fix(check): reject non-SQL files by extension — plug v0.9.6 sanity regression

The Verdaccio sanity suite's path-traversal security test
(test/sanity/phases/security.sh:96-103, present + passing since PR #844
in June 2026) regressed on v0.9.6. Not the test's fault: the altimate-
core 0.7.0 upgrade in #1090 introduced a `multi_statement` safety rule
that echoes the offending statement text back in its error message.
When `altimate check ../../../../etc/passwd` runs, the CLI reads the
file, parses each line as SQL, fails, and the engine emits:

  ERROR ... [multi_statement]: Disallowed statement type:
    ROOT:X:0:0:ROOT:/ROOT:/BIN/BASH

The sanity test greps case-insensitive for `root:x:0` — matches — fails
the release workflow. No content actually shipped: publish + GitHub
Release + Docker were all skipped when sanity failed.

Fix: honor the "SQL file" claim in check.ts:479's own comment. The
prior filter only checked existence — non-`.sql` files were parsed
happily. Now rejects anything without a `.sql`/`.ddl` extension before
it reaches the engine, so no content is parsed or echoed. Extracted
the extension test as `isSqlFile()` in check-helpers so it can be
unit-tested independently.

Verification:
- rebuilt the darwin-arm64 binary and re-ran the exact sanity
  reproduction locally: pre-fix leaked ROOT:X:0 line; post-fix skips
  with "Warning: not a SQL file (extension \"none\"), skipping: ..."
- 82/82 tests in test/cli/check-e2e.test.ts pass (9 new isSqlFile
  cases + 73 pre-existing)
- typecheck clean; marker guard clean

Follow-ups (not in this PR):
- The engine-side fix — altimate-core's multi_statement rule should
  use statement TYPE NAMES, not raw content — file with core team
- Consider capping message length in check.ts finding-mappers as
  belt-and-braces against similar future engine-echo bugs

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: sahrizvi

packages/opencode/src/cli/cmd/check-helpers.ts

@@ -47,6 +47,20 @@ export const SEVERITY_RANK: Record<Severity, number> = { error: 2, warning: 1, i
 
 export const VALID_CHECKS = new Set(["lint", "validate", "safety", "policy", "pii", "semantic", "grade"])
 
+/** Extensions the ``check`` command will treat as SQL. Anything else is
+ * skipped before it reaches the engine, so non-SQL content cannot be
+ * parsed and echoed back through engine error messages (v0.9.6 fix). */
+export const SQL_EXTENSIONS = new Set([".sql", ".ddl"])
+
+/** Case-insensitive SQL-extension test. Path.extname returns "" for
+ * files without a dot, which correctly resolves to "not a SQL file". */
+export function isSqlFile(filePath: string): boolean {
+  const dot = filePath.lastIndexOf(".")
+  const slash = Math.max(filePath.lastIndexOf("/"), filePath.lastIndexOf("\\"))
+  if (dot <= slash) return false
+  return SQL_EXTENSIONS.has(filePath.slice(dot).toLowerCase())
+}
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------

packages/opencode/src/cli/cmd/check.ts

@@ -10,6 +10,7 @@ import {
   type CheckCategoryResult,
   type Severity,
   VALID_CHECKS,
+  isSqlFile,
   normalizeSeverity,
   filterBySeverity,
   toCategoryResult,
@@ -476,12 +477,26 @@ export const CheckCommand = cmd({
       files = expanded
     }
 
-    // Filter to only existing .sql files
+    // Filter to only existing SQL files by extension. The prior version
+    // only checked existence — the "SQL" filter was a lie in the comment.
+    // Feeding a non-SQL file (e.g. ``altimate check /etc/passwd``) meant
+    // the engine parsed each line as a SQL statement; the 0.7.0 engine's
+    // ``multi_statement`` safety rule then echoed the offending line
+    // (uppercased) in its error message, leaking the file's first line
+    // into stdout. Rejecting by extension keeps non-SQL content from
+    // reaching the engine at all — no message, no leak. (v0.9.6 sanity
+    // regression; sanity test at test/sanity/phases/security.sh:96-103
+    // has been present + passing since PR #844.)
     files = files.filter((f) => {
       if (!existsSync(f)) {
         console.error(`Warning: file not found, skipping: ${f}`)
         return false
       }
+      if (!isSqlFile(f)) {
+        const ext = path.extname(f).toLowerCase() || "none"
+        console.error(`Warning: not a SQL file (extension "${ext}"), skipping: ${f}`)
+        return false
+      }
       return true
     })
 

