360 Secure SkillHub
360 安全技能中心

ast-grep

提供 ast-grep 结构化代码搜索工作流:先写测试片段和规则,用 --stdin 验证,再搜索代码库;强调关系规则 stopBy: end、shell 转义、元变量限制及 --debug-query 调试,并附完整规则参考。

poteto
热度 0.00
最近更新 2026-10-19 06:44:33
分类:开发依赖:代码执行应用场景:代码审查 / 调试排错 / 研究

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add poteto/noodle/ast-grep
Metadata
name
ast-grep
description
Structural code search via ast-grep — use when code shape and element relationships matter, not just text. E.g., "find async functions without error handling", "refactor foo(a, b) to foo({ a, b })". Use Grep for simple name lookups.

ast-grep

Workflow

  1. Write a test snippet representing the target code
  2. Write the rule (start with pattern, escalate to kind + has/inside if needed)
  3. Test with --stdin before searching the codebase
  4. Search the codebase once the rule matches

Critical Gotchas

Always use stopBy: end on relational rules

Without it, has/inside stop at the first non-matching node instead of traversing the full subtree:

# WRONG — will miss deeply nested matches
has:
  pattern: await $EXPR

# RIGHT
has:
  pattern: await $EXPR
  stopBy: end

Escape metavariables in shell

$VAR gets interpreted by the shell. Either escape or single-quote:

# Double-quoted: escape with backslash
ast-grep scan --inline-rules "id: test
language: javascript
rule:
  pattern: await \$EXPR" .

# Single-quoted: no escaping needed
ast-grep scan --inline-rules 'id: test
language: javascript
rule:
  pattern: await $EXPR' .

Metavariables must be the sole content of an AST node

These don't work: obj.on$EVENT, "Hello $WORLD", a $OP b, $jq

Use $$OP for unnamed nodes (operators, punctuation). Use $$$ARGS for zero-or-more nodes.

Testing with --stdin

echo "async function test() { await fetch(); }" | ast-grep scan --inline-rules 'id: test
language: javascript
rule:
  kind: function_declaration
  has:
    pattern: await $EXPR
    stopBy: end' --stdin

Debugging with --debug-query

When rules don't match, inspect the AST to find correct kind values:

ast-grep run --pattern 'your code here' --lang javascript --debug-query=cst

Formats: cst (all nodes), ast (named only), pattern (how ast-grep sees your pattern).

Rule syntax

See references/rule_reference.md for the full rule reference (atomic, relational, composite rules, and metavariables).