[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M74C4FSJ3C2RCHPJE2AC2MXN":3,"skill-same:01M74C4FSJ3C2RCHPJE2AC2MXN":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":25,"commitSha":26,"skillDirectory":27,"forksCount":28,"repositoryHtmlUrl":29,"repositoryHomepageUrl":6,"ownerHtmlUrl":30,"ownerBlogUrl":31,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M74C4FSJ3C2RCHPJE2AC2MXN","no-mistakes",null,"Answers questions about how code connects: is this dead, still used, or safe to delete; is it only used by tests; where is a symbol used, and which files import or call it; did a rename update every reference; what has to change if a signature, argument, or return type changes; which tests actually need to run for a change, or why the whole suite is running; does a route have e2e coverage; what to run to validate a change before pushing or handing it off; does an empty test plan really mean nothing is affected. Resolves the import graph instead of searching text, so consumers behind workspace aliases, barrel re-exports and transitive test chains are not missed.","jonathanong\u002Fno-mistakes","jonathanong","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F643505?v=4","01M72BK9Y3KZF7M2AM14BMJBAK","jongleberry","01M72BK9YTVF9K5MW3524R0YJ3",11,"MIT","https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: no-mistakes\ndescription: \"Answers questions about how code connects: is this dead, still used, or safe to delete; is it only used by tests; where is a symbol used, and which files import or call it; did a rename update every reference; what has to change if a signature, argument, or return type changes; which tests actually need to run for a change, or why the whole suite is running; does a route have e2e coverage; what to run to validate a change before pushing or handing it off; does an empty test plan really mean nothing is affected. Resolves the import graph instead of searching text, so consumers behind workspace aliases, barrel re-exports and transitive test chains are not missed.\"\nallowed-tools: Bash(no-mistakes:*) Bash(rg:*) Read Glob\n---\n\n# No Mistakes\n\nUse `no-mistakes` for structural codebase questions: import and test impact,\npublic symbols, static route\u002Ffetch\u002Fqueue relationships, or configured project\nchecks. Use `rg` after a graph query for exact call lines, comments, strings,\nor unsupported\u002Fdynamic forms. The mistakes this prevents are catalogued in\n[why.md](references\u002Fwhy.md).\n\n## When to activate\n\nUse `no-mistakes` when skipping the graph would miss callers, tests, or\ncoverage: a change that crosses packages or aliases, transitive test impact,\nPlaywright\u002Froute\u002Fqueue questions, or configured checks. For one local TS\u002FJS\nfile's direct static importers, use `no-mistakes importers \u003Cfile>`; otherwise\nuse the graph command below. For non-code text and exact syntax use `rg`\ndirectly.\n\n## Change lifecycle\n\nFor an existing file, plan before editing; for a new file, rerun after it\nexists. Recheck changed files after editing, then validate before handoff.\n\n```bash\n# Before editing: scope impact and focused tests.\nno-mistakes dependents \u003Cfile> --format json\nno-mistakes tests plan vitest --changed-file \u003Cfile> --format json\n\n# After editing: request the complete local validation set.\nno-mistakes impacted-checks \u003Cfile...> --format json\n\n# Before handoff: resolve imports and run configured checks.\nno-mistakes resolve-check \u003Cfile...> --format json\nno-mistakes check --format json\n```\n\n`no-mistakes check --include-sql-verdicts --format json` adds the opt-in SQL verdict ledger and does not change findings.\n`no-mistakes check --effort low --format json` requests low effort for rules\nthat implement it; adoption is rule-specific and documented in each rule's\nEffort section. Examples include PostgreSQL SQL checks, Next.js checks, and\nPlaywright checks. `max` is the default and preserves current analysis.\n`test-no-unmocked-dynamic-imports` at `low` accepts only a top-level static\nimport, a `vi.mock` or `jest.mock` call, or a literal `require()` in setup\nfiles; other setup-reachability shapes follow `unanalyzable`.\n`playwright-unique-test-ids` and `playwright-coverage` at `low` accept a\nstring literal test id, including JSX `data-testid={\"save\"}`, or a prop with a\nliteral default; other selector shapes follow `unanalyzable`.\n`playwright-unique-html-ids` at `low` accepts a string literal HTML id,\nincluding JSX `id={\"save\"}`, or a prop with a literal default; other id\nexpressions follow `unanalyzable`.\n`nextjs-no-caching` at `low` checks literal fetch options, route segment exports,\nand direct configuration objects; indirect settings follow `unanalyzable`.\n`require-storybook-stories` at `low` keeps direct story and configured colocated\ntest coverage; coverage requiring render-chain or dynamic\u002Fmock boundary analysis\nfollows `unanalyzable`.\n`postgres-no-offset` at `low` supports literal SQL and bounded helper\u002Fbuilder\nrecovery; SQL-template interpolations in configured bind templates are values,\nnot SQL text. Unsupported shapes follow `unanalyzable`, and selected `.sql`\nfiles retain their existing checks. See the\n[bounded helper contract](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fpostgres-facts\u002Flow-helper-recovery.md).\n`postgres-no-test-state-mutation` supports `low` for configured test SQL,\nbounded source helpers, and finite inline Vitest row selections;\ncomplete banned statements before opaque SQL remain findings, while unknown\ntails follow `unanalyzable`. See its\n[Effort section](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-test-state-mutation.md#effort).\n`postgres-explicit-columns` and `postgres-required-predicates` also support\n`low` for literal SQL and the bounded helper subset; unsupported or residual\ninputs follow `unanalyzable`. See the\n[explicit-columns](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-explicit-columns.md#effort) and\n[required-predicates](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-required-predicates.md#effort)\nEffort sections and the\n[bounded helper contract](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fpostgres-facts\u002Flow-helper-recovery.md).\nIf a low-effort rule's required partner check is missing or outside its\nconfigured scope, the check warns and falls back to `max` for that rule.\nJSON reports include `analysisFallbacks` for these partner fallbacks and omit\nthe field when none occurred. A rule without a low implementation emits a\nnamed, non-failing warning when low was requested and stays at `max`.\n[`github-actions-job-timeouts`](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fgithub-actions-job-timeouts.md#effort)\nis the example: `low` needs a covering `github-actions-step-timeouts` partner,\nand otherwise warns and falls back to `max`.\n\nFor `github-actions-checkout-credentials`, uncertain persistence, permissions,\ncustom tokens (including `secrets.GITHUB_TOKEN`), and invalid workflow YAML\nfollow `unanalyzable: report | advise | ignore` (default `report`). Set\n`with.persist-credentials: false` or use the default token with literal\nread-only permissions. Reusable declarations are known upper bounds; unsafe\nwrite bounds stay failing under every policy. Job permissions override workflow\ndefaults, and valid workflows without checkout have no finding. Inspect advisories before\ntreating a run as clean. For `pull_request_target`, a PR-head ref is a definite\nrisk even with false persistence; unresolved refs\u002Frepositories follow the policy.\nUse the base repository, a base-side ref, AND literal false. Declare YAML\n`options.defaultBranch` for a literal default-branch name; no name is guessed.\nCredential\u002Fref risks can produce separate rows on the same checkout.\n\nRepository and rule settings use `effort` and `unanalyzable`; the older\nSQL-specific `unanalyzableSql` setting remains an alias.\nFor `shellcheck-runner`, the shared policy handles a missing executable or a\nfailed invocation with no recognized diagnostics. If an abnormal exit has\nsome recognized diagnostics, those findings remain and the policy handles\nselected scripts without recognized diagnostics. Use `unanalyzable: report`\n(the default), `advise`, or `ignore` to choose whether incomplete analysis\nfails, advises, or is skipped; install ShellCheck and repair failed\ninvocations. Other launcher errors, such as permission denied, are hard errors.\n\nFor `unconstructed-error-class`, unresolved constructor targets and otherwise-unused\nclasses with unresolved constructors or base ancestry produce non-failing\nadvisories even with `options.unanalyzable: report` (the default).