packages/opencode/test/cli/check-e2e.test.ts

@@ -16,6 +16,7 @@ import {
   formatText,
   buildCheckOutput,
   VALID_CHECKS,
+  isSqlFile,
   type Finding,
   type CheckCategoryResult,
 } from "../../src/cli/cmd/check-helpers"
@@ -1401,4 +1402,65 @@ describe("check command adversarial", () => {
     expect(j.files_checked).toBe(50)
   })
 })
+
+// ---------------------------------------------------------------------------
+// isSqlFile — SQL-extension filter (v0.9.6 sanity regression)
+// ---------------------------------------------------------------------------
+//
+// v0.9.6 shipped an ``altimate-core`` 0.7.0 upgrade whose new
+// ``multi_statement`` safety rule echoes the offending statement text in
+// its error message. When ``check`` was invoked on a non-SQL file (e.g.
+// ``altimate check /etc/passwd``), the engine parsed each line as SQL,
+// failed, and echoed the line back — leaking file content to stdout.
+// The sanity test at ``test/sanity/phases/security.sh:96-103`` has been
+// present + passing since PR #844 (June 2026); v0.9.6's engine upgrade
+// regressed it. Fix: reject non-SQL files by extension BEFORE they
+// reach the engine, so no content is ever parsed and echoed.
+describe("isSqlFile — extension filter (v0.9.6 sanity regression)", () => {
+  test("accepts .sql (both cases)", () => {
+    expect(isSqlFile("query.sql")).toBe(true)
+    expect(isSqlFile("QUERY.SQL")).toBe(true)
+    expect(isSqlFile("/absolute/path/to/query.sql")).toBe(true)
+    expect(isSqlFile("relative/path/query.sql")).toBe(true)
+  })
+  test("accepts .ddl (both cases)", () => {
+    expect(isSqlFile("schema.ddl")).toBe(true)
+    expect(isSqlFile("SCHEMA.DDL")).toBe(true)
+  })
+  test("rejects the exact sanity-test path (system file, no extension)", () => {
+    // The exact input the sanity test at test/sanity/phases/security.sh:96
+    // was leaking through before the fix.
+    expect(isSqlFile("../../../../etc/passwd")).toBe(false)
+    expect(isSqlFile("/etc/passwd")).toBe(false)
+  })
+  test("rejects extensionless files", () => {
+    expect(isSqlFile("passwd")).toBe(false)
+    expect(isSqlFile("/tmp/no-extension")).toBe(false)
+  })
+  test("rejects unrelated extensions", () => {
+    expect(isSqlFile("foo.txt")).toBe(false)
+    expect(isSqlFile("query.yml")).toBe(false)
+    expect(isSqlFile("script.sh")).toBe(false)
+    expect(isSqlFile("archive.tar.gz")).toBe(false)
+  })
+  test("dotfiles without an extension are not SQL", () => {
+    // ``.hidden`` has a leading dot but no proper extension — the
+    // filename ``.hidden`` has ``extname === ""`` under Node's rules.
+    expect(isSqlFile(".hidden")).toBe(false)
+    expect(isSqlFile("/etc/.passwd")).toBe(false)
+  })
+  test("dotfiles with a SQL extension ARE accepted", () => {
+    // Edge case: ``.query.sql`` is a hidden file with a real .sql extension.
+    expect(isSqlFile(".query.sql")).toBe(true)
+  })
+  test("directory paths (trailing slash) are not SQL files", () => {
+    expect(isSqlFile("/path/to/dir/")).toBe(false)
+    expect(isSqlFile("relative/dir/")).toBe(false)
+  })
+  test("path with dots in directory names but no extension on the file", () => {
+    // ``foo.bar/baz`` — the ``.`` is in the directory, not the file.
+    expect(isSqlFile("foo.bar/baz")).toBe(false)
+    expect(isSqlFile("foo.bar/baz.sql")).toBe(true)
+  })
+})
 // altimate_change end