@boyingliu01/xp-gate 0.35.16 → 0.35.18

package/principles/adapters/import-clause.ts

@@ -0,0 +1,57 @@
+/**
+ * Import-clause parsing for the TypeScript adapter's `imports` getter.
+ *
+ * Extracted from `typescript.ts` so that one function does not have to carry
+ * both the parsing rules and the usage-scoring loop: together they pushed the
+ * getter past the 50-line budget and to 5 nesting levels. Splitting also lets
+ * the clause grammar be tested without reading a file.
+ */
+
+/** One symbol bound by an import statement. */
+export interface ImportBinding {
+  name: string;
+  type?: string;
+}
+
+/** A plain identifier -- these are the only names an import can bind. */
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+
+/**
+ * Parse the clause between `import` and `from` into the symbols it binds.
+ *
+ * Covers the four shapes TypeScript allows: a default binding, a named brace
+ * list (with per-member `type` and `as` renames), and a namespace binding.
+ *
+ * @param clause text between `import` / `import type` and `from`
+ * @param isTypeOnly whether the whole statement was `import type ...`
+ */
+export function parseImportClause(clause: string, isTypeOnly: boolean): ImportBinding[] {
+  const bindings: ImportBinding[] = [];
+  const marker = isTypeOnly ? 'type' : undefined;
+  const push = (name: string, type?: string): void => {
+    if (IDENTIFIER.test(name)) bindings.push({ name, ...(type ? { type } : {}) });
+  };
+
+  // default import
+  const def = /^(\w+)/.exec(clause);
+  if (def) push(def[1], marker);
+
+  // named imports { a, b as c }
+  const braces = /\{([\s\S]*?)\}/.exec(clause);
+  if (braces) {
+    for (const raw of braces[1].split(',')) {
+      const part = raw.trim();
+      if (!part) continue;
+      const asMatch = /\bas\s+(\w+)\s*$/.exec(part);
+      const local = asMatch ? asMatch[1] : part.replace(/^type\s+/, '').trim();
+      const memberTypeOnly = /^type\s+/.test(part);
+      push(local, isTypeOnly || memberTypeOnly ? 'type' : undefined);
+    }
+  }
+
+  // namespace import * as ns
+  const ns = /\*\s+as\s+(\w+)/.exec(clause);
+  if (ns) push(ns[1], marker);
+
+  return bindings;
+}

package/principles/adapters/member-scan.ts

@@ -0,0 +1,73 @@
+/**
+ * Class-member scanning for the TypeScript adapter.
+ *
+ * Extracted from `typescript.ts` to keep that file inside its line budget, and
+ * because this is the piece that was wrong: counting members by looking at the
+ * character BEFORE a name reported every call site inside a method body as a
+ * member. `{ helper(1); }` and `{ async run() { ... }` differ in what follows the
+ * name, not in what precedes it -- so depth is what separates them.
+ */
+
+/** Words that look like `name(` but are control flow, never members. */
+const CONTROL_KEYWORDS = new Set([
+  'if', 'for', 'while', 'switch', 'catch', 'return', 'typeof', 'new',
+]);
+
+/** Class body members live one level in: the body string starts AT its `{`. */
+const MEMBER_DEPTH = 1;
+
+/**
+ * Names of the members declared directly in a class body.
+ *
+ * Depth-aware rather than prefix-aware: a member declaration sits at brace
+ * depth 1 of the body, and a call inside a method sits deeper. Nesting is
+ * tracked over the MASKED body, so braces inside strings and comments cannot
+ * shift the depth -- prose in a JSDoc line like
+ * "three separate events (close / error / timeout)" otherwise reads as
+ * `events(` and is counted as a method, as is `unknown` from `(): unknown {`.
+ *
+ * Arrow-function properties (`handler = () => {}`) carry no `name(` shape and
+ * are not counted; they were not counted before either.
+ */
+export function countTopLevelMembers(body: string): string[] {
+  const names: string[] = [];
+  let depth = 0;
+  for (let i = 0; i < body.length; i += 1) {
+    const c = body[i];
+    if (c === '{') { depth += 1; continue; }
+    if (c === '}') { depth -= 1; continue; }
+    if (depth !== MEMBER_DEPTH || c !== '(') continue;
+    const name = memberNameBefore(body, i);
+    if (name && !CONTROL_KEYWORDS.has(name.value)) names.push(name.value);
+  }
+  return names;
+}
+
+/**
+ * The identifier immediately before the `(` at `parenIndex`, skipping modifiers
+ * (`public`, `static`, `async`, `readonly`, `get`, `set`, `*`).
+ *
+ * @returns the name and its offset, or null when no identifier precedes the paren.
+ */
+function memberNameBefore(
+  body: string,
+  parenIndex: number,
+): { value: string; index: number } | null {
+  let end = parenIndex;
+  while (end > 0 && /\s/.test(body[end - 1])) end -= 1;
+  let start = end;
+  while (start > 0 && /[\w$]/.test(body[start - 1])) start -= 1;
+  if (start === end) return null;
+  return { value: body.substring(start, end), index: start };
+}
+
+/**
+ * Claim a `name@offset` key once, so overlapping extraction shapes cannot
+ * double-count the same declaration.
+ */
+export function claimMember(seen: Set<string>, name: string, nameIndex: number): boolean {
+  const key = `${name}@${nameIndex}`;
+  if (seen.has(key)) return false;
+  seen.add(key);
+  return true;
+}

