammars. The SQL grammar includes a full parser implementation (C), grammar definitions, node types, and bindings for Node.js and Rust, along with documentation and build scripts. The Terraform grammar adds the core parser files (\grammar.json\, \parser.c\, \scanner.c\) and node definitions for the HCL dialect, enabling syntax tree generation for Terraform configuration files.

(repo-wide) · high confidence

The CLI tool is now publicly available as an open-source project, with the binary name set to 'grit'. The release includes a build script that conditionally links the C++ standard library on Linux targets to support compilation, while explicitly noting that Windows support for this linking is not yet implemented. Users can now build and install the tool via Cargo and run pattern checks on files.

crates/cli · high confidence

This change introduces the tree-sitter-markdown language grammar, providing syntax parsing for Markdown documents to support features like syntax highlighting in editors such as Neovim and Helix. The release includes a split grammar architecture with separate parsers for block-level and inline-level structures, along with Node.js and Rust bindings to integrate the parser into host applications. It also adds support for various Markdown extensions (such as GFM, strikethrough, and task lists) that can be toggled at compile time, and includes comprehensive documentation, licensing, and test suites.

resources/language-metavariables/tree-sitter-markdown · high confidence

This change introduces the tree-sitter grammar for the Go programming language, enabling syntax highlighting, code navigation, and parsing capabilities for Go files. The release includes the core grammar definition, syntax highlighting queries, and native bindings for Node.js, Rust, and Swift, along with the necessary build infrastructure (Makefile, binding.gyp) to compile the parser.

resources/language-metavariables/tree-sitter-go · high confidence

This change introduces the initial implementation of N-API bindings for GritQL in the \js/gritql\ crate, exposing a \QueryBuilder\ API to JavaScript/TypeScript consumers. Users can now programmatically construct GritQL queries, apply filters, define replacements or insertions, pipe queries, and execute searches against target files or apply changes to individual files directly from JavaScript. The bindings bridge the Rust-based pattern matching engine (Marzano) to the JS runtime, enabling programmatic code analysis and transformation capabilities within Node.js environments.

js/gritql · high confidence

This change introduces the Java grammar for tree-sitter, providing the core parser (\src/parser.c\), grammar definition (\grammar.js\), and syntax highlighting queries (\queries/highlights.scm\) needed for Java code analysis. It also includes native bindings for Node.js, Python, Go, Rust, and Swift, along with build configurations (Makefile, CMakeLists.txt, binding.gyp, setup.py) to compile the grammar into shared libraries for these platforms.

resources/language-metavariables/tree-sitter-java · high confidence

This change introduces the initial N-API bindings for GritQL, exposing the \QueryBuilder\ class to JavaScript and TypeScript consumers. Users can now programmatically construct GritQL queries, apply rewrites and insertions to files via \applyToFile\, and run searches across target paths using \run\. The bindings support a wide range of platforms, including macOS (x64, ARM64, universal), Windows (x64, ARM64), Linux (x64, ARM64, RISC-V, with both glibc and musl variants), Android (ARM64), and FreeBSD (x64). The release also includes GitHub Actions workflows to automate the build and testing of these native binaries across all supported architectures.

js · high confidence

The \resources/language-submodules\ directory has been initialized with submodules for a wide range of programming languages and markup formats, including C\#, CSS, Go, HCL, HTML, Java, JavaScript, JSON, Kotlin, Markdown, PHP, Python, Ruby, Rust, Solidity, SQL, TOML, TypeScript, Vue, and YAML. This change establishes the foundational grammar resources required for syntax highlighting and code intelligence for these languages.

resources/language-submodules · high confidence

This change introduces a new set of language grammars in the \resources/metavariable-grammars\ directory, enabling the parsing of C\#, CSS, Elixir, Go, HCL, Java, JavaScript, JSON, Kotlin, and Markdown. These grammars are specifically extended to support \grit\_metavariable\ tokens, allowing the system to recognize and process metavariables within code structures. Additionally, build configuration files (\c\_build.rs\ and \cc\_build.rs\) are added to support the compilation of external C/C++ parsers required by some of these grammars.

