fix(sqlite): correct parameter binding when mixing sqlc.arg() with bare "?"

[abgoyal]

When a SQLite query uses both sqlc.arg() named parameters and bare ? placeholders, the generated SQL has numbered ?N for named params but leaves bare ? unnumbered. SQLite's auto-numbering for bare ? then conflicts with the explicit ?N values, silently binding arguments to wrong columns.

Fix by numbering all placeholders sequentially in text order when the mixed case is detected, ensuring positional argument passing matches the generated ?N values.

[gemini-code-assist]

Code Review

This pull request adds support for mixing named parameters (via sqlc.arg()) and bare ? placeholders in SQLite queries by numbering all placeholders in text order when both coexist. The review feedback identifies two critical issues in internal/sql/rewrite/parameters.go: first, using len(numbs) > 0 to detect bare placeholders is imprecise and can lead to parameter conflicts; second, isBareParamRef incorrectly matches explicitly numbered parameters, which would corrupt them during rewriting. Actionable code suggestions are provided to resolve both issues.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[abgoyal]

/gemini-review