@bhargavvc/sdd-cc 1.35.0 → 1.42.3

package/scripts/diff-touches-shipped-paths.cjs

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+/**
+ * Used by the release-sdk hotfix cherry-pick loop to decide whether a
+ * candidate commit can possibly change what ships in the npm package.
+ *
+ * Reads a newline-separated list of paths from stdin (typically the
+ * output of `git diff-tree --no-commit-id --name-only -r <SHA>`) and
+ * exits with one of three codes so the workflow can distinguish a
+ * legitimate "skip this commit" signal from a classifier failure.
+ *
+ * "Shipped" = the union of:
+ *   - package.json (always included by `npm pack`, regardless of `files`)
+ *   - every entry in package.json `files`, treated as either an exact
+ *     file match or a directory prefix (matching `npm pack` semantics).
+ *   - CI-gating test paths: `tests/<anything>` plus
+ *     `sdk/src/<anything>/<name>.test.<ts|cjs|mjs|js>` and `.spec.` variants
+ *     — these don't ship in the tarball, but they gate the hotfix-branch
+ *     test job. A test fixture update that aligns with a cherry-picked
+ *     production fix MUST be pickable or CI fails on the hotfix run.
+ *     #3621 — root cause of the v1.42.3 hotfix red CI.
+ *
+ * `package-lock.json` is intentionally NOT considered shipped — `npm pack`
+ * excludes it from the tarball unless it's explicitly in `files`, and at
+ * the time of writing this repo's `files` whitelist does not include it.
+ *
+ * Exit codes (the workflow MUST treat these distinctly — bug #2983):
+ *   0  at least one path is shipped       → cherry-pick is meaningful
+ *   1  no shipped paths                   → CI / test / docs / planning
+ *                                            only; hotfix loop skips
+ *   2  classifier error                   → bad/missing package.json,
+ *                                            I/O failure, or any
+ *                                            uncaught exception. The
+ *                                            workflow MUST fail-fast on
+ *                                            this code rather than
+ *                                            treating it as a skip.
+ *
+ * Why distinct codes: Node's default exit code for uncaught throws is 1,
+ * which would otherwise be indistinguishable from the legitimate "no
+ * shipped paths" result. CodeRabbit on PR #2981 / bug #2983.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const EXIT_SHIPPED = 0;
+const EXIT_NOT_SHIPPED = 1;
+const EXIT_ERROR = 2;
+
+function loadShipPrefixes(pkgPath) {
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+  const files = Array.isArray(pkg.files) ? pkg.files : [];
+  return ['package.json', ...files];
+}
+
+// #3621: paths that gate hotfix-branch CI even though they don't appear
+// in the npm tarball. When a cherry-picked production fix changes behavior
+// that an existing test on the v1.42.2 base asserts against, the matching
+// test fixture from `main` must also be cherry-picked or CI fails on the
+// hotfix run (exactly what happened on v1.42.3 — production fix(3562) was
+// picked, the bundled test-fixture correction in commit 08848df8 was not).
+// Combined with the `test:` prefix being added to the candidate-loop regex
+// in release-sdk.yml, this lets `test(####):` fixture-alignment commits be
+// cherry-picked alongside their production counterparts.
+function isCiGating(diffPath) {
+  if (diffPath.startsWith('tests/')) return true;
+  // SDK vitest specs live next to source. Production source ships via
+  // sdk/dist/ (already in package.json `files`); the test files are what's
+  // missing from that surface.
+  if (diffPath.startsWith('sdk/src/') && /\.(test|spec)\.(ts|cjs|mjs|js)$/.test(diffPath)) return true;
+  return false;
+}
+
+function isShipped(diffPath, shipPrefixes) {
+  // Normalize Windows-style separators just in case (git always emits
+  // forward slashes, but a developer running this locally on a different
+  // tool's output shouldn't get a false negative).
+  const p = diffPath.replace(/\\/g, '/');
+  return shipPrefixes.some((s) => p === s || p.startsWith(s + '/'));
+}
+
+// #2980: commits that touch `.github/workflows/*` cannot be cherry-picked
+// onto a hotfix branch because the default GITHUB_TOKEN lacks the
+// `workflow` permission and the push step fails. Detect them upfront so a
+// `test:`-eligible commit bundling a workflow edit still gets skipped.
+function isPushBlocking(diffPath) {
+  return diffPath.replace(/\\/g, '/').startsWith('.github/workflows/');
+}
+
+function fail(message, err) {
+  process.stderr.write(`diff-touches-shipped-paths: ${message}\n`);
+  if (err && err.stack) process.stderr.write(`${err.stack}\n`);
+  process.exit(EXIT_ERROR);
+}
+
+function main() {
+  // Surface ANY uncaught failure as exit 2 (classifier error) rather
+  // than letting Node's default-1 shadow the legitimate
+  // "no shipped paths" result. Bug #2983.
+  process.on('uncaughtException', (err) => fail('uncaught exception', err));
+  process.on('unhandledRejection', (err) => fail('unhandled rejection', err));
+
+  let shipPrefixes;
+  try {
+    const pkgPath = path.resolve(process.cwd(), 'package.json');
+    shipPrefixes = loadShipPrefixes(pkgPath);
+  } catch (err) {
+    return fail(`failed to read package.json from ${process.cwd()}`, err);
+  }
+
+  let buf = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('error', (err) => fail('stdin read error', err));
+  process.stdin.on('data', (chunk) => {
+    buf += chunk;
+  });
+  process.stdin.on('end', () => {
+    try {
+      const paths = buf.split('\n').map((s) => s.trim()).filter(Boolean);
+      // #2980 still wins over #3621: any commit touching .github/workflows/*
+      // is unpickable regardless of other content because the push step
+      // fails on workflow scope rejection. Check this first.
+      if (paths.some(isPushBlocking)) {
+        process.exit(EXIT_NOT_SHIPPED);
+      }
+      if (paths.some((p) => isShipped(p, shipPrefixes))) {
+        process.exit(EXIT_SHIPPED);
+      }
+      // #3621: a commit whose only relevant paths are CI-gating tests is
+      // still pickable — it can change whether the hotfix CI passes even
+      // though it doesn't change what the npm tarball ships.
+      if (paths.some(isCiGating)) {
+        process.exit(EXIT_SHIPPED);
+      }
+      process.exit(EXIT_NOT_SHIPPED);
+    } catch (err) {
+      fail('classification failed', err);
+    }
+  });
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { loadShipPrefixes, isShipped, isCiGating, isPushBlocking, EXIT_SHIPPED, EXIT_NOT_SHIPPED, EXIT_ERROR };

