@codyswann/lisa 3.15.0 → 3.16.0

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.15.0",
+  "version": "3.16.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/scripts/build-plugins.sh

@@ -153,6 +153,35 @@ if [ -f "$ROOT_DIR/scripts/lisa-enforcement-fallback.sh" ]; then
   chmod +x "$ROOT_DIR/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh"
 fi
 
+# The shared ESM entry guard, into every lane that has a consumer of it.
+#
+# Downstream, all of these land flat in one `scripts/` directory, so a single
+# `scripts/lib/invoked-as-script.mjs` serves every lane and `./lib/...` resolves
+# from each. Inside THIS repo the lanes are separate trees and Lisa's own unit
+# tests import the lane copies directly, so each lane that imports the helper
+# must carry it or those imports fail to resolve. Synced from one canonical
+# source rather than hand-copied, for the same reason the ratchet above is: a
+# unit test asserts byte-equality, so the three copies can never drift.
+#
+# `all` is applied to every project type before the stack lanes, so the copies
+# in `typescript` and `expo` are redundant at apply time — they exist for
+# in-repo resolution and are byte-identical, so whichever lane writes last
+# writes the same bytes.
+#
+# Guarded on the GENERATOR as well as the source. This script is run against
+# isolated fixtures that vendor `scripts/lib/` but not the repository's own
+# `scripts/*.mjs`, so testing the source alone would find it present and then
+# fail the whole build on a missing materializer.
+if [ -f "$ROOT_DIR/scripts/lib/invoked-as-script.mjs" ] &&
+  [ -f "$ROOT_DIR/scripts/materialize-copy-overwrite.mjs" ]; then
+  for guard_lane in all typescript expo; do
+    guard_lib_dir="$ROOT_DIR/$guard_lane/copy-overwrite/scripts/lib"
+    mkdir -p "$guard_lib_dir"
+    materialize "$ROOT_DIR/scripts/lib/invoked-as-script.mjs" \
+      "$guard_lib_dir/invoked-as-script.mjs"
+  done
+fi
+
 # Stack-specific plugins (NO base copy)
 STACKS=(typescript expo nestjs cdk harper-fabric phaser rails)
 for stack in "${STACKS[@]}"; do

package/scripts/check-conflict-markers.mjs

@@ -43,7 +43,9 @@ import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 const REPO_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -302,10 +304,7 @@ export function main(argv, io = {}) {
   return results.length === 0 ? 0 : 1;
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   // exitCode (not process.exit): when stdout is a pipe, writes are async and
   // process.exit() truncates the report mid-flush.
   process.exitCode = main(process.argv.slice(2));

package/scripts/detect-stale-workflow-inputs.mjs

@@ -41,7 +41,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 import {
   diffStaleKeys,
   extractCallerJobs,
@@ -320,9 +322,6 @@ export function main(argv, io = {}) {
   return results.some(r => r.status === "stale") ? 1 : 0;
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   process.exit(main(process.argv.slice(2)));
 }