\n`advise` also advises; `ignore` omits these diagnostics. Namespace-escape-only\nuncertainty keeps the shared policy: `report` fails, `advise` advises, and\n`ignore` omits it. Definite unused Error classes remain failures under every\npolicy. Known constructor targets reuse the prepared resolver, including\npath aliases, workspace root\u002Fwildcard exports and re-exports, and usable package\ndeclarations, and credit the actual class even outside the rule include.\nImmutable constructor aliases and declaration members typed `typeof NamedClass`\nretain the concrete class identity. Included ambient module declarations and\ntsconfig-visible ambient modules, including `export =` namespaces, can prove a\nnon-Error base; a bare constructor signature cannot. Unset `types` does not\nscan installed packages. A relative `extends` path, including one that omits\nits json suffix, resolves the same way as the catalog. Known non-Error\nglobals are quiet; shadowed names resolve independently.\nTyped constant facades follow the immutable initializer through export barrels.\nDeclarations use the re-exporting package's dependency context. Static imports\nand re-exports in `.mts`\u002F`.mjs` select conditional `import` declarations;\n`.cts`\u002F`.cjs` select `require`. Ambiguous contexts retain branch-agreement checks.\nNon-Error targets are silent; otherwise-unused Error subclasses still fail under\nevery policy.\nOrdinary import\u002Fcall query results remain unchanged. Suppressions apply at the\nconstruction or class line in both report channels. The rule remains `max`\nonly; a requested `low` warns and runs `max`.\n\nFor `version-pin-consistency`, a missing, unreadable, or malformed declared\ncomparison source outside the selected file set for a selected anchor, or a\nselected anchor that cannot be read as UTF-8, follows `unanalyzable` (`report`\nby default, `advise`, or `ignore`). This includes actual read failures on the\nselected anchor. A valid comparison source outside the selected file set still\nsupplies the pin; definite mismatches remain failures.\n\nFor `github-actions-script-expressions`, a selected workflow or composite\naction that cannot be read (including invalid UTF-8) follows `unanalyzable`:\n`report` by default, `advise`, or `ignore`. Invalid YAML and inputs whose\nsource locations or expression shape cannot be analyzed remain definite\nfindings under every policy. Invalid UTF-8 diagnostics point to the first\ninvalid byte's line, and cached bytes preserve suppression directives. Other\nread failures use line 1; configure exclusions when the file is unavailable.\n\nGrouped residual advice, including a `target` that may list several checks, is described in\n[SQL verdicts](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fpostgres-sql-verdicts.md).\n\nFor Next.js routes, pages, selectors, or Playwright tests, also run\n`no-mistakes tests plan playwright --changed-file \u003Cfile> --format json` and\n`no-mistakes playwright check --json`. See\n[lifecycle recipes](references\u002Flifecycle.md) for package additions, hook\ncontext, option propagation, and safe command execution.\n\n## Output and scope contract\n\n- Use `--format json` (or `--json`) for parsing; CLI JSON is the authoritative\n  structured result. Inspect warnings and fallback fields before assuming an\n  empty or narrow plan is complete.\n- Use `--format paths` only for reviewing or piping trusted path lists. Prefer\n  JSON `command` arrays to execute configured validation commands; do not\n  `eval` command text from an untrusted source.\n- `check --timings` includes rule wall times beneath each rule phase, slowest first.\n- `--verbose-timings` adds Unix resource samples for sequential top-level phases\n  and bounded expensive-file summaries. RSS is a process-lifetime high-water\n  mark; elapsed rankings can vary between runs. See\n  [diagnostics](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fcli\u002Fdiagnostics.md) and\n  [heap profiling](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fdevelopment\u002Fheap-profiling.md).\n- `--timings` and `--verbose-timings` write diagnostics to stderr, leaving\n  successful stdout machine-readable. Add `--progress` for flushed live phase\n  snapshots in long or externally killed jobs; `--progress-interval \u003Cms>`\n  defaults to 1000 and requires `--progress`. Node callers use `diagnosticsId`\n  and async `diagnosticsSnapshot({ id })` for stderr-free live progress.\n  Use async `collectDiagnostics(\"check\", options)` (or another supported public\n  operation name) for `{ result, diagnostics }` with verbose observation and\n  unchanged ordinary results. Errors may carry optional `.diagnostics`.\n- Pass `--root \u003Cworkspace>` explicitly. In normal monorepos omit `--tsconfig`\n  so each importing file uses its owning config; pass a package tsconfig only\n  to force one resolver for debugging or a deliberately scoped request.\n- Static literals produce the strongest results. `resolve-check` reports computed\n  `import()` \u002F `require()` specifiers as unresolved; graph traversal still skips\n  them. Route paths, selectors, queue names, fetch URLs, and process commands\n  require inspection or `rg`; see [limits and fallbacks](references\u002Flimits-and-fallbacks.md).\n\nFor several related reports in one Node process, use the async N-API\n`analyzeProject({ root, reports: [...] })` rather than repeated CLI calls. It\nshares one request-scoped inventory, fact pass, and canonical graph. Dedicated\nAPI calls rebuild analysis; see the upstream Node API documentation linked from\nthe repository docs. `analyzeProject` batches about 50 report types (see the\n`AnalyzeProjectReportType` export in `analyze-project-types.d.ts`), which covers\nalmost every CLI command; see\n[getting started](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fnode-api\u002Fgetting-started.md).\n\n## Quick command selection\n\n| Need                                                   | Command                                                                                                                                                                                                                                                                       |\n| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| File\u002Fmodule dependencies                               | `no-mistakes dependencies \u003Cfile> --format json`                                                                                                                                                                                                                               |\n| Files or named-export consumers                        | `no-mistakes dependents \u003Cfile>[#SYMBOL] --format json`                                                                                                                                                                                                                        |\n| Direct static importers                                | `no-mistakes importers \u003Cfile> --format json`                                                                                                                                                                                                                                  |\n| Literal import specifiers                              | `no-mistakes import-usages --root . --filter 'src\u002F**' --format json`                                                                                                                                                                                                          |\n| Public API, imports, or signature blast radius         | `no-mistakes symbols \u003Cfile> --include both --format json`; add `--mode signature-impact --symbol NAME`                                                                                                                                                                        |\n| Named exports and their consumers                      | `no-mistakes exports-of \u003Cfile> --format json`                                                                                                                                                                                                                                 |\n| Is an export unused?                                   | `no-mistakes dead-exports \u003Cfile> [NAME...]