package/principles/adapters/position-analysis.ts

@@ -0,0 +1,43 @@
+/**
+ * Position analysis for TypeScript's regex-based extraction.
+ *
+ * The extraction regexes match `name(` for both a method DECLARATION and a CALL.
+ * This module answers which one it is, keeping `typescript.ts` inside its line
+ * budget and giving the rule a place to be tested directly.
+ */
+
+/**
+ * Characters that can only precede a CALL, never a declaration.
+ *
+ * `.` covers member calls (`this.c()`, `obj.method()`), `(` a call used as an
+ * argument (`if (existsSync(p))`), `,` a call in a list (`foo(a, bar(b))`), and
+ * the operators cover a call in a condition or expression
+ * (`hadExisting && existsSync(p)`, `x = read(p)`, `!isReady(q)`). No member
+ * declaration begins with any of them.
+ *
+ * Deliberately NOT included: `{`, `;`, `}` and plain whitespace. Those precede
+ * BOTH shapes -- `{ helper(1); }` is a call, `{ run(): void {` is a declaration
+ * -- so using them makes the answer depend on formatting. Depth is what
+ * separates those two, which is why extractClasses counts by brace depth.
+ */
+const CALL_PRECEDERS = new Set([
+  '.', '(', ',',
+  '&', '|', '=', '!', '?', ':', '+', '-', '*', '/', '<', '>', '[',
+]);
+
+/**
+ * Is the identifier starting at `nameIndex` a call rather than a declaration?
+ *
+ * Without this check `if (existsSync(p))` was extracted as a method named
+ * `existsSync` -- the extraction regex's lookbehind permits `(` before the name
+ * -- which then borrowed the enclosing block's brace as a "body" and reported a
+ * phantom `missing-error-handling` warning that no edit could clear. It also
+ * inflated `extractClasses().methodCount` with the names of whatever the class
+ * body happened to call (66 reported for a class declaring 30).
+ */
+export function isCallPosition(masked: string, nameIndex: number): boolean {
+  let i = nameIndex - 1;
+  while (i >= 0 && /\s/.test(masked[i])) i -= 1;
+  return i >= 0 && CALL_PRECEDERS.has(masked[i]);
+}
+

package/principles/adapters/quote-state.ts

@@ -0,0 +1,80 @@
+/**
+ * Character-level quote and delimiter tracking for TypeScript source scanning.
+ *
+ * The param-list and brace scanners all need "is this delimiter inside a string
+ * or template?" before they can act on it. That logic is identical for every
+ * caller, so it lives here instead of being repeated -- and it keeps
+ * `typescript.ts` inside the 1050-line budget.
+ */
+
+export interface QuoteState {
+  inSingle: boolean;
+  inDouble: boolean;
+  inTemplate: boolean;
+}
+
+export function newQuoteState(): QuoteState {
+  return { inSingle: false, inDouble: false, inTemplate: false };
+}
+
+export function inQuotedState(state: QuoteState): boolean {
+  return state.inSingle || state.inDouble || state.inTemplate;
+}
+
+/** The three quote kinds tracked by QuoteState, with the flag that marks each. */
+const QUOTE_KINDS: ReadonlyArray<{ quote: string; flag: 'inSingle' | 'inDouble' | 'inTemplate' }> = [
+  { quote: "'", flag: 'inSingle' },
+  { quote: '"', flag: 'inDouble' },
+  { quote: '`', flag: 'inTemplate' },
+];
+
+/**
+ * Advance one character of quote tracking.
+ *
+ * Extracted because `countParams` and `readParenGroup` carried the same
+ * six-branch block verbatim (#602): both must ignore delimiters that appear
+ * inside a string, and neither may treat an escape as a closing quote.
+ *
+ * Table-driven (#620): all three quote kinds behave identically -- an escape
+ * skips two characters, the matching quote closes the literal -- so they are one
+ * rule applied to a list rather than three copies of it.
+ *
+ * @returns the number of characters consumed (2 when the next char is escaped).
+ */
+export function advanceQuoteState(src: string, i: number, state: QuoteState): number {
+  const c = src[i];
+
+  for (const kind of QUOTE_KINDS) {
+    if (!state[kind.flag]) continue;
+    if (c === '\\') return 2;
+    if (c === kind.quote) state[kind.flag] = false;
+    return 1;
+  }
+
+  // Not inside any literal: open the one this character starts, if any.
+  const opener = QUOTE_KINDS.find(kind => kind.quote === c);
+  if (opener) state[opener.flag] = true;
+  return 1;
+}
+
+/** Opening delimiters that raise the generic/bracket depth in a param list. */
+const DEPTH_OPENERS = new Set(['(', '[', '{', '<']);
+/** Closing delimiters that lower it. */
+const DEPTH_CLOSERS = new Set([')', ']', '}', '>']);
+
+/**
+ * Adjust `depth` for one delimiter.
+ * @returns true when the character was a delimiter (so it cannot also be a
+ *          separator), false otherwise.
+ */
+export function applyDelimiter(c: string, depth: { value: number }): boolean {
+  if (DEPTH_OPENERS.has(c)) { depth.value++; return true; }
+  if (DEPTH_CLOSERS.has(c)) { depth.value--; return true; }
+  return false;
+}
+
+/** True when the character opens a quote/template the scanners must skip. */
+export function isQuote(c: string): boolean {
+  return c === "'" || c === '"' || c === '`';
+}
+

package/principles/adapters/typescript.ts

@@ -1,5 +1,11 @@
 import { BaseAdapter } from './base';
 import { Adapter } from '../types';
+import { isCallPosition } from './position-analysis';
+import { claimMember, countTopLevelMembers } from './member-scan';
+import { parseImportClause } from './import-clause';
+import {
+  type QuoteState, newQuoteState, inQuotedState, advanceQuoteState, applyDelimiter, isQuote,
+} from './quote-state';
 
 /** IO-ish callees that the missing-error-handling rule cares about. */
 const IO_CALLEES = [
@@ -181,77 +187,6 @@ function lineOf(src: string, index: number): number {
 }
 
 /** The three quoted states shared by the parameter/paren scanners. */
-interface QuoteState {
-  inSingle: boolean;
-  inDouble: boolean;
-  inTemplate: boolean;
-}
-
-function newQuoteState(): QuoteState {
-  return { inSingle: false, inDouble: false, inTemplate: false };
-}
-
-function inQuotedState(state: QuoteState): boolean {
-  return state.inSingle || state.inDouble || state.inTemplate;
-}
-
-/** The three quote kinds tracked by QuoteState, with the flag that marks each. */
-const QUOTE_KINDS: ReadonlyArray<{ quote: string; flag: 'inSingle' | 'inDouble' | 'inTemplate' }> = [
-  { quote: "'", flag: 'inSingle' },
-  { quote: '"', flag: 'inDouble' },
-  { quote: '`', flag: 'inTemplate' },
-];
-
-/**
- * Advance one character of quote tracking.
- *
- * Extracted because `countParams` and `readParenGroup` carried the same
- * six-branch block verbatim (#602): both must ignore delimiters that appear
- * inside a string, and neither may treat an escape as a closing quote.
- *
- * Table-driven (#620): all three quote kinds behave identically -- an escape
- * skips two characters, the matching quote closes the literal -- so they are one
- * rule applied to a list rather than three copies of it.
- *
- * @returns the number of characters consumed (2 when the next char is escaped).
- */
-function advanceQuoteState(src: string, i: number, state: QuoteState): number {
-  const c = src[i];
-
-  for (const kind of QUOTE_KINDS) {
-    if (!state[kind.flag]) continue;
-    if (c === '\\') return 2;
-    if (c === kind.quote) state[kind.flag] = false;
-    return 1;
-  }
-
-  // Not inside any literal: open the one this character starts, if any.
-  const opener = QUOTE_KINDS.find(kind => kind.quote === c);
-  if (opener) state[opener.flag] = true;
-  return 1;
-}
-
-/** Opening delimiters that raise the generic/bracket depth in a param list. */
-const DEPTH_OPENERS = new Set(['(', '[', '{', '<']);
-/** Closing delimiters that lower it. */
-const DEPTH_CLOSERS = new Set([')', ']', '}', '>']);
-
-/**
- * Adjust `depth` for one delimiter.
- * @returns true when the character was a delimiter (so it cannot also be a
- *          separator), false otherwise.
- */
-function applyDelimiter(c: string, depth: { value: number }): boolean {
-  if (DEPTH_OPENERS.has(c)) { depth.value++; return true; }
-  if (DEPTH_CLOSERS.has(c)) { depth.value--; return true; }
-  return false;
-}
-
-/** True when the character opens a quote/template the scanners must skip. */
-function isQuote(c: string): boolean {
-  return c === "'" || c === '"' || c === '`';
-}
-
 /** Count top-level, comma-separated parameters in a raw parameter list. */
 function countParams(rawList: string): number {
   const trimmed = rawList.trim();
@@ -726,37 +661,13 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
     const importRe = /^[ \t]*import\s+(?:type\s+)?([\s\S]*?)\s+from\s+['"][^'"]+['"]/gm;
     const importSpans: Array<[number, number]> = [];
     let m: RegExpExecArray | null;
-    const idRe = /^[A-Za-z_$][\w$]*$/;
 
     while ((m = importRe.exec(src)) !== null) {
-      const clause = m[1].trim();
       const line = lineOf(src, m.index);
       const isTypeOnly = /^import\s+type\b/.test(m[0]);
-      const push = (name: string, type?: string) => {
-        if (idRe.test(name)) entries.push({ name, line, used: false, ...(type ? { type } : {}) });
-      };
-
-      // default import
-      const def = /^(\w+)/.exec(clause);
-      if (def) push(def[1], isTypeOnly ? 'type' : undefined);
-
-      // named imports { a, b as c }
-      const braces = /\{([\s\S]*?)\}/.exec(clause);
-      if (braces) {
-        for (const raw of braces[1].split(',')) {
-          const part = raw.trim();
-          if (!part) continue;
-          const asMatch = /\bas\s+(\w+)\s*$/.exec(part);
-          const local = asMatch ? asMatch[1] : part.replace(/^type\s+/, '').trim();
-          const memberTypeOnly = /^type\s+/.test(part);
-          push(local, isTypeOnly || memberTypeOnly ? 'type' : undefined);
-        }
+      for (const binding of parseImportClause(m[1].trim(), isTypeOnly)) {
+        entries.push({ ...binding, line, used: false });
       }
-
-      // namespace import * as ns
-      const ns = /\*\s+as\s+(\w+)/.exec(clause);
-      if (ns) push(ns[1], isTypeOnly ? 'type' : undefined);
-
       importSpans.push([m.index, m.index + m[0].length]);
     }
 
@@ -831,7 +742,9 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       length: hasBraces ? Math.max(1, endLine - startLine + 1) : 1,
       paramCount: countParams(inner),
       nestingDepth: hasBraces ? maxNesting(maskLiterals(body)) : 0,
-      hasTryCatch: /\btry\s*\{/.test(masked.substring(bodyOpen, bodyEnd)),
+      // The RAW body: `on('error', ...)` needs its string literal intact, and
+      // masking blanks string bodies. try/catch is a keyword and is unaffected.
+      hasTryCatch: hasErrorHandling(body),
       ioOperations: ioOperationsIn(masked.substring(bodyOpen, bodyEnd)),
       code: body,
     };
@@ -853,13 +766,6 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
   }
 
   /** Claim a `name@offset` key once, so overlapping shapes cannot double-count. */
-  private claim(seen: Set<string>, name: string, nameIndex: number): boolean {
-    const key = `${name}@${nameIndex}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  }
-
   /** `function name(...)` declarations, including export / async / generators. */
   private collectFunctionDecls(seen: Set<string>, found: FunctionMetrics[]): void {
     const masked = this.maskedSource;
@@ -871,7 +777,7 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       if (parenIndex === -1) continue;
       const bodyOpen = findBodyBrace(masked, parenIndex);
       if (bodyOpen === -1) continue;
-      if (!this.claim(seen, m[1], nameIndex)) continue;
+      if (!claimMember(seen, m[1], nameIndex)) continue;
       found.push(this.buildFunction(m[1], 'function', nameIndex, parenIndex, bodyOpen));
     }
   }
@@ -892,10 +798,11 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       // parameter list or a type annotation, which corrupted the reported span.
       const parenIndex = m.index + m[0].length - 1;
       const nameIndex = parenIndex - m[1].length;
+      if (isCallPosition(masked, nameIndex)) continue;
       // Only treat as a method when a body brace follows the parameter list.
       const bodyOpen = findBodyBrace(masked, parenIndex);
       if (bodyOpen === -1) continue;
-      if (!this.claim(seen, m[1], nameIndex)) continue;
+      if (!claimMember(seen, m[1], nameIndex)) continue;
       found.push(this.buildFunction(m[1], 'method', nameIndex, parenIndex, bodyOpen));
     }
   }
@@ -909,7 +816,7 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       const arrow = this.parseArrowAt(m, arrowRe.lastIndex);
       if (!arrow) continue;
       const nameIndex = m.index + m[0].length - m[1].length;
-      if (!this.claim(seen, m[1], nameIndex)) continue;
+      if (!claimMember(seen, m[1], nameIndex)) continue;
       found.push(this.buildArrowMetrics(m[1], nameIndex, arrow));
     }
   }
@@ -1003,14 +910,19 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
       if (bodyOpen === -1) continue;
       const bodyEnd = findBlockEnd(masked, bodyOpen);
       const body = src.substring(bodyOpen, bodyEnd);
-
-      // Count method-ish members. Not anchored to line start: minified /
-      // single-line class bodies (`m1() {} m2() {}`) are valid TS and must count.
-      // `(?<![\w$.])` avoids matching call sites like `foo.bar(`.
-      const memberRe = /(?<![\w$.])(?:public\s+|private\s+|protected\s+|static\s+|async\s+|readonly\s+|get\s+|set\s+|\*\s*)*(\w+)\s*\(/g;
-      const methods = [...body.matchAll(memberRe)]
-        .map(x => x[1])
-        .filter(n => !['if', 'for', 'while', 'switch', 'catch', 'return', 'typeof', 'new'].includes(n));
+      // Members are counted on the MASKED body: the prose in a JSDoc line like
+      // "three separate events (close / error / timeout)" reads as `events(` and
+      // was counted as a method, as did `unknown` from a `(): unknown {` return
+      // type. Masking blanks comments and string bodies, so only real code has
+      // braces and parens left.
+      const maskedBody = masked.substring(bodyOpen, bodyEnd);
+
+      // Count members declared at the class body's TOP brace depth. A call
+      // inside a method body sits one level deeper, which is the only signal
+      // that separates `{ helper(1); }` from `{ async run() { ... }`.
+      // Earlier attempts compared the preceding character and reported 66
+      // methods for a class declaring 30 -- every call site counted once.
+      const methods = countTopLevelMembers(maskedBody);
 
       results.push({
         name,
@@ -1065,3 +977,32 @@ export class TypeScriptAdapter extends BaseAdapter implements Adapter {
     return exportMatches;
   }
 }
+
+
+/**
+ * Does this function handle failures?
+ *
+ * `try`/`catch` is one way, and for a function that owns a child process it is
+ * not the idiomatic one: Node reports spawn failures through an `'error'`
+ * event, and a `try` around `spawn()` would never see them. Treating the event
+ * listener as unhandled reported `runMutmut` for having "I/O without error
+ * handling" while it was in fact the only handler for that failure mode --
+ * a warning no correct edit could clear, which is how a rule loses its meaning.
+ *
+ * `'error'` is matched as a QUOTED argument (`on('error', ...)`) so that a
+ * string that merely contains the word does not qualify.
+ */
+function hasErrorHandling(body: string): boolean {
+  return TRY_BLOCK.test(body) || ERROR_LISTENER.test(body);
+}
+
+/**
+ * The two handler shapes, as module-level constants.
+ *
+ * ccn-report locates a function body by counting brackets on its lines; a regex
+ * literal INSIDE the body makes that extent ambiguous, and the row comes back
+ * "CCN could not be span-verified" -- a Gate 3 block. Brackets and braces in the
+ * patterns are written as character classes for the same reason.
+ */
+const TRY_BLOCK = /\btry\s*[{]/;
+const ERROR_LISTENER = /\bon\s*[(]\s*['"]error['"]\s*,/;