package/scripts/fix-slash-commands.cjs

@@ -0,0 +1,106 @@
+'use strict';
+/**
+ * One-shot script: replace retired /sdd-<cmd> with /sdd:<cmd> for known command names.
+ * Only replaces when followed by a word boundary (space, newline, quote, backtick, ), end).
+ *
+ * The transform is exported as a pure function so it can be unit-tested directly
+ * (see tests/bug-2543-sdd-slash-namespace.test.cjs) without needing fixture files.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const COMMANDS_DIR = path.join(__dirname, '..', 'commands', 'sdd');
+const SEARCH_DIRS = [
+  path.join(__dirname, '..', 'sdd', 'bin', 'lib'),
+  path.join(__dirname, '..', 'sdd', 'workflows'),
+  path.join(__dirname, '..', 'sdd', 'references'),
+  path.join(__dirname, '..', 'sdd', 'templates'),
+  path.join(__dirname, '..', 'sdd', 'contexts'),
+  path.join(__dirname, '..', 'commands', 'sdd'),
+  path.join(__dirname, '..', 'agents'),
+  path.join(__dirname, '..', 'hooks'),
+];
+
+const TOP_LEVEL_FILES = [
+  path.join(__dirname, '..', '.clinerules'),
+];
+
+const SKIP_DIRS = new Set(['node_modules', 'dist', '.turbo']);
+const EXTENSIONS = new Set(['.md', '.cjs', '.js', '.ts', '.tsx']);
+
+// Test files contain intentional fixture strings (e.g. inputs the sanitizer
+// is expected to strip). Rewriting them changes test semantics.
+function isTestFile(name) {
+  return /\.test\.(c?js|tsx?)$/.test(name);
+}
+
+function buildPattern(cmdNames) {
+  // Empty input would compile `/sdd-()(?=[^a-zA-Z0-9_-]|$)/g`, which the regex
+  // engine still matches at any `/sdd-` token followed by a non-word boundary
+  // (e.g. EOL, whitespace, punctuation) — rewriting it to a stray `/sdd:`.
+  // Short-circuit so the caller can no-op on a missing/empty registry rather
+  // than perform an unintended broad rewrite.
+  if (!Array.isArray(cmdNames) || cmdNames.length === 0) return null;
+  const sorted = [...cmdNames].sort((a, b) => b.length - a.length); // longest first to avoid partial matches
+  return new RegExp(`/sdd-(${sorted.join('|')})(?=[^a-zA-Z0-9_-]|$)`, 'g');
+}
+
+/**
+ * Pure transform: rewrite retired `/sdd-<cmd>` to `/sdd:<cmd>` for the given command names.
+ * Returns the rewritten string. Identifiers not in `cmdNames` (e.g. `/sdd-sdk`,
+ * `/sdd-tools`) are left untouched.
+ */
+function transformContent(src, cmdNames) {
+  const pattern = buildPattern(cmdNames);
+  if (!pattern) return src;
+  return src.replace(pattern, (_, cmd) => `/sdd:${cmd}`);
+}
+
+function readCmdNames() {
+  return fs.readdirSync(COMMANDS_DIR)
+    .filter(f => f.endsWith('.md'))
+    .map(f => f.replace(/\.md$/, ''));
+}
+
+function processFile(file, cmdNames) {
+  const pattern = buildPattern(cmdNames);
+  if (!pattern) return;
+  let src;
+  try { src = fs.readFileSync(file, 'utf-8'); } catch { return; }
+  const replaced = transformContent(src, cmdNames);
+  if (replaced !== src) {
+    fs.writeFileSync(file, replaced, 'utf-8');
+    const count = (src.match(pattern) || []).length;
+    console.log(`  ${count} replacements: ${path.relative(path.join(__dirname, '..'), file)}`);
+  }
+}
+
+function processDir(dir, cmdNames) {
+  const pattern = buildPattern(cmdNames);
+  if (!pattern) return;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (SKIP_DIRS.has(e.name)) continue;
+      processDir(full, cmdNames);
+    } else if (EXTENSIONS.has(path.extname(e.name)) && !isTestFile(e.name)) {
+      processFile(full, cmdNames);
+    }
+  }
+}
+
+if (require.main === module) {
+  const cmdNames = readCmdNames();
+  for (const dir of SEARCH_DIRS) {
+    processDir(dir, cmdNames);
+  }
+  for (const file of TOP_LEVEL_FILES) {
+    processFile(file, cmdNames);
+  }
+  console.log('Done.');
+}
+
+module.exports = { transformContent, buildPattern, SKIP_DIRS };