`                                                                                                                                                                                                                                   |\n| Function calls and static argument shapes              | `no-mistakes call-sites \u003Cfile> NAME --format json`                                                                                                                                                                                                                            |\n| Tests for a changed file or diff                       | `no-mistakes tests plan \u003Cframework> --changed-file \u003Cfile> --format json`; use `--from-git-diff base...head` for a diff                                                                                                                                                        |\n| Explain selected tests                                 | `no-mistakes tests why \u003Ctest> --plan plan.json --format json`                                                                                                                                                                                                                 |\n| Exact runner commands                                  | `no-mistakes tests plan \u003Cframework> --changed-file \u003Cfile> --format commands`                                                                                                                                                                                                  |\n| Runner command for one known test file                 | `no-mistakes tests targets \u003Cframework> \u003Ctest-file> --format commands`                                                                                                                                                                                                         |\n| Combined tests, lint, typecheck, and configured checks | `no-mistakes impacted-checks \u003Cfile...> --format json`                                                                                                                                                                                                                         |\n| Playwright coverage or related tests                   | `no-mistakes playwright check --json`; `no-mistakes playwright related \u003Cfile> --json`                                                                                                                                                                                         |\n| React callers and component traits                     | `no-mistakes react usages \u003Cfile>#Component --format json`; `no-mistakes react analyze \u003Cglob> --format json`                                                                                                                                                                   |\n| Next.js page-to-API coupling                           | `no-mistakes fetches \u003Croute-or-file> --format json`                                                                                                                                                                                                                           |\n| Queue\u002Fserver graph                                     | `no-mistakes queues related \u003Cfile> --format json`; `no-mistakes server related \u003Cfile> --format json`; `no-mistakes server contracts --format json`                                                                                                                            |\n| CI or workflow impact                                  | `no-mistakes ci impact \u003Cfile> --format json`; `no-mistakes ci env \u003CNAME> --format json`; `no-mistakes ci topology --format json`; `no-mistakes ci topology-impact --root . --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --entry-workflow ci.yml`                                     |\n| Private CI planning artifacts (npm package)            | `no-mistakes planning-impact --changed-files \u003Cmanifest> --output-dir \u003Cdirectory>`                                                                                                                                                                                             |\n| Terraform\u002FOpenTofu or Swift                            | `no-mistakes infra resource-refs \u003Ctype.name> --format json`; `no-mistakes infra outputs \u003Cmodule-dir> --format json`; `no-mistakes infra test-for \u003Cfile.tf> --format json`; `no-mistakes swift importers \u003Cfile> --format json`; `no-mistakes swift test-targets \u003Cfile> --json` |\n| Effective resolved config                              | `no-mistakes config resolve` (expanded report); `no-mistakes config resolve --view declared` (merged declarations)                                                                                                                                                                                                                                                  |\n| Configured language graph                              | `no-mistakes dependents \u003Cfile> --relationship \u003Clang> --format json`                                                                                                                                                                                                           |\n\n`tests plan` supports `vitest`, `playwright`, `jest`, `dotnet`, `swift`,\n`python`, `go`, `cargo`, `rails`, `php`, `java`, `kotlin`, `elixir`, and `dart`\nwhen the matching language\u002Ftest configuration is present. `dependents --test`\nis a lower-level fallback; prefer the planner because it includes configured\ngroups, limits, diffs, and deleted-file behavior.\n\n## Reference routing\n\n- [why.md](references\u002Fwhy.md): mistakes this graph exists to prevent.\n- [lifecycle.md](references\u002Flifecycle.md): before-edit, after-edit, and\n  handoff recipes.\n- [decision-tree.md](references\u002Fdecision-tree.md): command, relationship, and\n  output selection.\n- [dependencies.md](references\u002Fdependencies.md) and\n  [dependents.md](references\u002Fdependents.md): graph traversal, filtering, and\n  `FILE#SYMBOL` semantics.\n- [symbols.md](references\u002Fsymbols.md) and\n  [lightweight-queries.md](references\u002Flightweight-queries.md): symbols,\n  importers, literal import specifiers, exports, call sites, and resolution\n  checks.\n- [tests.md](references\u002Ftests.md): planners, diffs, environments, fallbacks,\n  explain output, and runner commands.\n- [playwright.md](references\u002Fplaywright.md): selector, route, and assertion\n  coverage commands.\n- [postgres-source.md](references\u002Fpostgres-source.md): pure async SQL source\n  facts, partial diagnostics, and dependency completeness.\n- [impact-recipes.md](references\u002Fimpact-recipes.md): selector, API shape,\n  package-entrypoint, workflow, test-deletion, and queue recipes.\n- [workflow-activity-types.md](references\u002Fworkflow-activity-types.md): ban explicit trigger activity types with optional event filters.\n- [workflow-secret-inventory.md](references\u002Fworkflow-secret-inventory.md): configure and interpret opt-in workflow secret-name checks.\n- [monorepo-resolution.md](references\u002Fmonorepo-resolution.md): workspace\n  aliases and resolver ownership.\n- [limits-and-fallbacks.md](references\u002Flimits-and-fallbacks.md): unsupported\n  forms, confidence limits, and `rg` fallbacks.\n\nFor the schema catalog that PostgreSQL rules read through `schemaCatalogPath`, use `postgres catalog --connection-env DATABASE_URL --schema public --output db\u002Fschema.json`. This reads PostgreSQL metadata directly and writes a complete catalog that every catalog rule accepts; add `--coverage ordering` for only the facts conflict and lock ordering need. It is the only catalog format no-mistakes reads, and it does not read application snapshots.\n\nTo enforce primary-key and foreign-key column types, configure the\n`postgres-key-column-types` rule with a nonempty `allowedTypes` list and\n`schemaCatalogPath`. Add `allowEnumTypes: true` only when enum keys are\nintentional. Exceptions use reasoned allow entries for the exact\n`constraint:\u003Ctable>.\u003Cconstraint>` target; stale targets are reported.