@blamejs/exceptd-skills 0.18.6 → 0.18.8

package/scripts/audit-cross-skill.js

@@ -263,4 +263,4 @@ if (issues.length === 0) {
 } else {
   for (const i of issues) console.log("  • " + i);
 }
-process.exit(issues.length === 0 ? 0 : 1);
+process.exit(issues.length === 0 ? 0 : 1); // allow:process-exit-after-stdout-write — top-level local audit script; the issue list above is human-read on a TTY, not a piped --json result channel

package/scripts/bootstrap.js

@@ -121,6 +121,7 @@ function run(label, scriptPath, scriptArgs) {
     });
   } catch (err) {
     console.error(`[bootstrap] FAILED at step "${label}".`);
+    // allow:process-exit-after-stdout-write — local first-run setup script; the step banner above is human-read on a TTY (stdio:'inherit'), not a piped --json result channel
     process.exit(err.status && Number.isInteger(err.status) ? err.status : 1);
   }
 }

package/scripts/build-indexes.js

@@ -69,7 +69,14 @@ function sha256(buf) {
 }
 
 function writeJson(name, obj) {
-  fs.writeFileSync(path.join(IDX, name), JSON.stringify(obj, null, 2) + "\n", "utf8");
+  // Atomic write: a crash / disk-full / SIGKILL mid-write would otherwise leave
+  // a truncated JSON output on disk. Write to a temp sibling and rename — rename
+  // is atomic on POSIX and Windows, so a reader (or the next build's
+  // parse-check) only ever sees the complete old or complete new file.
+  const abs = path.join(IDX, name);
+  const tmp = `${abs}.tmp-${process.pid}`;
+  fs.writeFileSync(tmp, JSON.stringify(obj, null, 2) + "\n", "utf8");
+  fs.renameSync(tmp, abs);
 }
 
 function readJson(p) {
@@ -565,6 +572,25 @@ function outputsAffectedBy(changedPaths) {
   return affected;
 }
 
+// An output's absence/corruption is itself a rebuild trigger. --changed keys
+// on source-hash deltas, but a derived file that was deleted, truncated, or
+// left unparseable must be regenerated even when every source is byte-identical
+// — otherwise the no-op path leaves a broken tree while writeMeta records it as
+// fresh (and reports a 0 count for the file it never rebuilt). Mirrors the
+// existence/parse check in lib/validate-indexes.js verifyOutputs.
+function outputsMissingOrCorrupt() {
+  const broken = new Set();
+  for (const o of OUTPUTS) {
+    const p = path.join(IDX, o.file);
+    let ok = fs.existsSync(p);
+    if (ok) {
+      try { readJson(p); } catch { ok = false; }
+    }
+    if (!ok) broken.add(o.name);
+  }
+  return broken;
+}
+
 function withDependencyClosure(names) {
   // Pull in any dependsOn entries (e.g. token-budget needs section-offsets).
   const closure = new Set(names);
@@ -643,10 +669,41 @@ async function runBuilders(ctx, names, opts) {
   return results;
 }
 