package/scripts/gen-inventory-manifest.cjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Generates docs/INVENTORY-MANIFEST.json — a structural skeleton of every
+ * shipped surface derived entirely from the filesystem. Commit this file;
+ * CI re-runs the script and diffs. A non-empty diff means a surface shipped
+ * without an INVENTORY.md row.
+ *
+ * Usage:
+ *   node scripts/gen-inventory-manifest.cjs              # print to stdout
+ *   node scripts/gen-inventory-manifest.cjs --write      # write docs/INVENTORY-MANIFEST.json
+ *   node scripts/gen-inventory-manifest.cjs --check      # exit 1 if committed manifest is stale
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const ROOT = path.resolve(__dirname, '..');
+const MANIFEST_PATH = path.join(ROOT, 'docs', 'INVENTORY-MANIFEST.json');
+
+const FAMILIES = [
+  {
+    name: 'agents',
+    dir: path.join(ROOT, 'agents'),
+    filter: (f) => /^sdd-.*\.md$/.test(f),
+    toName: (f) => f.replace(/\.md$/, ''),
+  },
+  {
+    name: 'commands',
+    dir: path.join(ROOT, 'commands', 'sdd'),
+    filter: (f) => f.endsWith('.md'),
+    toName: (f) => '/sdd-' + f.replace(/\.md$/, ''),
+  },
+  {
+    name: 'workflows',
+    dir: path.join(ROOT, 'sdd', 'workflows'),
+    filter: (f) => f.endsWith('.md'),
+    toName: (f) => f,
+  },
+  {
+    name: 'references',
+    dir: path.join(ROOT, 'sdd', 'references'),
+    filter: (f) => f.endsWith('.md'),
+    toName: (f) => f,
+  },
+  {
+    name: 'cli_modules',
+    dir: path.join(ROOT, 'sdd', 'bin', 'lib'),
+    filter: (f) => f.endsWith('.cjs'),
+    toName: (f) => f,
+  },
+  {
+    name: 'hooks',
+    dir: path.join(ROOT, 'hooks'),
+    filter: (f) => /\.(js|sh)$/.test(f),
+    toName: (f) => f,
+  },
+];
+
+function buildManifest() {
+  const manifest = { generated: new Date().toISOString().slice(0, 10), families: {} };
+  for (const { name, dir, filter, toName } of FAMILIES) {
+    manifest.families[name] = fs
+      .readdirSync(dir)
+      .filter((f) => fs.statSync(path.join(dir, f)).isFile() && filter(f))
+      .map(toName)
+      .sort();
+  }
+  return manifest;
+}
+
+const [, , flag] = process.argv;
+
+if (flag === '--check') {
+  const committed = JSON.parse(fs.readFileSync(MANIFEST_PATH, 'utf8'));
+  const live = buildManifest();
+  // Strip the generated date for comparison
+  delete committed.generated;
+  delete live.generated;
+  const committedStr = JSON.stringify(committed, null, 2);
+  const liveStr = JSON.stringify(live, null, 2);
+  if (committedStr !== liveStr) {
+    process.stderr.write(
+      'docs/INVENTORY-MANIFEST.json is stale. Run:\n' +
+      '  node scripts/gen-inventory-manifest.cjs --write\n' +
+      'then add a matching row in docs/INVENTORY.md for each new entry.\n\n',
+    );
+    // Show diff-friendly output
+    for (const family of Object.keys(live.families)) {
+      const liveSet = new Set(live.families[family]);
+      const committedSet = new Set((committed.families || {})[family] || []);
+      for (const name of liveSet) {
+        if (!committedSet.has(name)) process.stderr.write('  + ' + family + '/' + name + '\n');
+      }
+      for (const name of committedSet) {
+        if (!liveSet.has(name)) process.stderr.write('  - ' + family + '/' + name + '\n');
+      }
+    }
+    process.exit(1);
+  }
+  process.stdout.write('docs/INVENTORY-MANIFEST.json is up to date.\n');
+} else if (flag === '--write') {
+  const manifest = buildManifest();
+  fs.writeFileSync(MANIFEST_PATH, JSON.stringify(manifest, null, 2) + '\n');
+  process.stdout.write('Wrote ' + MANIFEST_PATH + '\n');
+} else {
+  process.stdout.write(JSON.stringify(buildManifest(), null, 2) + '\n');
+}