resources/metavariable-grammars · high confidence

The \grit-pattern-matcher\ crate is introduced, providing the core pattern definitions and matching logic for the GritQL engine. This module exposes the \Matcher\ trait and a comprehensive set of pattern types (such as \Variable\, \Rewrite\, \CallBuiltIn\, and \CallbackPattern\) that define how queries are evaluated. It also includes supporting infrastructure for query execution context, binding management, effect handling, and file ownership tracking.

crates/grit-pattern-matcher/src · high confidence

This change introduces the tree-sitter YAML parser (version 0.6.1) as a new language resource. The grammar is configured to support Grit metavariables, allowing them to be recognized within YAML flow maps and block structures. The release includes native bindings for Node.js, Python, Rust, Go, and Swift, along with syntax highlighting queries and example files.

resources/language-metavariables/tree-sitter-yaml · high confidence

This change adds the \gritql\ Python package, providing bindings that allow embedding the Grit CLI within Python applications. The package includes an installer module that automatically downloads and caches the Grit binary for supported platforms (macOS, Linux, Windows) if it is not already present in the system PATH, and exposes functions to run GritQL patterns and apply them to source code.

python · high confidence

The new \grit-util\ crate centralizes foundational utilities for the Grit engine, providing a language-agnostic \AstNode\ trait for AST traversal (ancestors, children, siblings) and a \Language\ trait for language-specific behaviors like metavariable handling and snippet padding. It also introduces \CodeRange\ for source-address-aware range tracking, \AnalysisLogs\ for structured warning/error reporting, and comprehensive \Position\ and \Range\ types for precise source location management across the platform.

crates/grit-util/src · high confidence

The CLI now exposes dedicated subcommands for managing user identity and cloud-based automation. The \grit auth\ command group provides \login\, \logout\, \get-token\, and \refresh\ operations to handle Grit.io authentication, including device-code flows and token lifecycle management. A new \grit blueprints\ subcommand allows users to list, pull, and push Grit Agent blueprints via remote workflow execution. Additionally, the \grit workflows\ command group (behind the \workflows\_v2\ feature) enables uploading, listing, and running workflows, with support for remote execution on Grit Cloud, custom workflow IDs, and watch mode for continuous updates.

crates/cli/src/commands · high confidence

The \marzano\_messenger\ crate now provides a structured system for handling analysis results and workflow states. It introduces a \Messager\ trait to standardize how match results, rewrites, and logs are emitted, including support for interactive user prompts during rewrites. A new \workflows\ module defines \PackagedWorkflowOutcome\ and \StatusManager\ to track and propagate workflow success, failure, or skipped states, while \SimpleLogMessage\ and \LogMessage\ types standardize log serialization for remote or internal consumption. Additionally, a \TestingMessenger\ is provided to facilitate unit testing by capturing message counts without external side effects.

_crates/marzano\messenger · high confidence

The core engine now includes built-in functions for string manipulation (\capitalize\, \lowercase\, \uppercase\) and list processing (\distinct\, \join\, \length\), enabling users to transform data directly within patterns. Additionally, a comprehensive test suite for a \react\_to\_hooks\ pattern has been added, demonstrating the engine's capability to automatically migrate React class components to functional components using hooks like \useState\, \useEffect\, and \useCallback\.

crates/core · high confidence

The \crates/util\ crate now includes new modules for handling code diffs. It introduces a \diff\ module that parses unified diff formats into \FileDiff\ objects containing before/after line ranges, and a \diff\_standardizer\ module that normalizes file rewrites by ignoring spurious whitespace changes. These utilities are supported by a comprehensive set of test fixtures (e.g., \confusing.diff\, \multiline\_edit.diff\) and snapshot tests to ensure correct parsing of various diff scenarios.

crates/util · high confidence

A change to existing behaviour in crates/wasm-bindings/wasm\_parsers — 24 commits (6 fixs), 24 files.