package/scripts/lib/invoked-as-script.mjs

@@ -0,0 +1,93 @@
+/**
+ * invoked-as-script — the one implementation of "was this module run as the CLI
+ * entry point?", shared by every guarded `.mjs` entry point Lisa ships.
+ *
+ * @remarks
+ * ## Why this is shared rather than copied
+ *
+ * The obvious spelling is `import.meta.url === pathToFileURL(process.argv[1]).href`,
+ * and it is wrong in a way that cannot be seen in review. `import.meta.url` is
+ * normally the REAL path — node resolves ESM through `realpath` unless
+ * `--preserve-symlinks` or `--preserve-symlinks-main` is set — while `argv[1]`
+ * is whatever spelling the caller typed. Naming only the first of those two
+ * flags is what let a second instance of this very defect survive review here:
+ * `--preserve-symlinks-main` is a SEPARATE flag that applies to the entry
+ * module specifically, which is exactly the module this guard runs in, so it is
+ * the one that matters most and the one easiest to leave out. See the section
+ * on realpathing both sides below.
+ * Reached through a symlinked checkout, a symlinked bin shim, or a
+ * `/tmp` path on macOS (`/tmp` is itself a symlink to `/private/tmp`), the two
+ * differ, the guard is false, `main()` never runs, and the process exits 0
+ * having done nothing.
+ *
+ * That failure mode is not symmetric. A no-op GENERATOR usually fails closed —
+ * whatever consumes its output notices the missing artifact. A no-op CHECK
+ * fails **OPEN**: it prints nothing, exits 0, and the npm script "succeeds", so
+ * a gate that is meant to block a merge silently stops having an opinion. Every
+ * `check-*.mjs` in this tree is in the second category, and git worktrees —
+ * which every Lisa-driven agent uses — put a symlinked path on that code path
+ * as a matter of routine.
+ *
+ * ## `moduleUrl` is REQUIRED, and is the FIRST parameter
+ *
+ * A deliberate deviation from the obvious signature
+ * `invokedAsScript(argv1 = process.argv[1], moduleUrl = import.meta.url)`. A
+ * defaulted `import.meta.url` inside a SHARED module resolves to *this* file,
+ * which is never anybody's `process.argv[1]` — so a caller that forgot the
+ * second argument would get `false` forever and no-op silently. That is exactly
+ * the fail-open defect this module exists to remove, re-introduced by its own
+ * convenience default. Making it required and first means a call site cannot be
+ * written wrong.
+ *
+ * ## Why ANY resolution error returns false
+ *
+ * `realpathSync` throws ENOENT, EACCES, ELOOP and ENOTDIR, not just ENOENT. A
+ * fallback that narrows to ENOENT and then compares `resolve(argv1)` reinstates
+ * the un-normalized comparison the realpath exists to avoid, so the symlink
+ * defect survives on precisely the path meant to be the safety net.
+ *
+ * Returning `false` on an unresolvable `argv[1]` is sound rather than merely
+ * convenient: node resolved and LOADED the entry point from that path moments
+ * earlier, so a path that cannot be resolved now is not the path this module
+ * was loaded through. Comparing an unnormalized spelling instead would answer
+ * "maybe" with a confident "yes".
+ *
+ * ## Why BOTH sides are realpath'd, not just `argv[1]`
+ *
+ * "`import.meta.url` is always the real path" is true by default and false under
+ * `--preserve-symlinks-main`, which tells node not to resolve the main entry.
+ * Normalizing only `argv[1]` then compares a real path against a symlinked one
+ * and answers `false` for an entry point that WAS invoked directly — the same
+ * fail-open this module exists to remove, reappearing on the flag that most
+ * looks like it should not matter. Measured: a symlinked entry point reports
+ * `true` normally and `false` under the flag.
+ *
+ * Realpathing both sides is free in the ordinary case, where `moduleUrl` is
+ * already canonical and `realpathSync` is the identity.
+ *
+ * @module scripts/lib/invoked-as-script
+ */
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * Both sides are realpath'd before comparison — see the module remarks for why a
+ * raw comparison silently answers "no" under a symlinked path, and why
+ * normalizing only `argv[1]` leaves the same hole open under
+ * `--preserve-symlinks-main`.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  // `node -e`, `node --eval`, `node --print` and the REPL leave `argv[1]`
+  // undefined. Nothing was asked to run, so nothing should.
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}

package/scripts/plugin-parity-drift.mjs

@@ -40,7 +40,9 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 const REPO_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -608,10 +610,7 @@ export function main(argv, io = {}) {
   return results.every(r => r.status === "ok") ? 0 : 1;
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   // exitCode (not process.exit): when stdout is a pipe, writes are async and
   // process.exit() truncates the report mid-flush (observed: a consumer's
   // $(...) capture stopped at the first 512-byte chunk). Setting exitCode lets

