@blamejs/exceptd-skills 0.19.33 → 0.19.35

package/scripts/check-test-subjects.js

@@ -1,27 +1,13 @@
 #!/usr/bin/env node
 "use strict";
 /**
- * check-test-subjects.js — bidirectional test↔subject gate (and reorg driver).
+ * Bidirectional test↔subject gate. Every tests/<x>.test.js must name a real
+ * subject and every subject must have a test. Subjects are derived from the
+ * codebase, not a hand-maintained list.
  *
- * Every test file must be named after a real SUBJECT the codebase actually has,
- * and every subject must have a test. A "subject" is derived dynamically from
- * the codebase so this list is never hand-maintained:
- *   - a source MODULE basename (lib/x.js -> x; lib/collectors/x.js -> x and
- *     collectors-x; orchestrator/index.js -> orchestrator; bin/exceptd.js -> cli)
- *   - an exported FUNCTION / CLASS name (kebab-cased) — per-function granularity
- *   - a data PRIMITIVE: a data/*.json catalog FILE, plus each catalog ENTRY that
- *     is itself a primitive — every CVE/MAL/GHSA id in data/cve-catalog.json and
- *     every playbook in data/playbooks/ — so one CVE == one test file
- *   - a .github/workflows/*.yml WORKFLOW (release -> release-workflow, etc.)
- *   - a CLI verb dispatched by bin/exceptd.js
- *
- * FORWARD violation : a tests/<x>.test.js where <x> is not a valid subject.
- * REVERSE violation : a subject (module / CVE / playbook / workflow) with no
- *                     tests/<subject>.test.js.
- *
- * Run with --worklist for the machine-readable reorg work list (JSON on stdout).
- * Run with no flag for a human summary; exits non-zero while any violation
- * remains (so once the suite conforms this becomes a standing predeploy gate).
+ * A FORWARD violation is a test file naming no subject; a REVERSE violation is
+ * a subject with no test. --worklist writes the machine-readable list to
+ * stdout; either violation exits non-zero.
  */
 const fs = require("node:fs");
 const path = require("node:path");
@@ -42,22 +28,16 @@ function deriveSubjects() {
       if (e.isDirectory()) { walkSrc(rel); continue; }
       if (!e.name.endsWith(".js")) continue;
       const base = e.name.replace(/\.js$/, "");
-      // index.js is a directory entry point; the directory/canonical subject
-      // covers it, so treat the bare "index" basename as an alias, not a
-      // separately reverse-required module.
+      // A bare "index" is an alias, not a reverse-required module.
       add(base, (base === "index" ? "alias:" : "module:") + rel);
       const parent = path.basename(path.dirname(rel));
-      // parent-prefixed name (collectors-x, builders-x, validators-x) is an
-      // ALIAS of the canonical basename subject — a valid test target, but the
-      // canonical <base>.test.js already satisfies coverage, so don't double-
-      // count the alias as its own reverse gap.
+      // A parent-prefixed name (collectors-x) is an alias of the canonical
+      // basename: a valid test target, never its own reverse gap.
       if (!["lib", "scripts", "orchestrator", "bin"].includes(parent)) add(parent + "-" + base, "alias:" + rel);
       const txt = read(rel);
       for (const m of txt.matchAll(/(?:^|\n)\s*(?:async\s+)?(?:function|class)\s+([A-Za-z_$][\w$]*)/g)) add(camelKebab(m[1]), "fn:" + rel);
-      // Capture the FULL module.exports object via a brace-balanced scan. A
-      // non-greedy /\{([\s\S]*?)\}/ stops at the first nested `}` and drops
-      // every export name after it (the brace-truncation class), under-deriving
-      // subjects so a real export silently has no required test.
+      // Brace-balanced scan, not a non-greedy /\{([\s\S]*?)\}/ — that stops at
+      // the first nested `}` and drops every export after it.
       const expAt = txt.search(/module\.exports\s*=\s*\{/);
       if (expAt >= 0) {
         const open = txt.indexOf("{", expAt);
@@ -70,43 +50,28 @@ function deriveSubjects() {
   ["lib", "orchestrator", "scripts", "bin", "sources/validators"].forEach(walkSrc);
   add("orchestrator", "module:orchestrator/index.js");
   add("cli", "module:bin/exceptd.js");
-  // Vendored (pinned third-party) modules are valid test SUBJECTS but are not
-  // reverse-required — we don't force a dedicated test per vendored file.
+  // Vendored modules are valid test subjects but not reverse-required.
   (function walkVendor(d) { for (const e of ls(d)) { const rel = d + "/" + e.name; if (e.isDirectory()) walkVendor(rel); else if (e.name.endsWith(".js")) add(e.name.replace(/\.js$/, ""), "vendor:" + rel); } })("vendor");
 