package/scripts/lint-command-contract.cjs

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+/**
+ * lint-command-contract.cjs  (ADR-0002)
+ *
+ * Enforces the commands/sdd/*.md contract across all 65 command files:
+ *
+ *   1. name:        present, non-empty, matches sdd: or sdd- prefix
+ *   2. description: present, non-empty
+ *   3. allowed-tools: block present, non-empty, all entries from CANONICAL_TOOLS
+ *   4. execution_context @-refs: every @-reference resolves to an existing file on disk
+ *   5. execution_context @-refs: each appears on its own line (no trailing prose)
+ *
+ * Exit 0 = clean. Exit 1 = violations (with diagnostics).
+ */
+
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+const ROOT          = path.join(__dirname, '..');
+const COMMANDS_DIR  = path.join(ROOT, 'commands', 'sdd');
+const SDD_ROOT      = path.join(ROOT, 'sdd');
+
+const {
+  CANONICAL_TOOLS,
+  parseFrontmatter,
+  executionContextRefs: extractExecutionContextRefs,
+} = require('./command-contract-helpers.cjs');
+
+// ─── check one file ───────────────────────────────────────────────────────────
+
+function check(filePath) {
+  const content  = fs.readFileSync(filePath, 'utf-8');
+  const rel      = path.relative(ROOT, filePath);
+  const fm       = parseFrontmatter(content);
+  const violations = [];
+
+  // 1. name: present + sdd: / sdd- prefix
+  if (!fm.name || !fm.name.trim()) {
+    violations.push('name: field missing or empty');
+  } else if (!/^sdd[:-]/.test(fm.name.trim())) {
+    violations.push(`name: must start with "sdd:" or "sdd-", got "${fm.name.trim()}"`);
+  }
+
+  // 2. description: present + non-empty
+  if (!fm.description || !fm.description.trim()) {
+    violations.push('description: field missing or empty');
+  }
+
+  // 3. allowed-tools: present + non-empty + all entries canonical
+  if (!fm['allowed-tools'] || !fm['allowed-tools'].trim()) {
+    violations.push('allowed-tools: block missing or empty');
+  } else {
+    const tools = fm['allowed-tools'].split('\n').map(t => t.trim()).filter(Boolean);
+    for (const tool of tools) {
+      const valid =
+        CANONICAL_TOOLS.has(tool) ||
+        (tool.startsWith('mcp__context7__') && CANONICAL_TOOLS.has('mcp__context7__*'));
+      if (!valid) violations.push(`allowed-tools: unknown tool "${tool}"`);
+    }
+  }
+
+  // 4+5. execution_context @-refs resolve + no trailing prose
+  const refs = extractExecutionContextRefs(content);
+  for (const { token, normalized, trailingProse } of refs) {
+    const absPath = path.join(SDD_ROOT, normalized);
+    if (!fs.existsSync(absPath)) {
+      violations.push(`execution_context: @-ref "${normalized}" does not exist on disk`);
+    }
+    if (trailingProse) {
+      violations.push(`execution_context: @-ref "${token}" has trailing prose on the same line`);
+    }
+  }
+
+  if (violations.length === 0) return null;
+  return { file: rel, violations };
+}
+
+// ─── run ─────────────────────────────────────────────────────────────────────
+
+const commandFiles = fs
+  .readdirSync(COMMANDS_DIR)
+  .filter(f => f.endsWith('.md'))
+  .map(f => path.join(COMMANDS_DIR, f));
+
+const results = commandFiles.map(check).filter(Boolean);