-function writeMeta(ctx, results) {
+function writeMeta(ctx, results, opts = {}) {
+  const prior = loadPriorMeta();
   const sourceFiles = [...liveSourceSet(ctx)];
-  const sourceHashes = {};
-  for (const p of sourceFiles) sourceHashes[p] = sha256(fs.readFileSync(ABS(p)));
+  const computedSourceHashes = {};
+  for (const p of sourceFiles) computedSourceHashes[p] = sha256(fs.readFileSync(ABS(p)));
+
+  // A `--only` build regenerates an ARBITRARY subset of outputs (not the set
+  // implied by source changes), so the un-rebuilt outputs are not guaranteed to
+  // be consistent with the current sources. Preserve the prior source_hashes in
+  // that case, so validate-indexes still detects drift and demands a full
+  // rebuild — overwriting them with current hashes would fail OPEN, recording
+  // stale outputs as fresh. (--changed rebuilds exactly the change-affected
+  // outputs and a full build rebuilds all, so their current hashes are accurate.)
+  const partial = !!(opts && opts.only);
+  const sourceHashes = (partial && prior && prior.source_hashes && typeof prior.source_hashes === "object")
+    ? prior.source_hashes
+    : computedSourceHashes;
+
+  const outputsList = OUTPUTS.map((o) => o.file).sort();
+
+  // Determinism: preserve the prior `generated_at` when the inputs are
+  // byte-identical to the last build (same source hashes AND same output set).
+  // validate-indexes keys freshness on `source_hashes`/`outputs`, never on the
+  // timestamp, so re-stamping a no-op run with a fresh wall-clock value adds
+  // no freshness signal and only produces a spurious git diff — contradicting
+  // the documented "identical inputs always produce identical outputs"
+  // contract for --changed (and the idempotence the predeploy gate relies on).
+  // Reuse the prior timestamp on a genuine no-op; mint a new one only when the
+  // hashed surface actually moved (or there is no prior meta to inherit from).
+  const sourcesUnchanged = prior && prior.source_hashes &&
+    JSON.stringify(prior.source_hashes) === JSON.stringify(sourceHashes) &&
+    JSON.stringify(prior.outputs || []) === JSON.stringify(outputsList);
+  const generatedAt = sourcesUnchanged && typeof prior.generated_at === "string"
+    ? prior.generated_at
+    : new Date().toISOString();
 
   // Stats are computed from in-memory results when available, else from disk
   // (covers --only / --changed runs that didn't rebuild every output).
@@ -683,12 +740,17 @@ function writeMeta(ctx, results) {
 
   const meta = {
     schema_version: "1.1.0",
-    generated_at: new Date().toISOString(),
+    generated_at: generatedAt,
     generator: "scripts/build-indexes.js",
-    source_count: sourceFiles.length,
+    source_count: Object.keys(sourceHashes).length,
     source_hashes: sourceHashes,
     skill_count: ctx.skills.length,
     catalog_count: ctx.catalogFiles.length,
+    // The derived index files this build produces. validate-indexes confirms
+    // every one still exists and parses — source hashes alone do not detect a
+    // deleted/truncated/corrupted OUTPUT (an index file removed from a clean
+    // source tree would otherwise pass the freshness gate as "current").
+    outputs: outputsList,
     index_stats: {
       xref_entries: xrefStats,
       trigger_table_entries: Object.keys(trigger).length,
@@ -742,12 +804,23 @@ async function main() {
     const changed = changedSources(ctx, prior);
     log(`changed sources: ${changed.length}`);
     const affected = outputsAffectedBy(changed);
+    // Union in any output that no longer exists on disk or fails to parse.
+    // A deleted/corrupt output is a rebuild trigger independent of source
+    // hashes — without this, --changed reports "nothing to do" and writeMeta
+    // would claim freshness for a tree that's actually broken.
+    const broken = outputsMissingOrCorrupt();
+    for (const name of broken) affected.add(name);
+    if (broken.size > 0) log(`missing/corrupt outputs to regenerate: ${[...broken].sort().join(", ")}`);
     chosen = withDependencyClosure(affected);
     if (chosen.size === 0) {
       log("build-indexes: no outputs need rebuilding (sources unchanged)");
-      // Still rewrite _meta.json with the same hashes — preserves freshness
-      // semantics for the predeploy gate even when nothing else changed.
-      writeMeta(ctx, {});
+      // Rewrite _meta.json so its hash table + outputs list self-heal against
+      // the live source set (e.g. an old-format _meta that predates a field).
+      // writeMeta preserves the prior `generated_at` when the hashed surface is
+      // byte-identical, so a genuine no-op leaves the file unchanged — no
+      // spurious timestamp-only diff. Re-stamping would add no freshness signal
+      // (validate-indexes keys on source_hashes/outputs, not the timestamp).
+      writeMeta(ctx, {}, opts);
       return;
     }
   } else {
@@ -757,7 +830,7 @@ async function main() {
   log(`build-indexes — ${chosen.size} output(s) ${opts.parallel ? "in parallel" : "sequential"}${opts.changed ? " (--changed)" : ""}${opts.only ? ` (--only ${opts.only})` : ""}`);
 
   const results = await runBuilders(ctx, chosen, opts);
-  writeMeta(ctx, results);
+  writeMeta(ctx, results, opts);
 