-  // CLI verbs — both the switch-case form and the dispatch-table form
-  //   (verb: () => path.join(...)) that bin/exceptd.js uses for most subcommands.
+  // Both dispatch forms bin/exceptd.js uses: switch-case and the `verb: () =>` table.
   const cliSrc = read("bin/exceptd.js");
   for (const m of cliSrc.matchAll(/case\s+['"]([a-z][a-z0-9-]+)['"]/g)) { add("cli-" + m[1], "cli-verb"); add(m[1], "cli-verb"); }
   for (const m of cliSrc.matchAll(/^\s*["']?([a-z][a-z0-9-]+)["']?:\s*\(\)\s*=>/gm)) { add("cli-" + m[1], "cli-verb"); add(m[1], "cli-verb"); }
 
-  // data catalog files
   for (const e of ls("data")) if (e.isFile() && e.name.endsWith(".json")) add(e.name.replace(/\.json$/, ""), "data");
-  // data ENTRY primitives: every CVE id + every playbook
-  // CVE-primitive subjects. An unreadable / malformed / empty catalog must NOT
-  // silently derive zero CVE subjects — that would let the reverse-coverage gate
-  // PASS with no CVE coverage at all (the absent-input false-pass class). Fail
-  // loud instead.
+  // A zero-subject derivation throws rather than passing reverse coverage empty.
   let cveDerived = 0;
   try { const cat = JSON.parse(read("data/cve-catalog.json")); for (const k of Object.keys(cat)) if (k !== "_meta") { add(k.toLowerCase(), "cve-primitive"); cveDerived++; } }
   catch (e) { throw new Error("check-test-subjects: cannot read/parse data/cve-catalog.json — refusing to derive subjects (reverse coverage would falsely pass with no CVE coverage): " + e.message); }
   if (cveDerived === 0) throw new Error("check-test-subjects: data/cve-catalog.json yielded zero CVE entries — refusing to let reverse coverage pass with no CVE coverage.");
-  // Playbook-primitive subjects. Mirror the CVE-catalog guard above: an
-  // unreadable / empty data/playbooks must NOT silently derive zero playbook
-  // subjects — that lets the reverse-coverage gate pass with no playbook
-  // coverage (the same absent-input false-pass class). Fail loud instead.
+  // Same floor for playbooks.
   let pbDerived = 0;
   for (const e of ls("data/playbooks")) if (e.isFile() && e.name.endsWith(".json")) { const b = e.name.replace(/\.json$/, ""); add(b, "playbook-primitive"); add("playbook-" + b, "alias:playbook"); pbDerived++; }
   if (pbDerived === 0) throw new Error("check-test-subjects: data/playbooks/ yielded zero playbooks — refusing to let reverse coverage pass with no playbook coverage.");
-  // workflows
   for (const e of ls(".github/workflows")) if (/\.ya?ml$/.test(e.name)) { const b = e.name.replace(/\.ya?ml$/, ""); add(b, "workflow"); add(b + "-workflow", "workflow"); }
 