package/principles/rules/clean-code/god-class.ts

@@ -15,25 +15,26 @@ export const godClassRule: Rule = {
       code?: string;
       line: number;
       name: string;
+      /** Method count when the adapter parsed the class structurally. */
+      methodCount?: number;
     }
-    
+
     interface TypedAdapter {
       extractClasses?: () => ClassObject[] | undefined;
     }
-    
+
     const typedAdapter = adapter as TypedAdapter;
     const classes = typedAdapter.extractClasses?.() || [];
-    
+
     for (const cls of classes) {
-      const methodMatches = cls.code?.match(/(get|set)\s+\w+\s*\(|\w+\s*\([^)]*\)\s*{/g) || [];
-      
-      const methodCount = methodMatches.filter((m: string) => {
-        if (m.startsWith('get ') || m.startsWith('set ')) {
-          return false;
-        }
-        return true;
-      }).length;
-      
+      // Prefer the adapter's structural count. The regex fallback below cannot
+      // see methods whose signature spans lines or carries a return type, so on
+      // `TypeScriptAdapter` (66 methods) it counted 0 while `solid.srp` read the
+      // adapter's own figure and reported it -- the same class, two different
+      // answers, and the wrong one was silent. A count the adapter already
+      // computed must not be recomputed by guessing at source text.
+      const methodCount = cls.methodCount ?? countMethodsByRegex(cls.code);
+
       if (methodCount > (settings.threshold ?? 0)) {
         violations.push({
           file,
@@ -46,7 +47,29 @@ export const godClassRule: Rule = {
         });
       }
     }
-    
+
     return violations;
   }
-};
+};
+
+/**
+ * Source-text method matcher.
+ *
+ * Kept at module scope on purpose: ccn-report locates a function body by counting
+ * brackets on its lines, so a regex literal inside the body makes the extent
+ * ambiguous and the row comes back "CCN could not be span-verified".
+ */
+const METHOD_PATTERN = /(?:get|set)\s+\w+\s*[(]|\w+\s*[(][^)]*[)]\s*[{]/g;
+
+/** A matched accessor keyword pair rather than a real method. */
+const ACCESSOR_PATTERN = /^(?:get|set)\s/;
+
+/**
+ * Count methods by matching source text. Only used when the adapter does not
+ * report `methodCount` (Java, C++ and other regex-backed adapters), so the
+ * getter/setter exclusion stays meaningful.
+ */
+function countMethodsByRegex(code: string | undefined): number {
+  const methodMatches = code?.match(METHOD_PATTERN) ?? [];
+  return methodMatches.filter((m: string) => !ACCESSOR_PATTERN.test(m)).length;
+}

package/principles/rules/solid/dip.ts

@@ -1,8 +1,14 @@
 import { Rule, Violation, Severity } from '../../types';
 import { getActiveConfig } from '../../config';
 
+// Value objects, not collaborators. Every entry here is a type that ordinary
+// code CONSTRUCTS from data it already has, and that has no injectable
+// alternative: you cannot pass in a Date/Map/RegExp factory any more usefully
+// than you can pass in the number 1. Constructing one is not the inversion being
+// bypassed, so reporting it teaches the wrong lesson (#676).
 const DEFAULT_EXCLUDED_CLASSES = [
-  'Date', 'Map', 'Set', 'Error', 'Array', 'Object', 'Promise'
+  'Date', 'Map', 'Set', 'Error', 'Array', 'Object', 'Promise',
+  'RegExp', 'Number', 'String', 'Boolean', 'BigInt', 'Symbol', 'WeakMap', 'WeakSet',
 ];
 
 /**
@@ -10,9 +16,16 @@ const DEFAULT_EXCLUDED_CLASSES = [
  *
  * A module-load snapshot was #457: a project's `.principlesrc` override was
  * parsed but never consulted.
+ *
+ * The config entry EXTENDS the built-in value-object list rather than replacing
+ * it (#676). Replacing meant a project that added one name silently lost every
+ * default exemption -- `.principlesrc` here lists 7 entries, so `new RegExp()`
+ * was reported even though the default list would have excused it. A project
+ * cannot reasonably be expected to restate the built-ins it never knew about.
  */
 function excludedClasses(): (string | number)[] {
-  return getActiveConfig().rules['solid']['dip'].exclude ?? DEFAULT_EXCLUDED_CLASSES;
+  const configured = getActiveConfig().rules['solid']['dip'].exclude ?? [];
+  return [...new Set([...DEFAULT_EXCLUDED_CLASSES, ...configured])];
 }
 
 function shouldSkipInstantiation(className: string): boolean {