feat(rules): AffineScript hand-port pitfalls — HANDLE-as-fn-name + OCaml float ops

[hyperpolymath]

Summary

Adds 5 patterns under language "affine"/"affinescript" to catch parse-blocking hand-port leaks that surface when .res / .ml / .re code is migrated to AffineScript. Both classes were discovered manually during the sustainabot ReScript→AffineScript migration (gitbot-fleet#148) and resolved via 5 parser PRs + a hand-port-rewrite PR — but the underlying signal ("this code won't parse") only emerged after affinescript check. Capturing them as Hypatia rules surfaces the signal at PR-review time, before the iteration loop.

The two pitfalls

1. handle as a fn name. AffineScript's handle is a reserved keyword (HANDLE token), used by the effect-handler expression form handle body { handler_arms }. So pub fn handle(...) is a parse error. Severity: :high. Recommended rename: dispatch, handle_request, handle_event.

2. OCaml-style float operators. AffineScript uses unified + - * / for both Int and Float. The OCaml form +. -. *. /. is never accepted. Four separate patterns (one per operator) — each requires an operand-character preceding the operator-and-dot, so .0-suffixed numeric literals (e.g. 1.0 + x) don't false-positive. Severity: :high (parse blocker).

Integration

• New @affine_hand_port_patterns module attribute in lib/rules/code_safety.ex (immediately after @rescript_patterns).
• Dispatch registered for both "affine" and "affinescript" language keys (mirrors the javascript/typescript alias precedent at lines 384-385).
• File-extension fallback in lib/rules/rules.ex after the existing JS/TS web-security fallback: any .affine file gets the hand-port scan even when the caller passes language = nil or an unrelated upstream default.

Test plan

• Regex spot-check via elixir -e 'Regex.scan(...)': pub fn handle( matches; let x = a /. 1.0 matches; let x = a / 1.0 does NOT match (true negative). All three confirmed.
• elixirc of both modified files succeeds (only pre-existing module-resolution warnings unrelated to this patch).
• mix compile blocked by a Phoenix-dep / Elixir-1.15 mismatch in the sandbox env; not in scope for this PR.

Cross-refs

• Refs Track: ReScript→AffineScript migration backlog (~4,939 LOC) gitbot-fleet#148
• Refs feat(parser): trailing-comma in fn params and expr lists (Refs gitbot-fleet#148) affinescript#370, chore(deps): bump taiki-e/install-action from 2.79.9 to 2.79.11 #371, feat(rules): add :vlang_detected + :vmod_detected with path_allow_prefixes #372, feat(rules): extend vlang_detected allowlist (interop + archive carve-outs) #373, feat(rules): BP008 phantom required context + AM010 admin-merge eligibility #376
• Refs fix(sustainabot): parse-blocking OCaml-isms and HANDLE-keyword name (Refs #148) gitbot-fleet#206

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 20 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	20

View findings

[
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/batch.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/scan.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/scan.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/commands/fleet.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/cli/src/output.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/cli/build.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/fixer/src/main.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/hypatia/hypatia/integration/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "low"
  },
  {
    "reason": "1 untracked file(s) -- review and add or .gitignore",
    "type": "GS001",
    "file": ".",
    "action": "review",
    "rule_module": "git_state",
    "severity": "low"
  },
  {
    "reason": "Repository has 4 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence