Merge pull request #1136 from DeusData/fix/codeql-objectscript-wider-type

fix(grammars): widen uint8_t loop counters in objectscript scanner (CodeQL #69-#72)

internal/cbm/vendored/grammars/MANIFEST.md

@@ -13,7 +13,7 @@ The grammars were originally vendored as bare `parser.c`+`scanner.c` with **no r
 - ABI distribution: **7×** ABI-13 **85×** ABI-14 **64×** ABI-15 (runtime ceiling is ABI 15; never vendor ABI 16 without a runtime upgrade)
 - Vendored copies missing LICENSE: **0** — all upstream LICENSE files restored 2026-06-11 (first-party grammars carry the project MIT license; `move` uses the Helix-listed upstream tzakian/tree-sitter-move MIT text, `zsh` uses georgeharker/tree-sitter-zsh MIT)
 - `verdict`: VERIFIED-BOTH = our source matches *both* registries; VERIFIED-NVIM/HELIX = matches one; registry-disagreement = registries name a different repo (listed separately); `vendor-maintained` = the language vendor's own grammar, not in nvim/Helix.
-- **objectscript_udl / objectscript_routine** (added 2026-06-24): vendored from [intersystems/tree-sitter-objectscript](https://github.com/intersystems/tree-sitter-objectscript) @ `a7ffcdf` — MIT, the InterSystems-official grammars (a niche vendor language, hence `vendor-maintained`, not in nvim-treesitter/Helix). **Re-vendor note:** each `scanner.c`'s upstream `#include "../../common/scanner.h"` is repointed to a per-directory `objectscript_common.h` (a verbatim copy of upstream `common/scanner.h`), because this repo's shared `vendored/common/scanner.h` belongs to the cfml/fsharp grammars and differs. The generated `parser.c`/`scanner.c` are otherwise byte-for-byte upstream — on re-vendor, re-apply only that single include rename.
+- **objectscript_udl / objectscript_routine** (added 2026-06-24): vendored from [intersystems/tree-sitter-objectscript](https://github.com/intersystems/tree-sitter-objectscript) @ `a7ffcdf` — MIT, the InterSystems-official grammars (a niche vendor language, hence `vendor-maintained`, not in nvim-treesitter/Helix). **Re-vendor note:** each `scanner.c`'s upstream `#include "../../common/scanner.h"` is repointed to a per-directory `objectscript_common.h` (a verbatim copy of upstream `common/scanner.h`), because this repo's shared `vendored/common/scanner.h` belongs to the cfml/fsharp grammars and differs. The generated `parser.c`/`scanner.c` are otherwise byte-for-byte upstream — on re-vendor, re-apply only that single include rename. **Local modification (2026-07-16):** in `objectscript_common.h`, two loop counters `uint8_t i` were widened to `int i` (the `reverse_marker` scan and the `html_marker_buffer` reversal) to clear CodeQL `cpp/comparison-with-wider-type` — a false positive in practice (both lengths are hard-bounded by `MARKER_BUFFER_MAX_LEN = 30`, so `uint8_t` could never wrap), fixed for cleanliness. On re-vendor, re-apply this widening too (or upstream it at intersystems/tree-sitter-objectscript).
 - **mojo** (added 2026-07-01): vendored from [lsh/tree-sitter-mojo](https://github.com/lsh/tree-sitter-mojo) @ `33193a99afe6` — MIT, ABI 15. Helix tracks `lsh/tree-sitter-mojo` as its Mojo grammar source, but the Helix-pinned commit (`3d7c53b8038f`) no longer resolves in the upstream repository after a force-push, so this vendor uses current upstream `main` rather than the stale registry SHA. Security review covered only the vendored C surface (`parser.c`, `scanner.c`, `tree_sitter/*.h`) plus upstream license/provenance metadata; no package manager hooks, workflow files, prompt/agent instruction files, or generated lockfiles were vendored.
 
 > ⚠️ **Pinned commit = the revision nvim-treesitter/Helix vendor** (battle-tested, canonical source), not bleeding-edge HEAD. When re-vendoring, update the pinned commit here.

internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h

@@ -332,7 +332,7 @@ static bool ObjectScript_Core_Scanner_lex_marker_fenced_text(
       lexer->mark_end(lexer);
       advance(lexer);
 
-      uint8_t i = 0;
+      int i = 0;
       while (i < reverse_marker_len && !lexer->eof(lexer)
              && lexer->lookahead == reverse_marker[i]) {
         advance(lexer);
@@ -588,7 +588,7 @@ ObjectScript_Core_Scanner_scan(struct ObjectScript_Core_Scanner *scanner,
       return false;
     }
     scanner->js_marker_buffer_reversed_len = scanner->html_marker_buffer_len;
-    for (uint8_t i = 0; i < scanner->html_marker_buffer_len; i++) {
+    for (int i = 0; i < scanner->html_marker_buffer_len; i++) {
       if (scanner->html_marker_buffer[scanner->html_marker_buffer_len - 1 - i] == '[') {
         scanner->js_marker_buffer_reversed[i] = ']';
       }

internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h

@@ -332,7 +332,7 @@ static bool ObjectScript_Core_Scanner_lex_marker_fenced_text(
       lexer->mark_end(lexer);
       advance(lexer);
 
-      uint8_t i = 0;
+      int i = 0;
       while (i < reverse_marker_len && !lexer->eof(lexer)
              && lexer->lookahead == reverse_marker[i]) {
         advance(lexer);
@@ -588,7 +588,7 @@ ObjectScript_Core_Scanner_scan(struct ObjectScript_Core_Scanner *scanner,
       return false;
     }
     scanner->js_marker_buffer_reversed_len = scanner->html_marker_buffer_len;
-    for (uint8_t i = 0; i < scanner->html_marker_buffer_len; i++) {
+    for (int i = 0; i < scanner->html_marker_buffer_len; i++) {
       if (scanner->html_marker_buffer[scanner->html_marker_buffer_len - 1 - i] == '[') {
         scanner->js_marker_buffer_reversed[i] = ']';
       }