+
+if (results.length === 0) {
+  console.log(
+    `ok lint-command-contract: ${commandFiles.length} command files checked, 0 violations`,
+  );
+  process.exit(0);
+}
+
+const total = results.reduce((n, r) => n + r.violations.length, 0);
+process.stderr.write(
+  `\nERROR lint-command-contract: ${total} violation(s) across ${results.length} file(s)\n\n`,
+);
+for (const r of results) {
+  process.stderr.write(`  ${r.file}\n`);
+  for (const v of r.violations) {
+    process.stderr.write(`    - ${v}\n`);
+  }
+  process.stderr.write('\n');
+}
+process.stderr.write('See docs/adr/0002-command-contract-validation-module.md for the contract spec.\n\n');
+process.exit(1);

package/scripts/lint-descriptions.cjs

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+/**
+ * lint-descriptions.cjs
+ *
+ * Enforces the 100-char description budget for commands/sdd/*.md files.
+ *
+ * Usage:
+ *   node scripts/lint-descriptions.cjs [file.md ...]
+ *
+ * If no args are given, scans commands/sdd/ automatically.
+ * Exits 1 if any description exceeds 100 chars; exits 0 if all pass.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const MAX_LENGTH = 100;
+const COMMANDS_DIR = path.join(__dirname, '..', 'commands', 'sdd');
+
+/**
+ * Parse the description field from frontmatter in a .md file.
+ * Returns null if no description is found.
+ */
+function parseDescription(content) {
+  const fmMatch = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!fmMatch) return null;
+  const fm = fmMatch[1];
+
+  const quoted = fm.match(/^description:\s+"((?:[^"\\]|\\.)*)"\s*$/m);
+  if (quoted) return quoted[1];
+
+  const plain = fm.match(/^description:\s+(.+)$/m);
+  if (plain) return plain[1].trim();
+
+  return null;
+}
+
+function getFiles() {
+  if (process.argv.length > 2) {
+    return process.argv.slice(2);
+  }
+  return fs.readdirSync(COMMANDS_DIR)
+    .filter(f => f.endsWith('.md'))
+    .map(f => path.join(COMMANDS_DIR, f));
+}
+
+const files = getFiles();
+const violations = [];
+
+for (const filePath of files) {
+  let content;
+  try {
+    content = fs.readFileSync(filePath, 'utf-8');
+  } catch (err) {
+    process.stderr.write(`ERROR: Cannot read file: ${filePath}\n  ${err.message}\n`);
+    process.exit(1);
+  }
+
+  const description = parseDescription(content);
+  if (description === null) continue;
+
+  if (description.length > MAX_LENGTH) {
+    violations.push({ filePath, length: description.length, description });
+  }
+}
+
+if (violations.length === 0) {
+  const checked = files.length;
+  process.stdout.write(`ok lint-descriptions: ${checked} file(s) checked, 0 violations\n`);
+  process.exit(0);
+}
+
+process.stderr.write(`\nERROR lint-descriptions: ${violations.length} violation(s) found\n\n`);
+for (const v of violations) {
+  const preview = v.description.length > 120 ? v.description.slice(0, 117) + '...' : v.description;
+  process.stderr.write(`  ${v.filePath}\n`);
+  process.stderr.write(`    Length : ${v.length} (max ${MAX_LENGTH})\n`);
+  process.stderr.write(`    Desc   : ${preview}\n\n`);
+}
+process.stderr.write(`Trim descriptions to <= ${MAX_LENGTH} chars. Flag docs belong in argument-hint:.\n\n`);
+process.exit(1);