   log(`build-indexes — done`);
 }
@@ -769,4 +842,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { OUTPUTS, loadSources, runBuilders, writeMeta };
+module.exports = { OUTPUTS, loadSources, runBuilders, writeMeta, outputsMissingOrCorrupt };

package/scripts/check-agents-md-collectors.js

@@ -54,25 +54,53 @@ function main() {
     return;
   }
 
-  let collectorFiles;
+  let jsFiles;
   try {
-    collectorFiles = fs.readdirSync(COLLECTOR_DIR)
-      .filter(f => f.endsWith(".js"))
-      // A collector is a module exporting a collect() function. Shared
-      // helpers under lib/collectors/ (e.g. scan-excludes.js, the directory-
-      // walk exclusion policy) are not collectors and must not inflate the
-      // count or be required in the AGENTS.md enumeration.
-      .filter(f => {
-        try { return typeof require(path.join(COLLECTOR_DIR, f)).collect === "function"; }
-        catch { return false; }
-      })
-      .map(f => `lib/collectors/${f}`)
-      .sort();
+    jsFiles = fs.readdirSync(COLLECTOR_DIR).filter(f => f.endsWith(".js")).sort();
   } catch (e) {
     console.error(`[check-agents-md-collectors] cannot read ${COLLECTOR_DIR}: ${e.message}`);
     process.exitCode = 2;
     return;
   }
+
+  // Classify every lib/collectors/*.js into exactly one of three buckets:
+  //   - collector:  require() succeeds AND exports a collect() function
+  //                 (counted; must appear in the AGENTS.md enumeration).
+  //   - helper:     require() succeeds but exports no collect() function
+  //                 (e.g. scan-excludes.js, the directory-walk exclusion
+  //                 policy) — legitimately excluded from the count.
+  //   - load-error: require() THROWS (syntax error, bad top-level require,
+  //                 init-time exception). A broken collector must NOT be
+  //                 silently dropped: doing so excludes it from BOTH the
+  //                 count and the enumeration cross-check, so a file that
+  //                 still ships in the tarball passes the gate undetected.
+  //                 Surface it as a parse error (exit 2) naming the file.
+  const collectorFiles = [];
+  const loadErrors = [];
+  for (const f of jsFiles) {
+    let mod;
+    try {
+      mod = require(path.join(COLLECTOR_DIR, f));
+    } catch (e) {
+      loadErrors.push(`lib/collectors/${f}: ${e.message.split("\n")[0]}`);
+      continue;
+    }
+    if (typeof mod.collect === "function") {
+      collectorFiles.push(`lib/collectors/${f}`);
+    }
+  }
+  collectorFiles.sort();
+
+  if (loadErrors.length > 0) {
+    console.error(
+      `[check-agents-md-collectors] cannot load ${loadErrors.length} module(s) in lib/collectors/ ` +
+      `- a require-time failure must not be silently excluded from the count + enumeration check:\n  ` +
+      loadErrors.join("\n  ")
+    );
+    process.exitCode = 2;
+    return;
+  }
+
   const onDiskCount = collectorFiles.length;
 
   const para = agents.match(/(\b[A-Z][a-z]+)\s+reference collectors ship today\s*\(([^)]+)\)/);

package/scripts/check-changelog-extract.js

@@ -47,7 +47,7 @@ function extractSection(text, version) {
   const lines = text.split(/\r?\n/);
   const out = [];
   let capturing = false;
-  const startRe = new RegExp('^## ' + version.replace(/\./g, '\\.') + ' ');
+  const startRe = new RegExp('^## ' + version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + ' ');
   for (const ln of lines) {
     if (capturing) {
       if (/^## /.test(ln)) break;
@@ -65,7 +65,7 @@ function extractSection(text, version) {
 
 // Returns the `## <version> — <date>` heading line for the version, or null.
 function headingLine(text, version) {
-  const re = new RegExp('^## ' + version.replace(/\./g, '\\.') + ' ');
+  const re = new RegExp('^## ' + version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + ' ');
   return text.split(/\r?\n/).find((l) => re.test(l)) || null;
 }
 
@@ -82,7 +82,7 @@ const FORBIDDEN = [
   { id: 'agent-dispatch', re: /\b(?:sub-?agent|parallel agent|agent dispatch|fan(?:ned)?[ -]out|multi-agent)\b/i, why: 'implementation detail (agent/parallelization)' },
   { id: 'conversation-residue', re: /\b(?:as discussed|per your|operator-confirmed|as you (?:noted|requested)|per the conversation|PR feedback:)\b/i, why: 'conversation residue (invisible to the reader)' },
   { id: 'process-narrative', re: /\b(?:audit-derived|post-phase-\d|as part of the \d|the \d+-gap closure)\b/i, why: 'internal-process narrative' },
-  { id: 'tautological-green', re: /\b(?:all tests (?:pass|passing|green)|CI green|smoke \+ e2e (?:clean|pass)|tests? (?:are )?passing)\b/i, why: 'tautological pass/green claim (noise — the release exists)' },
+  { id: 'tautological-green', re: /\b(?:all(?:\s+\d+)?\s+(?:tests?|checks?|gates?|suites?)\s+(?:pass(?:ing)?|green)|(?:the\s+)?(?:whole|entire|full)\s+(?:test\s+)?suite\s+(?:is\s+)?(?:pass(?:ing|ed|es)?|green)|every\s+(?:test|check|gate)\s+(?:pass(?:es|ing|ed)?|is\s+green)|\d+\s*\/\s*\d+\s+(?:tests?|gates?|checks?)\s+(?:pass(?:ing|es|ed)?|green)|CI green|smoke \+ e2e (?:clean|pass)|tests? (?:are )?passing)\b/i, why: 'tautological pass/green claim (noise — the release exists). Covers the numbered ("all 288 tests green"), count ("288/288 tests pass", "21/21 gates pass"), and synonym ("full suite green", "every check passes") forms of the same banned claim.' },
 ];
 
 function lintOperatorClean(sectionLines) {
@@ -152,7 +152,7 @@ function main() {
     return;
   }
   // Heading must carry an ISO date: `## <version> — YYYY-MM-DD`.
-  if (!new RegExp('^## ' + version.replace(/\./g, '\\.') + ' [—-] \\d{4}-\\d{2}-\\d{2}\\s*$').test(heading)) {
+  if (!new RegExp('^## ' + version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + ' [—-] \\d{4}-\\d{2}-\\d{2}\\s*$').test(heading)) {
     console.error('[check-changelog-extract] FAIL: heading does not match `## ' + version + ' — YYYY-MM-DD`:');
     console.error('[check-changelog-extract]   got: ' + JSON.stringify(heading));
     process.exitCode = 1;

package/scripts/check-codebase-patterns.js

@@ -104,11 +104,25 @@ function readLines(rel) {
 }
 
 // Strip a trailing `//` line comment for code-shape detection (so a class
-// name mentioned in a comment doesn't arm a detector). Leaves string contents
-// alone enough for the coarse line-level checks here.
+// name mentioned in a comment doesn't arm a detector). String-aware: a `//`
+// inside a quoted string (e.g. a `http://` URL) is NOT a comment, so the
+// scanner skips string contents — otherwise the rest of the line, including a
+// real `process.exit(...)` / `new RegExp(...)`, was silently truncated away and
+// the detector never fired.
 function stripLineComment(line) {
-  const idx = line.indexOf("//");
-  return idx === -1 ? line : line.slice(0, idx);
+  let inStr = null; // active quote char, or null
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (inStr) {
+      if (ch === "\\") { i++; continue; } // skip the escaped char
+      if (ch === inStr) inStr = null;
+    } else if (ch === "'" || ch === '"' || ch === "`") {
+      inStr = ch;
+    } else if (ch === "/" && line[i + 1] === "/") {
+      return line.slice(0, i);
+    }
+  }
+  return line;
 }
 