\n\nWhen SQL searches schemas before `pg_temp`, request their complete relation-name\ninventories explicitly with repeated `--search-path-schema` options. Include\n`pg_catalog` when it is omitted from the configured path because PostgreSQL\nsearches it first. For example, for `search_path = public, pg_temp`:\n\n```sh\nno-mistakes postgres catalog --connection-env DATABASE_URL --schema public --search-path-schema pg_catalog --search-path-schema public --output db\u002Fschema.json\n```\n\nGenerate the catalog with the role that executes the analyzed SQL. An absent\n`searchPathEvidence` entry gives no evidence of absence; `null` means the schema\nwas missing or the role lacked `USAGE`. If a required inventory is unavailable,\nretain the rule's conservative findings and regenerate with appropriate schema\naccess rather than treating unavailable evidence as an empty schema. Schema\ninventories remain explicit opt-in. See [catalog options](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fcli\u002Fpostgres.md).\n\nGenerated catalogs also record the exact connected database in `currentDatabase`.\nOlder catalogs omit that evidence, so database qualification stays conservative.\n\nTo keep test SQL from changing shared PostgreSQL state, enable\n`postgres-no-test-state-mutation` with explicit `testGlobs`, optional\n`helperRoots`, and an executor `importSpecifier` (or inherit one from the\nselected project's `postgres` block). It bans schema DDL, `TRUNCATE`,\n`ALTER SYSTEM`, replication-role changes, and `pg_sleep` in executed test SQL.\nMove schema setup into migrations and inject a throwing executor for failure\ntests. See [test state mutation](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-test-state-mutation.md).\nFor other statement policies, configure `postgres-sql-statement-policy` with\n`bannedStatements` and `bannedSettings`; `sqlInclude` selects raw SQL files.\nSee the [statement policy](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-sql-statement-policy.md).\n\nTo catch cross-file SQL identifier registries and unbounded env\u002Fconfig\u002Fparameter\nsources, enable `postgres-no-mutable-sql-registry` and\n`postgres-no-unbounded-sql-identifier`. Inherit `importSpecifier` from\n`projects.\u003Cname>.postgres` instead of restating it on the rule. They use\nprepared import, value-flow, and embedded-SQL facts. Unknown provenance stays\nsilent.\nSee [mutable SQL registries](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-mutable-sql-registry.md)\nand [unbounded SQL identifiers](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-unbounded-sql-identifier.md).\n\nTo ban SQL sleeps or another configured function family, enable\n`postgres-sql-shape-policy` with `bannedShapes: [banned-function-call]` and a\nnonempty `shapeOptions.bannedFunctionCall.functions` list. Calls in expressions,\nCTEs, subqueries, and recoverable PL\u002FpgSQL bodies use the same prepared facts.\nConfigure `trustedSqlTags` for custom named SQL tag imports. See\n[shape policy](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-sql-shape-policy.md).\n\nTo keep catalog-resolved UUID columns bare in WHERE, JOIN ON, and HAVING, use\n`postgres-no-transformed-uuid-predicates` with `schemaCatalogPath`. It rejects\ncolumn-side casts and functions while allowing parameter casts and precomputed\nbounds. Literal SQL supports `effort: low`; see the rule's\n[analysis contract](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-transformed-uuid-predicates.md#analysis).\n\nTo review row identifiers stored in top-level JSON keys or unique fingerprint\ncolumns, configure the advisory\n[`postgres-json-relation-ids`](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-json-relation-ids.md)\nrule. It is silent with no configured patterns; use `schemaCatalogPath` when\nyou configure `keyColumnMap` or `fingerprintNamePattern`.\n\nFor test files that must always run in CI, enable the ESLint\u002FOxlint\n`no-mistakes\u002Ftest-no-skips` rule in explicit flat-config `files` globs.\nIt checks Vitest\u002FPlaywright modifiers and bound Vitest context `skip()` calls;\n`allow` permits named exceptions such as `todo`. Same-file `.extend()` wrappers\nstay bound; `testModules` names Playwright fixture modules whose exported\n`test` should be checked. See\n[the plugin options reference](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Feslint-plugin.md#test-no-skips). This is a\nsingle-file plugin rule, so invoke the configured linter rather than a\n`no-mistakes check` catalog scan.\n\nEnable ESLint\u002FOxlint `no-mistakes\u002Fvitest-timeout-cap` with explicit test and\nVitest config\u002Fproject `files` globs to cap defaults (`defaultMax`, `5000` ms)\nand test\u002Fhook\u002Fsuite overrides (`overrideMax`, `30000` ms). Same-module numeric\nconstants resolve; `unknownValues: \"finding\"` reports unresolved values.\nSee [plugin options](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Feslint-plugin.md#vitest-timeout-cap).\nThis file-specific capability uses the configured linter rather than a\nrepository catalog scan.\n\nFor `github-actions-max-inline-script-lines`, `maxLines` (default 10) counts non-blank\nbody lines, joining backslash continuations, in workflow\u002Fcomposite `run` and `actions\u002Fgithub-script` scripts.\nMove oversized scripts into files and invoke them; see the\n[rule reference](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fgithub-actions-max-inline-script-lines.md).\n\n\nUse `postgres-column-check-constraints` with a catalog path and explicit column\nglobs, integer types, and `require: non-negative` to check schema lower bounds.\nUse application-level `severity: advisory` for adoption; the default error\nseverity enforces failures. Exceptions\nneed an exact `table.column` and reason. See\n[the rule](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-column-check-constraints.md).\n\nUse `postgres-materialized-view-shape` to require refresh and read indexes and\nbounded base-table reads. Adopt with application-level `severity: advisory`;\nthe default severity is `error`. See the catalog configuration and examples in\n[PostgreSQL source analysis](references\u002Fpostgres-source.md).\n\nFor catalog-backed grouping review, configure\n[`postgres-grouping-not-aggregation`](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-grouping-not-aggregation.md)\nand run `no-mistakes check --root \u003Croot> --format json`. Read `advisories` and\nfilter their `target` by the five shape codes. No catalog means no findings.\nThe rule is always advisory; use normal source disable directives for measured\nexceptions and async `check()` \u002F `analyzeProject()` for repeated in-process work.\n","# No Mistakes\n\nUse `no-mistakes` for structural codebase questions: import and test impact,\npublic symbols, static route\u002Ffetch\u002Fqueue relationships, or configured project\nchecks. Use `rg` after a graph query for exact call lines, comments, strings,\nor unsupported\u002Fdynamic forms. The mistakes this prevents are catalogued in\n[why.md](references\u002Fwhy.md).\n\n## When to activate\n\nUse `no-mistakes` when skipping the graph would miss callers, tests, or\ncoverage: a change that crosses packages or aliases, transitive test impact,\nPlaywright\u002Froute\u002Fqueue questions, or configured checks. For one local TS\u002FJS\nfile's direct static importers, use `no-mistakes importers \u003Cfile>`; otherwise\nuse the graph command below. For non-code text and exact syntax use `rg`\ndirectly.\n\n## Change lifecycle\n\nFor an existing file, plan before editing; for a new file, rerun after it\nexists. Recheck changed files after editing, then validate before handoff.\n\n```bash\n# Before editing: scope impact and focused tests.\nno-mistakes dependents \u003Cfile> --format json\nno-mistakes tests plan vitest --changed-file \u003Cfile> --format json\n\n# After editing: request the complete local validation set.\nno-mistakes impacted-checks \u003Cfile...> --format json\n\n# Before handoff: resolve imports and run configured checks.\nno-mistakes resolve-check \u003Cfile...> --format json\nno-mistakes check --format json\n```\n\n`no-mistakes check --include-sql-verdicts --format json` adds the opt-in SQL verdict ledger and does not change findings.\n`no-mistakes check --effort low --format json` requests low effort for rules\nthat implement it; adoption is rule-specific and documented in each rule's\nEffort section. Examples include PostgreSQL SQL checks, Next.js checks, and\nPlaywright checks. `max` is the default and preserves current analysis.\n`test-no-unmocked-dynamic-imports` at `low` accepts only a top-level static\nimport, a `vi.mock` or `jest.mock` call, or a literal `require()` in setup\nfiles; other setup-reachability shapes follow `unanalyzable`.\n`playwright-unique-test-ids` and `playwright-coverage` at `low` accept a\nstring literal test id, including JSX `data-testid={\"save\"}`, or a prop with a\nliteral default; other selector shapes follow `unanalyzable`.\n`playwright-unique-html-ids` at `low` accepts a string literal HTML id,\nincluding JSX `id={\"save\"}`, or a prop with a literal default; other id\nexpressions follow `unanalyzable`.