_crates/wasm-bindings/wasm\parsers · medium confidence · unverified

The CLI binary's main entry point has been updated to call \run\_command\_with\_tracing\ instead of the previous command execution path. This change ensures that tracing is initialized before any commands run, which is necessary for the logging and observability features to function correctly.

_crates/cli\bin/src · high confidence

The CLI now sends usage analytics to PostHog instead of Segment. This change introduces a new analytics module that tracks command invocations, completions, and errors, capturing details like the command name, arguments, and execution time. A dedicated PostHog client handles the data transmission, and the system respects user telemetry preferences to ensure privacy.

crates/cli/src · high confidence

The internal tree-sitter Markdown parser has been replaced with the open-source \tree-sitter-markdown\ library, introducing both block-level (\tree-sitter-markdown\) and inline (\tree-sitter-markdown-inline\) grammars. This update brings improved support for Markdown headers and inline elements, including more robust parsing of link destinations, HTML tags, and emphasis delimiters, ensuring that Markdown documents are now parsed using a standardized, community-maintained grammar engine.

resources/language-metavariables/tree-sitter-markdown/tree-sitter-markdown, resources/language-metavariables/tree-sitter-markdown/tree-sitter-markdown-inline · high confidence

The pattern-matching logic in \crates/grit-pattern-matcher/src/pattern\ has been replaced with a new implementation. This introduces a comprehensive set of new pattern types—including accessors, accumulators, arithmetic operations (add, divide), positional checks (after, before), logical operators (and, any), assignments, and traversal controls (contains, every, files)—alongside support for dynamic snippets, callbacks, and built-in function calls, fundamentally changing how patterns are evaluated and resolved.

crates/grit-pattern-matcher/src/pattern · high confidence

The resources directory now includes a unified \edit\_grammars.mjs\ script that automates the build, generation, and packaging of Tree-sitter grammars for 21 languages (including C\#, Go, Kotlin, PHP, Ruby, Rust, and TOML). This script standardizes how grammar sources are synced from submodules, generates the necessary parser code, and packages the resulting WASM parsers and node-type definitions into the application's crates, replacing previous ad-hoc or fragmented build processes.

resources · high confidence

The TypeScript and TSX parsers have been updated to new versions, introducing changes to the syntax tree structure. The TSX parser now includes JSX-specific tokens (such as JSX identifiers and text fragments) and has a higher state count (7928 vs 7826) and symbol count (412 vs 393) compared to the TypeScript parser, reflecting the added complexity of JSX syntax. Both grammars now support Glimmer template content and Grit metavariables, and include updated field counts and production IDs, which may affect how code is parsed and analyzed in these languages.

resources/language-metavariables/tree-sitter-typescript/tsx, resources/language-metavariables/tree-sitter-typescript/typescript · high confidence

The vendored tree-sitter dependencies have been updated to new commits: tree-sitter-facade (a26c147), tree-sitter-gritql (f9d9866), and web-tree-sitter (9a01e45). These updates bring in the latest changes from the upstream repositories, which may include bug fixes, performance improvements, or new language support features.

vendor · medium confidence

The gritcache crate now includes a new threaded cache implementation (ThreadedCache) that uses multi-threading for concurrent access, switching to the fs\_err crate to provide more descriptive file error messages. A DynamicCache wrapper allows switching between the threaded cache and a null cache, and the cache directory resolution now checks the GRIT\_CACHE\_DIR environment variable before falling back to local or global grit modules directories, ensuring graceful handling when the cache directory is uninitialized or invalid.

crates/gritcache · high confidence

The YAML and JSON schema parsers have been updated to align with the latest upstream specifications. The YAML parser now supports additional null representations (such as 'Null', 'NULL', and '\~') and recognizes YAML-specific float literals like '.inf', '.Inf', '.INF', '.nan', '.NaN', and '.NAN'. The JSON parser has been updated to enforce stricter integer formatting (rejecting leading zeros) and simplified boolean/null tokenization.

resources/language-metavariables/tree-sitter-yaml/schema/core, resources/language-metavariables/tree-sitter-yaml/schema/json · high confidence

Added integration tests for CLI commands; Added test infrastructure for the CLI binary; Expanded test fixtures for CLI pattern matching and built-in functions; Snapshot tests for CLI apply, check, format, and list commands.