 // ---- allow-marker engine -------------------------------------------------
@@ -172,7 +186,7 @@ const FUNCTION_START = /(^|[^.\w])function\b|=>\s*\{?\s*$|^\s*(async\s+)?[A-Za-z
 
 function detectProcessExitAfterStdout(files) {
   const hits = [];
-  for (const rel of (files || filesUnder(["lib", "orchestrator"]))) {
+  for (const rel of (files || filesUnder(["bin/exceptd.js", "lib", "orchestrator", "scripts"]))) {
     const lines = readLines(rel);
     const mainRanges = requireMainRanges(lines);
     for (let i = 0; i < lines.length; i++) {

package/scripts/check-manifest-snapshot.js

@@ -37,7 +37,6 @@ const crypto = require("crypto");
 const ROOT = path.join(__dirname, "..");
 const MANIFEST_PATH = path.join(ROOT, "manifest.json");
 const SNAPSHOT_PATH = path.join(ROOT, "manifest-snapshot.json");
-const SNAPSHOT_SHA_PATH = path.join(ROOT, "manifest-snapshot.sha256");
 
 function captureSurface(manifest) {
   // Public surface = the set of facts downstream consumers may have
@@ -171,7 +170,71 @@ function formatDiff(result) {
   return lines.join("\n");
 }
 
-module.exports = { captureSurface, diff, formatDiff };
+/**
+ * Verify the on-disk snapshot still hashes to the value recorded in its
+ * .sha256 sidecar. The sidecar is the only thing that catches a hand-edit
+ * of manifest-snapshot.json that bypassed refresh-manifest-snapshot.js
+ * (the surface diff alone is defeated by editing manifest.json AND the
+ * baseline in lockstep — e.g. to hide a removed skill/trigger). The
+ * sidecar pins the baseline's exact bytes so that lockstep edit no longer
+ * produces a matching pair.
+ *
+ * Pairing invariant: refresh-manifest-snapshot.js always writes BOTH the
+ * snapshot and its sidecar, and package.json `files` ships them together.
+ * So a snapshot present WITHOUT its sidecar is not a benign legacy state
+ * for any tree the current gate runs against (CI/predeploy run on the
+ * committed tree, where both are present; the shipped tarball ships both).
+ * An absent sidecar next to a present snapshot is the integrity-evasion
+ * shape — treat it as a failure, symmetric with the present-but-mismatch
+ * failure. Returns { ok, error } so callers can surface a hard exit.
+ *
+ * @param {string} root  repo root containing the snapshot + sidecar
+ * @returns {{ok: boolean, error: (string|null)}}
+ */
+function checkSnapshotIntegrity(root) {
+  const snapshotPath = path.join(root, "manifest-snapshot.json");
+  const shaPath = path.join(root, "manifest-snapshot.sha256");
+
+  if (!fs.existsSync(snapshotPath)) {
+    // No snapshot at all — the caller's baseline-read handles this as a
+    // distinct error. Nothing for the integrity check to anchor against.
+    return { ok: true, error: null };
+  }
+
+  if (!fs.existsSync(shaPath)) {
+    return {
+      ok: false,
+      error:
+        "manifest-snapshot.sha256 missing while manifest-snapshot.json is present — " +
+        "the integrity sidecar that detects a hand-edited baseline is gone. " +
+        "The two ship as a pair (package.json `files`) and refresh-manifest-snapshot.js " +
+        "always writes both; an absent sidecar next to a present snapshot is the " +
+        "integrity-evasion shape, not a benign state. " +
+        "Re-run `node scripts/refresh-manifest-snapshot.js --commit-only` to regenerate it.",
+    };
+  }
+
+  const expectedLine = fs.readFileSync(shaPath, "utf8").trim();
+  const expectedSha = expectedLine.split(/\s+/)[0];
+  const liveSha = crypto
+    .createHash("sha256")
+    .update(fs.readFileSync(snapshotPath))
+    .digest("hex");
+  if (expectedSha !== liveSha) {
+    return {
+      ok: false,
+      error:
+        `manifest-snapshot.json integrity check FAILED ` +
+        `(expected ${expectedSha.slice(0, 12)}…, live ${liveSha.slice(0, 12)}…). ` +
+        "Someone edited manifest-snapshot.json without running refresh-manifest-snapshot.js. " +
+        "Re-run `node scripts/refresh-manifest-snapshot.js --commit-only` to regenerate.",
+    };
+  }
+
+  return { ok: true, error: null };
+}
+
+module.exports = { captureSurface, diff, formatDiff, checkSnapshotIntegrity };
 
 if (require.main === module) {
   try {
@@ -190,34 +253,15 @@ if (require.main === module) {
       process.exit(2);
     }
 
-    // when manifest-snapshot.sha256 is present, validate that
-    // the on-disk snapshot still hashes to the recorded value. Catches a
-    // hand-edit of manifest-snapshot.json that bypassed refresh-manifest-
-    // snapshot.js (so the F5 commit-only guard never had a chance to fire).
-    // The file is OPTIONAL: when absent, the gate warns-and-continues so
-    // pre-v0.12.14 trees still work.
-    if (fs.existsSync(SNAPSHOT_SHA_PATH)) {
-      const expectedLine = fs.readFileSync(SNAPSHOT_SHA_PATH, "utf8").trim();
-      const expectedSha = expectedLine.split(/\s+/)[0];
-      const liveSha = crypto
-        .createHash("sha256")
-        .update(fs.readFileSync(SNAPSHOT_PATH))
-        .digest("hex");
-      if (expectedSha !== liveSha) {
-        console.error(
-          "[check-manifest-snapshot] manifest-snapshot.json integrity check FAILED " +
-          `(expected ${expectedSha.slice(0, 12)}…, live ${liveSha.slice(0, 12)}…). ` +
-          "Someone edited manifest-snapshot.json without running refresh-manifest-snapshot.js. " +
-          "Re-run `node scripts/refresh-manifest-snapshot.js --commit-only` to regenerate."
-        );
-        process.exit(1);
-      }
-    } else {
-      console.warn(
-        "[check-manifest-snapshot] WARN: manifest-snapshot.sha256 missing — " +
-        "integrity check skipped. Run `node scripts/refresh-manifest-snapshot.js --commit-only` " +
-        "to generate it."
-      );
+    // Integrity gate: the snapshot must hash to its recorded sidecar value,
+    // and the sidecar must be present whenever the snapshot is. A missing
+    // sidecar next to a present snapshot is itself a failure — it is the
+    // only thing that would have caught a lockstep hand-edit of manifest.json
+    // + the baseline, so allowing it to be deleted re-opens that bypass.
+    const integrity = checkSnapshotIntegrity(ROOT);
+    if (!integrity.ok) {
+      console.error("[check-manifest-snapshot] " + integrity.error);
+      process.exit(1);
     }
 
     const manifest = JSON.parse(fs.readFileSync(MANIFEST_PATH, "utf8"));

package/scripts/check-sbom-currency.js

@@ -141,7 +141,14 @@ function checkSbomCurrency(root) {
   // and the skill count were. Pin them to the live values so a stale
   // description (e.g. after an auto-refresh changed a count) fails the gate.
   const catalogMatch = description.match(/(\d+)\s+catalogs?\b/i);
-  if (catalogMatch && Number(catalogMatch[1]) !== liveCatalogs) {
+  if (!catalogMatch) {
+    // Symmetric with the entry/skill tokens: absence fails CLOSED. A reworded
+    // description (or an auto-refresh that dropped the token) must not silently
+    // skip the count check — that is the asymmetric-absent fail-open class.
+    errors.push(
+      "SBOM description is missing the catalog-count token (N catalogs) — regenerate via `npm run refresh-sbom`"
+    );
+  } else if (Number(catalogMatch[1]) !== liveCatalogs) {
     errors.push(
       `SBOM description catalog count is ${Number(catalogMatch[1])} but live data/ has ${liveCatalogs} catalogs — description is stale; update package.json.description and \`npm run refresh-sbom\``
     );
@@ -157,10 +164,23 @@ function checkSbomCurrency(root) {
     }
   })();
   const jurisdictionMatch = description.match(/(\d+)\s+jurisdictions?\b/i);
-  if (liveJurisdictions !== null && jurisdictionMatch && Number(jurisdictionMatch[1]) !== liveJurisdictions) {
-    errors.push(
-      `SBOM description jurisdiction count is ${Number(jurisdictionMatch[1])} but live global-frameworks.json has ${liveJurisdictions} — description is stale; update package.json.description and \`npm run refresh-sbom\``
-    );
+  // Only enforce the jurisdiction token when the live source exists — a partial
+  // `--root` tree without global-frameworks.json (liveJurisdictions === null)
+  // skips the check rather than failing, matching catalogEntryCount's null-skip.
+  // When the source IS present, absence of the token fails CLOSED (the
+  // description token is the SBOM's only jurisdiction-count assertion — there is
+  // no structured jurisdiction property — so a dropped token would otherwise
+  // leave the count entirely unvalidated).
+  if (liveJurisdictions !== null) {
+    if (!jurisdictionMatch) {
+      errors.push(
+        "SBOM description is missing the jurisdiction-count token (N jurisdictions) — regenerate via `npm run refresh-sbom`"
+      );
+    } else if (Number(jurisdictionMatch[1]) !== liveJurisdictions) {
+      errors.push(
+        `SBOM description jurisdiction count is ${Number(jurisdictionMatch[1])} but live global-frameworks.json has ${liveJurisdictions} — description is stale; update package.json.description and \`npm run refresh-sbom\``
+      );
+    }
   }
 
   // Component-level cross-check (defense-in-depth). In normal operation

package/scripts/check-test-count.js

@@ -63,10 +63,13 @@ function countTests(filePath) {
   text = text.replace(/\/\*[\s\S]*?\*\//g, '');
   let count = 0;
   for (const rawLine of text.split('\n')) {
-    // Drop a trailing line comment too (`test('x'); // disabled`). Best-effort:
-    // a `//` inside a string literal would over-strip, which under-counts — the
-    // SAFE direction for a no-silent-shrinkage gate.
-    const stripped = rawLine.replace(/\/\/.*$/, '').trim();
+    // Blank out single-line string/template literal BODIES first so a `test(`
+    // mentioned inside a string (e.g. an assertion on output text, or this very
+    // file's docstring examples) is not miscounted as a declaration — that
+    // phantom inflated the baseline and could mask a real test deletion.
+    const noStrings = rawLine.replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g, "''");
+    // Drop a trailing line comment too (`test('x'); // disabled`).
+    const stripped = noStrings.replace(/\/\/.*$/, '').trim();
     if (!stripped) continue;
     if (/(?<![A-Za-z0-9_$.])test(?:\.only|\.skip)?\s*\(/.test(stripped)) count++;
   }
@@ -77,17 +80,33 @@ function main() {
   const wantJson = process.argv.includes('--json');
   const wantUpdate = process.argv.includes('--update-baseline');
 
-  if (!fs.existsSync(BASELINE_PATH)) {
+  // Read the baseline once and branch on the read RESULT, not on a prior
+  // existsSync probe. A separate existsSync(BASELINE_PATH)-then-read opens a
+  // check-then-use window (CodeQL js/file-system-race) where the file the
+  // gate decides about is not the file it later reads. ENOENT from the single
+  // read IS the "missing" signal — no second path access needed.
+  let baselineRaw = null;
+  try {
+    baselineRaw = fs.readFileSync(BASELINE_PATH, 'utf8');
+  } catch (e) {
+    if (e.code !== 'ENOENT') {
+      console.error(`[check-test-count] cannot read baseline: ${e.message}`);
+      process.exit(2);
+    }
+    // ENOENT — baseline absent.
     if (wantUpdate) {
       const files = listTestFiles(TESTS_DIR);
       const observed = files.reduce((n, f) => n + countTests(f), 0);
+      // Exclusive create ('wx'): fails with EEXIST if the file appeared
+      // between the read above and this write, so we never clobber a baseline
+      // a concurrent run just produced — atomic, no check-then-write window.
       fs.writeFileSync(BASELINE_PATH, JSON.stringify({
         baseline: observed,
         tolerance: 1,
         update_baseline_when_growth_exceeds: 20,
         notes: 'Operator-pinned canonical test count. Bump when new test files land in a release. See scripts/check-test-count.js for the contract.',
         recorded_at: new Date().toISOString().slice(0, 10),
-      }, null, 2) + '\n', 'utf8');
+      }, null, 2) + '\n', { encoding: 'utf8', flag: 'wx' });
       console.error(`[check-test-count] wrote initial baseline: ${observed}`);
       process.exit(0);
     }
@@ -96,7 +115,7 @@ function main() {
   }
 
   let baselineFile;
-  try { baselineFile = JSON.parse(fs.readFileSync(BASELINE_PATH, 'utf8')); }
+  try { baselineFile = JSON.parse(baselineRaw); }
   catch (e) {
     console.error(`[check-test-count] cannot parse baseline: ${e.message}`);
     process.exit(2);

package/scripts/check-test-coverage.js

@@ -316,17 +316,37 @@ function extractLibExports(content) {
   const objStart = stripped.search(/module\.exports\s*=\s*\{/);
   if (objStart !== -1) {
     const openIdx = stripped.indexOf("{", objStart);
-    let depth = 0, end = -1;
+    // String-aware brace balance: a `}` inside a string/template value (e.g.
+    // `{ PATTERN: "a}b", realExport }`) must NOT close the object early and
+    // hide the exports that follow — that blind spot let an uncovered export
+    // ship green.
+    let depth = 0, end = -1, inStr = null;
     for (let i = openIdx; i < stripped.length; i++) {
       const ch = stripped[i];
+      if (inStr) {
+        if (ch === "\\") { i++; continue; }
+        if (ch === inStr) inStr = null;
+        continue;
+      }
+      if (ch === "'" || ch === '"' || ch === "`") { inStr = ch; continue; }
       if (ch === "{") depth++;
       else if (ch === "}") { depth--; if (depth === 0) { end = i; break; } }
     }
     if (end !== -1) {
       const body = stripped.slice(openIdx + 1, end);
-      let d = 0, cur = "";
+      // String-aware member split: a `,` or bracket inside a string value must
+      // not split a member or skew the bracket depth.
+      let d = 0, cur = "", sInStr = null;
       const members = [];
-      for (const ch of body) {
+      for (let i = 0; i < body.length; i++) {
+        const ch = body[i];
+        if (sInStr) {
+          cur += ch;
+          if (ch === "\\") { cur += (body[i + 1] || ""); i++; continue; }
+          if (ch === sInStr) sInStr = null;
+          continue;
+        }
+        if (ch === "'" || ch === '"' || ch === "`") { sInStr = ch; cur += ch; continue; }
         if (ch === "{" || ch === "[") d++;
         else if (ch === "}" || ch === "]") d--;
         if (ch === "," && d === 0) { members.push(cur); cur = ""; }
@@ -335,10 +355,30 @@ function extractLibExports(content) {
       members.push(cur);
       for (const tok of members) {
         const id = tok.split(":")[0].trim();
-        if (/^[a-zA-Z_$][\w$]*$/.test(id)) out.add(id);
+        if (/^[a-zA-Z_$][\w$]*$/.test(id)) { out.add(id); continue; }
+        // Method-shorthand member (`fn(a){...}`, `async load(){}`, `get x(){}`,
+        // `*gen(){}`): the colon-split above fails the id test because the token
+        // is `name(...)...`, so the export name would be silently dropped and a
+        // new exported method would ship with no diff-coverage requirement.
+        // Recover the name as the identifier immediately before the first `(`,
+        // after any leading modifier keyword (async/get/set) or generator `*`.
+        const beforeParen = tok.split("(")[0].trim();
+        const parts = beforeParen.split(/\s+/);
+        const cand = parts[parts.length - 1].replace(/^\*/, "").trim();
+        if (/^[a-zA-Z_$][\w$]*$/.test(cand)) out.add(cand);
       }
     }
   }
+  // Single-identifier whole-module export (`module.exports = mainFn;`): the
+  // entire public surface of a lib file is one assigned function. The object
+  // extractor above matches nothing, so without this the file's only export is
+  // invisible to the gate and a change to it requires no test. Capture the bare
+  // identifier on the RHS of `module.exports =` when it is not an object/array/
+  // function-expression/arrow (those are handled elsewhere or have no name).
+  const singleIdent = stripped.match(/module\.exports\s*=\s*([a-zA-Z_$][\w$]*)\s*;/);
+  if (singleIdent && !/^(function|async|class)$/.test(singleIdent[1])) {
+    out.add(singleIdent[1]);
+  }
   const re = /module\.exports\.([a-zA-Z_$][\w$]*)\s*=/g;
   let mm;
   while ((mm = re.exec(stripped)) !== null) out.add(mm[1]);