-  // Repo-artifact subjects: shipped root config/doc files, the docker build
-  // context, the agents/ directory, and aggregate catalog directories. A test
-  // that pins one of these artifacts (its content, counts, or cross-references)
-  // is named after a durable subject, not a release — so these are valid test
-  // targets. Kind is not module/cve/playbook, so they are NOT reverse-required
-  // (we don't force a dedicated test per doc file).
+  // Repo artifacts — valid test targets, but their kind is not
+  // module/cve/playbook, so none of them is reverse-required.
   for (const f of ["package.json", "manifest.json", "manifest-snapshot.json", "README.md", "AGENTS.md", "SECURITY.md", "ARCHITECTURE.md", "CONTEXT.md", "CHANGELOG.md", "CONTRIBUTING.md", "CODE_OF_CONDUCT.md", "LICENSE", "NOTICE"]) {
     add(f.replace(/\.[^.]*$/, "").toLowerCase().replace(/_/g, "-"), "repo:" + f);
   }
@@ -116,12 +81,8 @@ function deriveSubjects() {
   add("playbooks", "aggregate:data/playbooks");
   add("workflows", "aggregate:.github/workflows");
   add("governance", "repo:governance-files"); // LICENSE/NOTICE/FUNDING/CoC/gitignore/gitleaks presence + integrity
-  // Module-subject floor. The source walk over lib/orchestrator/scripts/bin
-  // uses ls(), which returns [] on a read failure — so an unreadable source
-  // tree would derive zero reverse-required module subjects and let the gate
-  // pass with no module coverage (the absent-input false-pass class, same as
-  // the CVE/playbook guards). The repo always has dozens of modules; zero is an
-  // anomaly. Fail loud.
+  // Module floor: ls() returns [] on a read failure, so an unreadable source
+  // tree would otherwise pass the gate with no module coverage.
   let moduleCount = 0;
   for (const kind of subjects.values()) if (typeof kind === "string" && kind.startsWith("module:")) moduleCount++;
   if (moduleCount === 0) throw new Error("check-test-subjects: zero source-module subjects derived (lib/orchestrator/scripts/bin unreadable?) — refusing to let reverse coverage pass with no module coverage.");
@@ -142,10 +103,8 @@ function run() {
   for (const t of testFiles) if (!subjects.has(t.toLowerCase())) forward.push({ file: "tests/" + t + ".test.js", suggested: suggest(t) });
   const reverse = [];
   for (const [s, kind] of subjects) if (!testSet.has(s)) reverse.push({ subject: s, kind });
-  // Reverse-REQUIRED subset: only module / cve / playbook subjects must have a
-  // test (aliases, data files, cli verbs, repo artifacts are valid targets but
-  // not reverse-required). The exit-code logic gates on THIS, consistently
-  // across --worklist and the human/predeploy paths.
+  // Only module, cve and playbook subjects must have a test; the rest are valid
+  // targets, not requirements. Both output paths take their exit code from this.
   const reverseRequired = reverse.filter((x) => x.kind.startsWith("module:") || x.kind.startsWith("cve-primitive") || x.kind.startsWith("playbook-primitive"));
   return { subjects: subjects.size, forward, reverse, reverseRequired };
 }

package/scripts/check-ttp-references.js

@@ -2,30 +2,14 @@
 "use strict";
 
 /**
- * TTP reference-integrity gate.
+ * TTP reference-integrity gate. data/attack-techniques.json and
+ * data/atlas-ttps.json are the pinned copies of ATT&CK and ATLAS; every other file
+ * naming a technique refers into them, and this proves those references resolve.
+ * Resolution runs against the pins, not against MITRE:
+ * scripts/check-ttp-upstream.js is the network check on whether the pins
+ * themselves are current, and it cannot block a release. This one can.
  *
- * data/attack-techniques.json and data/atlas-ttps.json are the pinned copies of
- * ATT&CK and ATLAS. Every other file that names a technique — countermeasure
- * maps, DLP controls, playbooks, skill bodies, CVE entries — is referring INTO
- * those two catalogs. This gate proves those references resolve.
- *
- * The failure it exists for: MITRE retires and renumbers techniques between
- * releases. When a pin is bumped, the two source catalogs get remapped, but
- * references living in other files are easy to miss — nothing dereferences them
- * at runtime, so a stale id keeps rendering in operator output as if it were
- * current. It points at a MITRE page that no longer resolves, and any control
- * claiming to counter it is now mapped to nothing (AGENTS.md Hard Rule #4: no
- * orphaned controls). A bumped pin left exactly this residue in the D3FEND and
- * DLP maps, invisible to every other gate.
- *
- * The check is offline: it resolves references against the pinned catalogs, not
- * against MITRE. That is deliberate — scripts/check-ttp-upstream.js is the
- * network check that asks whether the PINS are current, and it cannot block a
- * release because it needs connectivity. This one can block, because a
- * reference that does not resolve against the pin we ship is broken no matter
- * what upstream says.
- *
- * Exit codes: 0 all references resolve, 1 unresolved references found.
+ * Exit 0 when every reference resolves, 1 when any does not.
  */
 
 const fs = require("node:fs");
@@ -34,11 +18,10 @@ const path = require("node:path");
 const ROOT = path.resolve(__dirname, "..");
 
 /**
- * ATT&CK ids are TNNNN[.NNN]; ATLAS ids are AML.TNNNN[.NNN]. The lookbehind
- * matters: without it the ATT&CK alternative matches the "T0017" inside
- * "AML.T0017" and reports a phantom bare-ATT&CK reference for every ATLAS id in
- * the tree. It covers the hyphen as well, because ATLAS ids also appear in
- * filenames, where the dot is not a legal separator.
+ * ATT&CK ids are TNNNN[.NNN]; ATLAS ids are AML.TNNNN[.NNN]. Without the
+ * lookbehind the ATT&CK alternative matches the "T0017" inside "AML.T0017" and
+ * reports a phantom bare-ATT&CK reference for every ATLAS id. It covers the
+ * hyphen too, since ATLAS ids also appear in filenames.
  */
 const TTP_PATTERN = /\bAML\.T\d{4}(?:\.\d{3})?\b|(?<!AML[.-])\bT\d{4}(?:\.\d{3})?\b/g;
 
@@ -50,17 +33,10 @@ const SEARCH_EXTS = new Set([".json", ".md", ".js"]);
 const SKIP_DIRS = new Set(["node_modules", "_indexes", "vendor", ".git"]);
 
 /**
- * Tokens that match the pattern without being references to a technique.
- * Every entry needs a reason: an unexplained allowlist is how a real stale id
- * eventually gets parked here to make the gate green.
+ * Tokens that match the pattern without referencing a technique. Every entry needs
+ * a reason: an unexplained allowlist is how a real stale id gets parked here.
  */
-const NOT_REFERENCES = [
-  {
-    id: "T1234",
-    file: "lib/gap-detectors.js",
-    why: "placeholder in a comment describing the reference-extraction pattern itself, not a claim about a technique",
-  },
-];
+const NOT_REFERENCES = [];
 
 function loadKnownIds() {
   const known = new Set();

package/scripts/check-ttp-upstream.js

@@ -2,31 +2,11 @@
 "use strict";
 
 /**
- * scripts/check-ttp-upstream.js — validates every shipped TTP id against the
- * pinned upstream release.
+ * Validates every shipped TTP id in data/attack-techniques.json and
+ * data/atlas-ttps.json against the pinned upstream MITRE release. A network
+ * check, so it runs in the refresh workflow rather than in offline predeploy.
  *
- * Why this exists. The catalogs in data/attack-techniques.json and
- * data/atlas-ttps.json are curated mirrors of MITRE releases, and nothing
- * checked that the ids in them are ids MITRE actually publishes. The ATLAS
- * 2026.07 / ATT&CK 19.2 pin bump found eleven that were not: five ATT&CK
- * techniques revoked upstream — already revoked in 19.1, the version pinned at
- * the time, so they had been shipping revoked for a full release cycle — and
- * six that appear in no upstream domain at any version. Every one of them was
- * reachable by a skill telling an operator to map a finding to it, which is
- * exactly what Hard Rule #4 (no orphaned controls — every control maps to a
- * real TTP) exists to prevent.
- *
- * This is a NETWORK check, so it runs in the refresh workflow beside the pin
- * checker rather than in predeploy, which is offline. Report-only: it prints
- * findings and exits non-zero, leaving the decision to a maintainer, because a
- * revocation needs a judgement call about the successor rather than an
- * automatic rewrite.
- *
- *   node scripts/check-ttp-upstream.js            validate against the pins
- *   node scripts/check-ttp-upstream.js --json     machine-readable output
- *
- * Exit: 0 clean, 1 findings, 2 upstream unreachable (never a silent pass —
- * an unreachable upstream must not read as "all ids valid").
+ * Exit 0 clean, 1 findings, 2 upstream unreachable — never a silent pass.
  */
 
 const fs = require("node:fs");
@@ -41,14 +21,8 @@ function readJson(p) {
 }
 
 /**
- * A pinned version read out of a catalog is file data, and it is about to be
- * interpolated into an upstream URL. Constrain it to the exact shape each
- * project publishes before it can reach a request, so a malformed or tampered
- * `_meta` cannot steer the fetch — and so a typo'd pin fails here with a clear
- * message instead of as a puzzling 404 later.
- *
- *   ATT&CK  semver-ish major.minor           19.2
- *   ATLAS   CalVer YYYY.MM with optional .N  2026.07, 2025.11.2
+ * A pin is catalog data interpolated into an upstream URL, so its shape is
+ * bounded here: ATT&CK is major.minor, ATLAS is CalVer YYYY.MM with optional .N.
  */
 const VERSION_SHAPES = {
   attack: /^\d{1,3}\.\d{1,3}$/,
@@ -66,13 +40,8 @@ function assertPinShape(kind, value) {
 }
 