package/scripts/lint-no-source-grep-extras.cjs

@@ -0,0 +1,81 @@
+'use strict';
+
+/**
+ * Extended detector for the no-source-grep rule (#2982).
+ *
+ * The base lint (scripts/lint-no-source-grep.cjs) only catches the
+ * direct-chain form: readFileSync(...).includes(...). The much more common
+ * var-binding form escapes it:
+ *
+ *   const src = fs.readFileSync(p, 'utf8');
+ *   // ... 50 lines later ...
+ *   assert.ok(src.includes('foo'));   // ← still source-grep, lint missed it
+ *
+ * This module exposes pure detectors that scan source text and return
+ * structured violation records. The CLI wrapper (in the base lint) calls
+ * these for each test file.
+ *
+ * Tests assert on the typed VIOLATION enum codes, not on prose messages.
+ */
+
+const VIOLATION = Object.freeze({
+  VAR_FROM_READFILE_USED_IN_TEXT_MATCH: 'var_from_readfile_used_in_text_match',
+  WRAPPED_ASSERT_OK_MATCH: 'wrapped_assert_ok_match',
+});
+
+const TEXT_MATCH_METHODS = ['includes', 'startsWith', 'endsWith', 'match', 'search'];
+
+/**
+ * Single-pass scanner. Tracks variables bound from a readFileSync call,
+ * then flags any subsequent <var>.<method>( use where method is one of
+ * TEXT_MATCH_METHODS.
+ */
+function detectVarBindingViolations(src) {
+  // Pass 1: collect variables bound from readFileSync.
+  // Matches:   const|let|var <name> = [fs.]readFileSync(
+  const bindRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:[A-Za-z_$][\w$.]*\.)?readFileSync\s*\(/g;
+  const boundVars = new Set();
+  let m;
+  while ((m = bindRe.exec(src)) !== null) {
+    boundVars.add(m[1]);
+  }
+  if (boundVars.size === 0) return [];
+
+  // Pass 2: find <var>.<method>( on any bound var.
+  const findings = [];
+  // Build a regex alternation from the bound var names.
+  const alt = [...boundVars].map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+  const useRe = new RegExp(
+    `\\b(${alt})\\s*\\.\\s*(${TEXT_MATCH_METHODS.join('|')})\\s*\\(`,
+    'g',
+  );
+  while ((m = useRe.exec(src)) !== null) {
+    findings.push({
+      kind: VIOLATION.VAR_FROM_READFILE_USED_IN_TEXT_MATCH,
+      variable: m[1],
+      method: m[2],
+    });
+  }
+  return findings;
+}
+
+/**
+ * Detects assert.ok(<expr>.match(/.../)) and assert.ok(<expr>.match(<expr>))
+ * which is the same anti-pattern as assert.match but escapes the simpler
+ * regex used by the base lint.
+ */
+function detectWrappedAssertOkMatch(src) {
+  const re = /assert\.ok\s*\(\s*[A-Za-z_$][\w$.]*\.match\s*\(/g;
+  const findings = [];
+  let m;
+  while ((m = re.exec(src)) !== null) {
+    findings.push({ kind: VIOLATION.WRAPPED_ASSERT_OK_MATCH });
+  }
+  return findings;
+}
+
+function detectAll(src) {
+  return [...detectVarBindingViolations(src), ...detectWrappedAssertOkMatch(src)];
+}
+
+module.exports = { detectVarBindingViolations, detectWrappedAssertOkMatch, detectAll, VIOLATION };