\n`nextjs-no-caching` at `low` checks literal fetch options, route segment exports,\nand direct configuration objects; indirect settings follow `unanalyzable`.\n`require-storybook-stories` at `low` keeps direct story and configured colocated\ntest coverage; coverage requiring render-chain or dynamic\u002Fmock boundary analysis\nfollows `unanalyzable`.\n`postgres-no-offset` at `low` supports literal SQL and bounded helper\u002Fbuilder\nrecovery; SQL-template interpolations in configured bind templates are values,\nnot SQL text. Unsupported shapes follow `unanalyzable`, and selected `.sql`\nfiles retain their existing checks. See the\n[bounded helper contract](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fpostgres-facts\u002Flow-helper-recovery.md).\n`postgres-no-test-state-mutation` supports `low` for configured test SQL,\nbounded source helpers, and finite inline Vitest row selections;\ncomplete banned statements before opaque SQL remain findings, while unknown\ntails follow `unanalyzable`. See its\n[Effort section](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-test-state-mutation.md#effort).\n`postgres-explicit-columns` and `postgres-required-predicates` also support\n`low` for literal SQL and the bounded helper subset; unsupported or residual\ninputs follow `unanalyzable`. See the\n[explicit-columns](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-explicit-columns.md#effort) and\n[required-predicates](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-required-predicates.md#effort)\nEffort sections and the\n[bounded helper contract](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fpostgres-facts\u002Flow-helper-recovery.md).\nIf a low-effort rule's required partner check is missing or outside its\nconfigured scope, the check warns and falls back to `max` for that rule.\nJSON reports include `analysisFallbacks` for these partner fallbacks and omit\nthe field when none occurred. A rule without a low implementation emits a\nnamed, non-failing warning when low was requested and stays at `max`.\n[`github-actions-job-timeouts`](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fgithub-actions-job-timeouts.md#effort)\nis the example: `low` needs a covering `github-actions-step-timeouts` partner,\nand otherwise warns and falls back to `max`.\n\nFor `github-actions-checkout-credentials`, uncertain persistence, permissions,\ncustom tokens (including `secrets.GITHUB_TOKEN`), and invalid workflow YAML\nfollow `unanalyzable: report | advise | ignore` (default `report`). Set\n`with.persist-credentials: false` or use the default token with literal\nread-only permissions. Reusable declarations are known upper bounds; unsafe\nwrite bounds stay failing under every policy. Job permissions override workflow\ndefaults, and valid workflows without checkout have no finding. Inspect advisories before\ntreating a run as clean. For `pull_request_target`, a PR-head ref is a definite\nrisk even with false persistence; unresolved refs\u002Frepositories follow the policy.\nUse the base repository, a base-side ref, AND literal false. Declare YAML\n`options.defaultBranch` for a literal default-branch name; no name is guessed.\nCredential\u002Fref risks can produce separate rows on the same checkout.\n\nRepository and rule settings use `effort` and `unanalyzable`; the older\nSQL-specific `unanalyzableSql` setting remains an alias.\nFor `shellcheck-runner`, the shared policy handles a missing executable or a\nfailed invocation with no recognized diagnostics. If an abnormal exit has\nsome recognized diagnostics, those findings remain and the policy handles\nselected scripts without recognized diagnostics. Use `unanalyzable: report`\n(the default), `advise`, or `ignore` to choose whether incomplete analysis\nfails, advises, or is skipped; install ShellCheck and repair failed\ninvocations. Other launcher errors, such as permission denied, are hard errors.\n\nFor `unconstructed-error-class`, unresolved constructor targets and otherwise-unused\nclasses with unresolved constructors or base ancestry produce non-failing\nadvisories even with `options.unanalyzable: report` (the default).\n`advise` also advises; `ignore` omits these diagnostics. Namespace-escape-only\nuncertainty keeps the shared policy: `report` fails, `advise` advises, and\n`ignore` omits it. Definite unused Error classes remain failures under every\npolicy. Known constructor targets reuse the prepared resolver, including\npath aliases, workspace root\u002Fwildcard exports and re-exports, and usable package\ndeclarations, and credit the actual class even outside the rule include.\nImmutable constructor aliases and declaration members typed `typeof NamedClass`\nretain the concrete class identity. Included ambient module declarations and\ntsconfig-visible ambient modules, including `export =` namespaces, can prove a\nnon-Error base; a bare constructor signature cannot. Unset `types` does not\nscan installed packages. A relative `extends` path, including one that omits\nits json suffix, resolves the same way as the catalog. Known non-Error\nglobals are quiet; shadowed names resolve independently.\nTyped constant facades follow the immutable initializer through export barrels.\nDeclarations use the re-exporting package's dependency context. Static imports\nand re-exports in `.mts`\u002F`.mjs` select conditional `import` declarations;\n`.cts`\u002F`.cjs` select `require`. Ambiguous contexts retain branch-agreement checks.\nNon-Error targets are silent; otherwise-unused Error subclasses still fail under\nevery policy.\nOrdinary import\u002Fcall query results remain unchanged. Suppressions apply at the\nconstruction or class line in both report channels. The rule remains `max`\nonly; a requested `low` warns and runs `max`.\n\nFor `version-pin-consistency`, a missing, unreadable, or malformed declared\ncomparison source outside the selected file set for a selected anchor, or a\nselected anchor that cannot be read as UTF-8, follows `unanalyzable` (`report`\nby default, `advise`, or `ignore`). This includes actual read failures on the\nselected anchor. A valid comparison source outside the selected file set still\nsupplies the pin; definite mismatches remain failures.\n\nFor `github-actions-script-expressions`, a selected workflow or composite\naction that cannot be read (including invalid UTF-8) follows `unanalyzable`:\n`report` by default, `advise`, or `ignore`. Invalid YAML and inputs whose\nsource locations or expression shape cannot be analyzed remain definite\nfindings under every policy. Invalid UTF-8 diagnostics point to the first\ninvalid byte's line, and cached bytes preserve suppression directives. Other\nread failures use line 1; configure exclusions when the file is unavailable.\n\nGrouped residual advice, including a `target` that may list several checks, is described in\n[SQL verdicts](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fpostgres-sql-verdicts.md).\n\nFor Next.js routes, pages, selectors, or Playwright tests, also run\n`no-mistakes tests plan playwright --changed-file \u003Cfile> --format json` and\n`no-mistakes playwright check --json`. See\n[lifecycle recipes](references\u002Flifecycle.md) for package additions, hook\ncontext, option propagation, and safe command execution.\n\n## Output and scope contract\n\n- Use `--format json` (or `--json`) for parsing; CLI JSON is the authoritative\n  structured result. Inspect warnings and fallback fields before assuming an\n  empty or narrow plan is complete.\n- Use `--format paths` only for reviewing or piping trusted path lists. Prefer\n  JSON `command` arrays to execute configured validation commands; do not\n  `eval` command text from an untrusted source.\n- `check --timings` includes rule wall times beneath each rule phase, slowest first.\n- `--verbose-timings` adds Unix resource samples for sequential top-level phases\n  and bounded expensive-file summaries. RSS is a process-lifetime high-water\n  mark; elapsed rankings can vary between runs. See\n  [diagnostics](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fcli\u002Fdiagnostics.md) and\n  [heap profiling](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fdevelopment\u002Fheap-profiling.md).\n- `--timings` and `--verbose-timings` write diagnostics to stderr, leaving\n  successful stdout machine-readable. Add `--progress` for flushed live phase\n  snapshots in long or externally killed jobs; `--progress-interval \u003Cms>`\n  defaults to 1000 and requires `--progress`. Node callers use `diagnosticsId`\n  and async `diagnosticsSnapshot({ id })` for stderr-free live progress.