 /**
- * The only hosts this checker may ever contact. `assertPinShape` already bounds
- * the catalog-sourced version to a digit-and-dot shape before it reaches a URL,
- * but that guard sits a long way from the request — a later edit could add a
- * caller that skips it, and static analysis reasonably flags file data reaching
- * an outbound request when the barrier is that distant. Re-check the resolved
- * origin at the sink so the property is enforced where it matters and is
- * verifiable by reading ten lines rather than tracing the whole module.
+ * The only hosts this checker may contact. Re-checked at the sink even though
+ * `assertPinShape` bounds the version, so a later caller cannot route past it.
  */
 const ALLOWED_ORIGINS = new Set(["https://raw.githubusercontent.com"]);
 
@@ -89,7 +58,6 @@ function assertAllowedUrl(rawUrl) {
         `${[...ALLOWED_ORIGINS].join(", ")}`
     );
   }
-  // Reject anything that could smuggle credentials or redirect the path.
   if (parsed.username || parsed.password || parsed.search || parsed.hash) {
     throw new Error(`refusing to fetch a URL carrying credentials or a query/fragment: ${parsed.origin}${parsed.pathname}`);
   }

package/scripts/check-version-bump.js

@@ -2,45 +2,9 @@
 'use strict';
 
 /**
- * scripts/check-version-bump.js — patch-only-cadence predeploy gate.
- *
- * Why this exists. The project cadence is "patch is the only default bump; a
- * minor or major requires explicit human authorization." That rule lived in
- * the contributor guide and in maintainer memory — and was violated anyway
- * (two releases shipped as minors that should have been patches). A written
- * rule the tooling does not enforce is one a tired/automated contributor will
- * eventually skip. This gate makes the rule mechanical: an unauthorized
- * minor/major version bump fails predeploy and cannot ship.
- *
- * Hermetic by design. Authorization is a COMMITTED artifact
- * (tests/.version-bump-ack.json), not an environment variable, because
- * `npm run predeploy` runs in the release.yml validate job as well as locally.
- * An env-var scheme would either false-fail a legitimately-authorized minor in
- * CI or require per-release CI config. A committed ack file travels with the
- * checkout, so the gate enforces identically everywhere — and a minor bump
- * becomes a loud, reviewable line in the PR diff instead of a silent change to
- * a version string.
- *
- * Mechanism:
- *   prev = the most recent OTHER `## X.Y.Z` heading in CHANGELOG.md
- *   cur  = package.json version (== the top CHANGELOG heading; the version-sync
- *          gate enforces that match separately)
- *   classify prev -> cur as patch | minor | major | none | downgrade
- *     - patch / none      -> pass (the default; zero ceremony)
- *     - downgrade / bad   -> fail (versions only move forward)
- *     - minor / major     -> pass ONLY if tests/.version-bump-ack.json names
- *                            the exact `cur` version with the matching type;
- *                            otherwise fail with remediation.
- *
- * To authorize a minor (only after the user explicitly asks for one):
- *   echo '{"version":"0.19.0","type":"minor"}' > tests/.version-bump-ack.json
- * and commit it. The ack is version-specific, so a stale ack cannot authorize
- * a different future bump.
- *
- * Output:
- *   stdout: structured JSON when --json, else a one-line summary
- *   exit 0: patch/none, or an authorized minor/major
- *   exit 1: unauthorized minor/major, downgrade, or unparseable version
+ * Patch-only-cadence gate. A minor or major fails unless the committed
+ * tests/.version-bump-ack.json names that exact version, so an ack travels with
+ * the checkout and a stale one cannot authorize a later bump.
  */
 
 const fs = require('fs');
@@ -57,7 +21,6 @@ function parseSemver(v) {
   return { major: Number(m[1]), minor: Number(m[2]), patch: Number(m[3]) };
 }
 
-// Classify the transition prev -> cur. Pure; exported for unit tests.
 function classifyBump(prev, cur) {
   const a = parseSemver(prev);
   const b = parseSemver(cur);
@@ -68,8 +31,7 @@ function classifyBump(prev, cur) {
   return 'none';
 }
 
-// Decide whether a bump is allowed given the committed ack (or null). Pure;
-// exported for unit tests. ack = { version, type } | null.
+// `ack` is { version, type } or null.
 function checkBump(prev, cur, ack) {
   if (!prev) return { ok: true, bump: 'initial', reason: 'no previous version recorded' };
   const bump = classifyBump(prev, cur);
@@ -82,7 +44,6 @@ function checkBump(prev, cur, ack) {
   if (bump === 'patch' || bump === 'none') {
     return { ok: true, bump, reason: `${bump} bump (${prev} -> ${cur})` };
   }
-  // minor or major — requires explicit committed authorization for this exact version.
   if (ack && ack.version === cur && ack.type === bump) {
     return { ok: true, bump, reason: `${bump} bump authorized for ${cur} via tests/.version-bump-ack.json` };
   }
@@ -93,7 +54,7 @@ function checkBump(prev, cur, ack) {
   };
 }
 
-// Extract `## X.Y.Z` version headings from CHANGELOG.md, in document order.
+// Document order — newest first, which determinePrevious relies on.
 function changelogVersions(text) {
   const out = [];
   const re = /^##\s+(\d+\.\d+\.\d+)\b/gm;
@@ -107,14 +68,8 @@ function suggestPatch(prev) {
   return a ? `${a.major}.${a.minor}.${a.patch + 1}` : null;
 }
 
-// Resolve the previous version from CHANGELOG text, or fail closed. Pure;
-// exported for unit tests. A release gate must NOT treat an unreadable or
-// heading-less CHANGELOG as a "first release" — doing so silently authorized
-// ANY bump (including an unapproved major), because checkBump(null, ...) takes
-// the initial-release pass. `text` is the CHANGELOG contents, or null when the
-// read failed. Returns { ok, prev?, reason? }: ok:false fails the gate; ok:true
-// yields prev, which is null ONLY for a genuine first release whose sole
-// `## X.Y.Z` heading equals cur (versions === [cur]).
+// Fails closed: an unreadable or heading-less CHANGELOG must not look like a
+// first release, because checkBump(null, ...) then authorizes any bump.
 function determinePrevious(text, cur) {
   if (text == null) {
     return { ok: false, reason: 'CHANGELOG.md could not be read' };
@@ -149,12 +104,7 @@ function main() {
   }
   const cur = pkg.version;
 
-  // Fail closed when CHANGELOG is unreadable or carries no version headings.
-  // Swallowing a read error to '' previously made versions=[] -> prev=null ->
-  // checkBump's initial-release pass, so a missing/malformed CHANGELOG silently
-  // authorized any bump. A genuine first release still passes: its sole
-  // `## X.Y.Z` heading equals cur, so determinePrevious returns prev=null with
-  // ok:true and checkBump takes the legitimate initial path.
+  // null on a read failure, never '' — determinePrevious fails closed on null.
   let changelogText = null;
   try { changelogText = fs.readFileSync(CHANGELOG_PATH, 'utf8'); } catch (_e) { changelogText = null; }
   const prevRes = determinePrevious(changelogText, cur);
@@ -163,7 +113,6 @@ function main() {
     process.exitCode = 1;
     return;
   }
-  // prev = the most recent heading that differs from the current version.
   const prev = prevRes.prev;
 
   const ack = readAck();
@@ -191,8 +140,7 @@ function main() {
       if (patch) process.stderr.write(`[check-version-bump] If this should be a patch, set the version to ${patch}.\n`);
       process.stderr.write(`[check-version-bump] If the user explicitly authorized a ${res.bump}, commit tests/.version-bump-ack.json = {"version":"${cur}","type":"${res.bump}"}.\n`);
     }
-    // process.exitCode (not process.exit) so the buffered stdout write above
-    // is not truncated when stdout is piped (the stdout-flush-truncation class).
+    // `process.exitCode`, not process.exit(): exit truncates the buffered stdout write.
     process.exitCode = 1;
     return;
   }