verify does not validate an sg rule's language field

[thecodedrift]

Summary

taskless verify reports ok: true for an ast-grep rule whose language: value is not one ast-grep accepts. The vendored rule schema types the field as a bare string with no enum, and verify never reads it, so the first thing with an opinion is the ast-grep binary — at check time, in the two ways below.

Why it matters

Both failure modes are silent at the moment the rule is written, which is the moment someone can still fix it cheaply.

1. A name ast-grep does not recognize at all aborts config parsing. The error is did not match any variant of untagged enum SgLang, and because Taskless assembles one config for the run, every other sg rule goes unreported too. One bad rule blinds the whole engine.
2. A recognized name that points at the wrong parser reports nothing and looks like a clean codebase. Tsx and TypeScript are two parsers, not aliases — a rule over .tsx that declares TypeScript does not match JSX.

The create-sg-rule recipe (topic v3) documents the accepted list and both traps, so the knowledge exists. It is just not enforced anywhere, and a recipe an agent read from a stale build does not carry it.

Reproduction

Author any sg rule with language: nonsense:

taskless verify .taskless/rules/sg/<id> --json
{"ok":true,"rules":[{"engine":"sg","ruleId":"<id>","ok":true,"errors":[]}]}

Then taskless check fails for the whole sg engine rather than for that rule.

Observed in practice

Onboarding taskless/cli itself, four rules were authored with lowercase typescript. verify and test were both green, and the rules did work — case variants reach the same parser. Nothing in the local loop would have distinguished that from a spelling that takes the engine down.

Proposed fix

Validate language in verify against ast-grep's accepted list, and fail with the accepted spelling in the error. Two details worth deciding:

• Case. ast-grep accepts case variants (cpp and C++ both reach Cpp). Accepting them and reporting a normalization hint is friendlier than rejecting; rejecting is more likely to keep rule files consistent. Either is better than silence.
• Do not source the list from detect --json. It reports the repository's languages in a different vocabulary — C++ where ast-grep says Cpp.

A related smaller item: verify could also warn when a rule declares TypeScript but its files: globs reach .tsx, which is trap 2 above in the form it actually shows up.

🤖 Generated with Claude Code

https://claude.ai/code/session_017cEN93Acyp4zBwP3oDnyy1