\n  Use async `collectDiagnostics(\"check\", options)` (or another supported public\n  operation name) for `{ result, diagnostics }` with verbose observation and\n  unchanged ordinary results. Errors may carry optional `.diagnostics`.\n- Pass `--root \u003Cworkspace>` explicitly. In normal monorepos omit `--tsconfig`\n  so each importing file uses its owning config; pass a package tsconfig only\n  to force one resolver for debugging or a deliberately scoped request.\n- Static literals produce the strongest results. `resolve-check` reports computed\n  `import()` \u002F `require()` specifiers as unresolved; graph traversal still skips\n  them. Route paths, selectors, queue names, fetch URLs, and process commands\n  require inspection or `rg`; see [limits and fallbacks](references\u002Flimits-and-fallbacks.md).\n\nFor several related reports in one Node process, use the async N-API\n`analyzeProject({ root, reports: [...] })` rather than repeated CLI calls. It\nshares one request-scoped inventory, fact pass, and canonical graph. Dedicated\nAPI calls rebuild analysis; see the upstream Node API documentation linked from\nthe repository docs. `analyzeProject` batches about 50 report types (see the\n`AnalyzeProjectReportType` export in `analyze-project-types.d.ts`), which covers\nalmost every CLI command; see\n[getting started](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fnode-api\u002Fgetting-started.md).\n\n## Quick command selection\n\n| Need                                                   | Command                                                                                                                                                                                                                                                                       |\n| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| File\u002Fmodule dependencies                               | `no-mistakes dependencies \u003Cfile> --format json`                                                                                                                                                                                                                               |\n| Files or named-export consumers                        | `no-mistakes dependents \u003Cfile>[#SYMBOL] --format json`                                                                                                                                                                                                                        |\n| Direct static importers                                | `no-mistakes importers \u003Cfile> --format json`                                                                                                                                                                                                                                  |\n| Literal import specifiers                              | `no-mistakes import-usages --root . --filter 'src\u002F**' --format json`                                                                                                                                                                                                          |\n| Public API, imports, or signature blast radius         | `no-mistakes symbols \u003Cfile> --include both --format json`; add `--mode signature-impact --symbol NAME`                                                                                                                                                                        |\n| Named exports and their consumers                      | `no-mistakes exports-of \u003Cfile> --format json`                                                                                                                                                                                                                                 |\n| Is an export unused?                                   | `no-mistakes dead-exports \u003Cfile> [NAME...]`                                                                                                                                                                                                                                   |\n| Function calls and static argument shapes              | `no-mistakes call-sites \u003Cfile> NAME --format json`                                                                                                                                                                                                                            |\n| Tests for a changed file or diff                       | `no-mistakes tests plan \u003Cframework> --changed-file \u003Cfile> --format json`; use `--from-git-diff base...head` for a diff                                                                                                                                                        |\n| Explain selected tests                                 | `no-mistakes tests why \u003Ctest> --plan plan.json --format json`                                                                                                                                                                                                                 |\n| Exact runner commands                                  | `no-mistakes tests plan \u003Cframework> --changed-file \u003Cfile> --format commands`                                                                                                                                                                                                  |\n| Runner command for one known test file                 | `no-mistakes tests targets \u003Cframework> \u003Ctest-file> --format commands`                                                                                                                                                                                                         |\n| Combined tests, lint, typecheck, and configured checks | `no-mistakes impacted-checks \u003Cfile...> --format json`                                                                                                                                                                                                                         |\n| Playwright coverage or related tests                   | `no-mistakes playwright check --json`; `no-mistakes playwright related \u003Cfile> --json`                                                                                                                                                                                         |\n| React callers and component traits                     | `no-mistakes react usages \u003Cfile>#Component --format json`; `no-mistakes react analyze \u003Cglob> --format json`                                                                                                                                                                   |\n| Next.js page-to-API coupling                           | `no-mistakes fetches \u003Croute-or-file> --format json`                                                                                                                                                                                                                           |\n| Queue\u002Fserver graph                                     | `no-mistakes queues related \u003Cfile> --format json`; `no-mistakes server related \u003Cfile> --format json`; `no-mistakes server contracts --format json`                                                                                                                            |\n| CI or workflow impact                                  | `no-mistakes ci impact \u003Cfile> --format json`; `no-mistakes ci env \u003CNAME> --format json`; `no-mistakes ci topology --format json`; `no-mistakes ci topology-impact --root . --base \"$BASE_SHA\" --head \"$HEAD_SHA\" --entry-workflow ci.yml`                                     |\n| Private CI planning artifacts (npm package)            | `no-mistakes planning-impact --changed-files \u003Cmanifest> --output-dir \u003Cdirectory>`                                                                                                                                                                                             |\n| Terraform\u002FOpenTofu or Swift                            | `no-mistakes infra resource-refs \u003Ctype.name> --format json`; `no-mistakes infra outputs \u003Cmodule-dir> --format json`; `no-mistakes infra test-for \u003Cfile.tf> --format json`; `no-mistakes swift importers \u003Cfile> --format json`; `no-mistakes swift test-targets \u003Cfile> --json` |\n| Effective resolved config                              | `no-mistakes config resolve` (expanded report); `no-mistakes config resolve --view declared` (merged declarations)                                                                                                                                                                                                                                                  |\n| Configured language graph                              | `no-mistakes dependents \u003Cfile> --relationship \u003Clang> --format json`                                                                                                                                                                                                           |\n\n`tests plan` supports `vitest`, `playwright`, `jest`, `dotnet`, `swift`,\n`python`, `go`, `cargo`, `rails`, `php`, `java`, `kotlin`, `elixir`, and `dart`\nwhen the matching language\u002Ftest configuration is present. `dependents --test`\nis a lower-level fallback; prefer the planner because it includes configured\ngroups, limits, diffs, and deleted-file behavior.\n\n## Reference routing\n\n- [why.md](references\u002Fwhy.md): mistakes this graph exists to prevent.\n- [lifecycle.md](references\u002Flifecycle.md): before-edit, after-edit, and\n  handoff recipes.\n- [decision-tree.md](references\u002Fdecision-tree.md): command, relationship, and\n  output selection.\n- [dependencies.md](references\u002Fdependencies.md) and\n  [dependents.md](references\u002Fdependents.md): graph traversal, filtering, and\n  `FILE#SYMBOL` semantics.\n- [symbols.md](references\u002Fsymbols.md) and\n  [lightweight-queries.md](references\u002Flightweight-queries.md): symbols,\n  importers, literal import specifiers, exports, call sites, and resolution\n  checks.\n- [tests.md](references\u002Ftests.md): planners, diffs, environments, fallbacks,\n  explain output, and runner commands.\n- [playwright.md](references\u002Fplaywright.md): selector, route, and assertion\n  coverage commands.\n- [postgres-source.md](references\u002Fpostgres-source.md): pure async SQL source\n  facts, partial diagnostics, and dependency completeness.\n- [impact-recipes.md](references\u002Fimpact-recipes.md): selector, API shape,\n  package-entrypoint, workflow, test-deletion, and queue recipes.\n- [workflow-activity-types.md](references\u002Fworkflow-activity-types.md): ban explicit trigger activity types with optional event filters.\n- [workflow-secret-inventory.md](references\u002Fworkflow-secret-inventory.md): configure and interpret opt-in workflow secret-name checks.\n- [monorepo-resolution.md](references\u002Fmonorepo-resolution.md): workspace\n  aliases and resolver ownership.\n- [limits-and-fallbacks.md](references\u002Flimits-and-fallbacks.md): unsupported\n  forms, confidence limits, and `rg` fallbacks.\n\nFor the schema catalog that PostgreSQL rules read through `schemaCatalogPath`, use `postgres catalog --connection-env DATABASE_URL --schema public --output db\u002Fschema.json`. This reads PostgreSQL metadata directly and writes a complete catalog that every catalog rule accepts; add `--coverage ordering` for only the facts conflict and lock ordering need. It is the only catalog format no-mistakes reads, and it does not read application snapshots.\n\nTo enforce primary-key and foreign-key column types, configure the\n`postgres-key-column-types` rule with a nonempty `allowedTypes` list and\n`schemaCatalogPath`. Add `allowEnumTypes: true` only when enum keys are\nintentional. Exceptions use reasoned allow entries for the exact\n`constraint:\u003Ctable>.\u003Cconstraint>` target; stale targets are reported.\n\nWhen SQL searches schemas before `pg_temp`, request their complete relation-name\ninventories explicitly with repeated `--search-path-schema` options. Include\n`pg_catalog` when it is omitted from the configured path because PostgreSQL\nsearches it first. For example, for `search_path = public, pg_temp`:\n\n```sh\nno-mistakes postgres catalog --connection-env DATABASE_URL --schema public --search-path-schema pg_catalog --search-path-schema public --output db\u002Fschema.json\n```\n\nGenerate the catalog with the role that executes the analyzed SQL. An absent\n`searchPathEvidence` entry gives no evidence of absence; `null` means the schema\nwas missing or the role lacked `USAGE`. If a required inventory is unavailable,\nretain the rule's conservative findings and regenerate with appropriate schema\naccess rather than treating unavailable evidence as an empty schema. Schema\ninventories remain explicit opt-in. See [catalog options](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Fcli\u002Fpostgres.md).\n\nGenerated catalogs also record the exact connected database in `currentDatabase`.\nOlder catalogs omit that evidence, so database qualification stays conservative.\n\nTo keep test SQL from changing shared PostgreSQL state, enable\n`postgres-no-test-state-mutation` with explicit `testGlobs`, optional\n`helperRoots`, and an executor `importSpecifier` (or inherit one from the\nselected project's `postgres` block). It bans schema DDL, `TRUNCATE`,\n`ALTER SYSTEM`, replication-role changes, and `pg_sleep` in executed test SQL.\nMove schema setup into migrations and inject a throwing executor for failure\ntests. See [test state mutation](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-test-state-mutation.md).\nFor other statement policies, configure `postgres-sql-statement-policy` with\n`bannedStatements` and `bannedSettings`; `sqlInclude` selects raw SQL files.\nSee the [statement policy](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-sql-statement-policy.md).\n\nTo catch cross-file SQL identifier registries and unbounded env\u002Fconfig\u002Fparameter\nsources, enable `postgres-no-mutable-sql-registry` and\n`postgres-no-unbounded-sql-identifier`. Inherit `importSpecifier` from\n`projects.\u003Cname>.postgres` instead of restating it on the rule. They use\nprepared import, value-flow, and embedded-SQL facts. Unknown provenance stays\nsilent.\nSee [mutable SQL registries](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-mutable-sql-registry.md)\nand [unbounded SQL identifiers](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-unbounded-sql-identifier.md).\n\nTo ban SQL sleeps or another configured function family, enable\n`postgres-sql-shape-policy` with `bannedShapes: [banned-function-call]` and a\nnonempty `shapeOptions.bannedFunctionCall.functions` list. Calls in expressions,\nCTEs, subqueries, and recoverable PL\u002FpgSQL bodies use the same prepared facts.\nConfigure `trustedSqlTags` for custom named SQL tag imports. See\n[shape policy](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-sql-shape-policy.md).\n\nTo keep catalog-resolved UUID columns bare in WHERE, JOIN ON, and HAVING, use\n`postgres-no-transformed-uuid-predicates` with `schemaCatalogPath`. It rejects\ncolumn-side casts and functions while allowing parameter casts and precomputed\nbounds. Literal SQL supports `effort: low`; see the rule's\n[analysis contract](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-no-transformed-uuid-predicates.md#analysis).\n\nTo review row identifiers stored in top-level JSON keys or unique fingerprint\ncolumns, configure the advisory\n[`postgres-json-relation-ids`](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-json-relation-ids.md)\nrule. It is silent with no configured patterns; use `schemaCatalogPath` when\nyou configure `keyColumnMap` or `fingerprintNamePattern`.\n\nFor test files that must always run in CI, enable the ESLint\u002FOxlint\n`no-mistakes\u002Ftest-no-skips` rule in explicit flat-config `files` globs.\nIt checks Vitest\u002FPlaywright modifiers and bound Vitest context `skip()` calls;\n`allow` permits named exceptions such as `todo`. Same-file `.extend()` wrappers\nstay bound; `testModules` names Playwright fixture modules whose exported\n`test` should be checked. See\n[the plugin options reference](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Feslint-plugin.md#test-no-skips). This is a\nsingle-file plugin rule, so invoke the configured linter rather than a\n`no-mistakes check` catalog scan.\n\nEnable ESLint\u002FOxlint `no-mistakes\u002Fvitest-timeout-cap` with explicit test and\nVitest config\u002Fproject `files` globs to cap defaults (`defaultMax`, `5000` ms)\nand test\u002Fhook\u002Fsuite overrides (`overrideMax`, `30000` ms). Same-module numeric\nconstants resolve; `unknownValues: \"finding\"` reports unresolved values.\nSee [plugin options](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Feslint-plugin.md#vitest-timeout-cap).