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 66 → 65 (-1.9)
• Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

• Code Health 70 → 70 (-0.1)
• Architecture 96 → 99 (+3.0)
• Maturity 69 → 68 (-0.1)
• Readiness 63 → 58 (-4.5)
• Security 62 → 61 (-0.4)
• Domain Modelling 100 → 100 (+0.0)
• Event Sourcing 100 → 100 (+0.0)

• Critical CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-toml/package-lock.json)
• Critical CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-toml/package-lock.json)
• Documentation: no installation or build instructions (README.md)
• Documentation: no usage examples (README.md)
• High CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-toml/package-lock.json)
• High CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-toml/package-lock.json)
• High CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-markdown/package-lock.json)
• Off-boarding risk: anonymized user #1
• redundant comment (resources/language-metavariables/tree-sitter-c-sharp/tools/highlight-test-generator/Generator.cs)

• Confusingly Named/Overlapping Operations: Binding.get_list_items and ResolvedPattern.get_list_items appear to do the same thing. Additionally, ResolvedPattern has get_list_binding_items which is semantically ambiguous compared to get_list_items. It is unclear what the difference is between 'list items' and 'list binding items'.
• Critical CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-toml/package-lock.json)
• Critical CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-toml/package-lock.json)
• Duplicate Intent: Both Binding and ResolvedPattern expose is_list(). Since ResolvedPattern is the resolved form of a Binding (or closely related), checking if a binding is a list should ideally be a single source of truth or clearly differentiated (e.g., one checks the AST structure, the other checks the resolved value type). Currently, it's unclear if they check the same thing.
• End-of-life runtime: .NET net6.0
• End-of-life runtime: Rust 1.82
• High CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-toml/package-lock.json)
• High CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-toml/package-lock.json)
• High CVE: [GHSA redacted] (resources/language-metavariables/tree-sitter-markdown/package-lock.json)
• Inconsistent Factory Naming: ResolvedPattern has multiple from_*_binding constructors. However, Binding also has from_node, from_path, from_range, etc. It is unclear why ResolvedPattern needs separate from_node_binding vs from_binding (which takes a Binding). This suggests a circular dependency or unclear ownership of the 'binding' concept.
• Inconsistent Position/Range APIs: Binding exposes position, range, and code_range. AstNode exposes byte_range and code_range. The naming is inconsistent (range vs byte_range). Furthermore, Binding.position returns a Range (likely line/col) while Binding.range returns ByteRange. This fragmentation makes it hard to know which method to use for different coordinate systems.
• Low cohesion: TransformedMessenger (LCOM4 6) (crates/cli/src/result_formatting.rs)
• Low cohesion: UncompiledPatternBuilder (LCOM4 4) (crates/core/src/sdk/pattern_sdk.rs)
• Off the main sequence: grit-util
• Off the main sequence: marzano-language
• Off-boarding risk: anonymized user #1
• Redundant/Inconsistent Text Retrieval: Multiple types expose methods to retrieve text content, but with inconsistent signatures and responsibilities. Binding.text and ResolvedPattern.text are semantically very similar (retrieving the text of a matched entity), yet Binding does not take a FileRegistry while ResolvedPattern does. AstNode.text is a raw AST method. This creates confusion about which method to call depending on whether you have a Binding, ResolvedPattern, or raw Node.
• Unstable project marzano-lsp
• redundant comment (resources/language-metavariables/tree-sitter-c-sharp/tools/highlight-test-generator/Generator.cs)
• redundant comment (resources/language-metavariables/tree-sitter-c-sharp/tools/highlight-test-generator/Generator.cs)

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

biomejs/gritql was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.