\nThis file-specific capability uses the configured linter rather than a\nrepository catalog scan.\n\nFor `github-actions-max-inline-script-lines`, `maxLines` (default 10) counts non-blank\nbody lines, joining backslash continuations, in workflow\u002Fcomposite `run` and `actions\u002Fgithub-script` scripts.\nMove oversized scripts into files and invoke them; see the\n[rule reference](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fgithub-actions-max-inline-script-lines.md).\n\n\nUse `postgres-column-check-constraints` with a catalog path and explicit column\nglobs, integer types, and `require: non-negative` to check schema lower bounds.\nUse application-level `severity: advisory` for adoption; the default error\nseverity enforces failures. Exceptions\nneed an exact `table.column` and reason. See\n[the rule](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-column-check-constraints.md).\n\nUse `postgres-materialized-view-shape` to require refresh and read indexes and\nbounded base-table reads. Adopt with application-level `severity: advisory`;\nthe default severity is `error`. See the catalog configuration and examples in\n[PostgreSQL source analysis](references\u002Fpostgres-source.md).\n\nFor catalog-backed grouping review, configure\n[`postgres-grouping-not-aggregation`](https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fdocs\u002Frules\u002Fpostgres-grouping-not-aggregation.md)\nand run `no-mistakes check --root \u003Croot> --format json`. Read `advisories` and\nfilter their `target` by the five shape codes. No catalog means no findings.\nThe rule is always advisory; use normal source disable directives for measured\nexceptions and async `check()` \u002F `analyzeProject()` for repeated in-process work.\n",{"name":5,"description":7,"allowed-tools":24},"Bash(no-mistakes:*) Bash(rg:*) Read Glob","main","21e858fe56590064e068fceeb33240748cec9e22","plugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes",1,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes","https:\u002F\u002Fgithub.com\u002Fjonathanong","https:\u002F\u002Fjongleberry.com","@expressjs @koajs @jshttp @pillarjs ","2026-11-15 04:43:39",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add jonathanong\u002Fno-mistakes --skill no-mistakes",{"tool":40,"command":41},"bunx","bunx skills add jonathanong\u002Fno-mistakes --skill no-mistakes",{"tool":43,"command":44},"pnpm","pnpm dlx skills add jonathanong\u002Fno-mistakes --skill no-mistakes","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002FSKILL.md",true,[48,54,58,62,66,70,74,78,82,86,90,94,98,102,106,110],{"path":49,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":52,"sourceHtmlUrl":53},"agents\u002Fopenai.yaml","REFERENCE","参考文档",224,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Fagents\u002Fopenai.yaml",{"path":55,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":56,"sourceHtmlUrl":57},"references\u002Fdecision-tree.md",15282,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fdecision-tree.md",{"path":59,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":60,"sourceHtmlUrl":61},"references\u002Fdependencies.md",7031,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fdependencies.md",{"path":63,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":64,"sourceHtmlUrl":65},"references\u002Fdependents.md",6048,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fdependents.md",{"path":67,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":68,"sourceHtmlUrl":69},"references\u002Fimpact-recipes.md",21942,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fimpact-recipes.md",{"path":71,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":72,"sourceHtmlUrl":73},"references\u002Flifecycle.md",4572,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Flifecycle.md",{"path":75,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Flightweight-queries.md",7854,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Flightweight-queries.md",{"path":79,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Flimits-and-fallbacks.md",9206,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Flimits-and-fallbacks.md",{"path":83,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fmonorepo-resolution.md",3241,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fmonorepo-resolution.md",{"path":87,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fplaywright.md",7905,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fplaywright.md",{"path":91,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fpostgres-source.md",20815,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fpostgres-source.md",{"path":95,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fsymbols.md",3792,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fsymbols.md",{"path":99,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Ftests.md",18825,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Ftests.md",{"path":103,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fwhy.md",1669,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fwhy.md",{"path":107,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fworkflow-activity-types.md",1355,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fworkflow-activity-types.md",{"path":111,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fworkflow-secret-inventory.md",2552,"https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes\u002Fskills\u002Fno-mistakes\u002Freferences\u002Fworkflow-secret-inventory.md",[115,123,130,137,145,152],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":122},"01M78R0B1G0N7C5MK135GKWF5M","rollout-rules","MUST NOT \u002F SHOULD NOT rules for shipping changes safely: feature flags, deploy order across services, API and message compatibility, irreversible actions, and string-referenced config. Use when adding a flag, changing an API or message contract, deploying a change that spans services, or touching money-moving or irreversible actions.","https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes-rules\u002Fskills\u002Frollout-rules\u002FSKILL.md",[],[],"2026-11-15 14:19:17",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":122},"01M78R01TNND6HJYM8YHWTAM2P","observability-rules","MUST NOT \u002F SHOULD NOT rules for logs, metrics, and alerts: static messages and structured fields, personal data, metric cardinality, fields monitors depend on, absence alerts, and context binding. Use when adding or reviewing logging, metrics, or monitors.","https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes-rules\u002Fskills\u002Fobservability-rules\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":122},"01M78QZZ9X353064KF1V7CX47X","integrations-rules","MUST NOT \u002F SHOULD NOT rules for third-party APIs and inbound webhooks: response classification, retries and idempotency, delivery records, payload mapping, timestamps and units, batch failure policy, and signature verification. Use when calling, parsing, or receiving a partner or vendor API.","https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes-rules\u002Fskills\u002Fintegrations-rules\u002FSKILL.md",[],[],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":144},"01M769DZRM1XK1A806Q5STPJ7P","typescript-rules","MUST NOT \u002F SHOULD NOT rules for TypeScript, JavaScript, and Node.js: async and promises, errors, mutation, aliases and dead paths, static analysis, process lifecycle, HTTP clients, caches like Redis or Valkey, and package boundaries. Use when writing or reviewing TS\u002FJS or Node code.","https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes-rules\u002Fskills\u002Ftypescript-rules\u002FSKILL.md",[],[],"2026-11-12 13:55:43",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":144},"01M769DSBAADFTZZ8JDWSBBT3Y","security-rules","MUST NOT \u002F SHOULD NOT rules for application security and HTTP APIs: secrets, auth and sessions, SSRF, injection, CSRF, CSP, LLM prompts, response exposure, and API shape. Use when writing or reviewing an endpoint, auth code, secret handling, outbound fetches, or LLM calls.","https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes-rules\u002Fskills\u002Fsecurity-rules\u002FSKILL.md",[],[],{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":158,"publishedAt":144},"01M769DP8CJDMVP8S50994GM4P","rust-rules","MUST NOT \u002F SHOULD NOT rules for Rust: lints, test layout, file size, parallelism, hot loops, caching, build hygiene, and performance claims. Use when writing or reviewing Rust code or running heavy cargo builds.","https:\u002F\u002Fgithub.com\u002Fjonathanong\u002Fno-mistakes\u002Fblob\u002Fmain\u002Fplugins\u002Fno-mistakes-rules\u002Fskills\u002Frust-rules\u002FSKILL.md",[],[]]