package/scripts/plugin-routing-validate.mjs

@@ -36,7 +36,9 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 import { compareSemver, isValidSemver } from "./plugin-parity-drift.mjs";
 
 const REPO_ROOT = path.resolve(
@@ -639,9 +641,6 @@ export function main(argv, io = {}) {
   return results.every(r => r.errors.length === 0) ? 0 : 1;
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   process.exit(main(process.argv.slice(2)));
 }

package/typescript/copy-overwrite/scripts/check-nightly-e2e-health.mjs

@@ -80,7 +80,7 @@
  * @module scripts/check-nightly-e2e-health
  */
 
-import { pathToFileURL } from "node:url";
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /**
  * Contract version of the gate, asserted by the reusable workflow against its
@@ -2368,9 +2368,6 @@ async function writeOutputs(machine) {
   );
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   await main(process.argv.slice(2));
 }

package/typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs

@@ -191,7 +191,8 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { pathToFileURL } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /** Repo-relative path of the per-repo declaration file. */
 export const DECLARATION_PATH = ".github/required-checks.json";
@@ -1253,9 +1254,6 @@ function main(argv) {
   }
 }
 
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   main(process.argv.slice(2));
 }

package/typescript/copy-overwrite/scripts/check-verification-coverage.mjs

@@ -27,7 +27,8 @@
  * @module scripts/check-verification-coverage
  */
 import { execSync } from "node:child_process";
-import { pathToFileURL } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 const BEHAVIORAL_TYPES = new Set(["feat", "fix"]);
 const EXEMPT_LABEL = "verification-exempt";
@@ -237,10 +238,7 @@ async function main() {
 }
 
 // Run only when invoked directly — importing for tests must have no side effects.
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
+if (invokedAsScript(import.meta.url)) {
   main().catch(error => {
     console.error(`[verification-coverage] FAIL: ${error.message}`);
     process.exit(1);

package/typescript/copy-overwrite/scripts/lib/invoked-as-script.mjs

@@ -0,0 +1,96 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * invoked-as-script — the one implementation of "was this module run as the CLI
+ * entry point?", shared by every guarded `.mjs` entry point Lisa ships.
+ *
+ * @remarks
+ * ## Why this is shared rather than copied
+ *
+ * The obvious spelling is `import.meta.url === pathToFileURL(process.argv[1]).href`,
+ * and it is wrong in a way that cannot be seen in review. `import.meta.url` is
+ * normally the REAL path — node resolves ESM through `realpath` unless
+ * `--preserve-symlinks` or `--preserve-symlinks-main` is set — while `argv[1]`
+ * is whatever spelling the caller typed. Naming only the first of those two
+ * flags is what let a second instance of this very defect survive review here:
+ * `--preserve-symlinks-main` is a SEPARATE flag that applies to the entry
+ * module specifically, which is exactly the module this guard runs in, so it is
+ * the one that matters most and the one easiest to leave out. See the section
+ * on realpathing both sides below.
+ * Reached through a symlinked checkout, a symlinked bin shim, or a
+ * `/tmp` path on macOS (`/tmp` is itself a symlink to `/private/tmp`), the two
+ * differ, the guard is false, `main()` never runs, and the process exits 0
+ * having done nothing.
+ *
+ * That failure mode is not symmetric. A no-op GENERATOR usually fails closed —
+ * whatever consumes its output notices the missing artifact. A no-op CHECK
+ * fails **OPEN**: it prints nothing, exits 0, and the npm script "succeeds", so
+ * a gate that is meant to block a merge silently stops having an opinion. Every
+ * `check-*.mjs` in this tree is in the second category, and git worktrees —
+ * which every Lisa-driven agent uses — put a symlinked path on that code path
+ * as a matter of routine.
+ *
+ * ## `moduleUrl` is REQUIRED, and is the FIRST parameter
+ *
+ * A deliberate deviation from the obvious signature
+ * `invokedAsScript(argv1 = process.argv[1], moduleUrl = import.meta.url)`. A
+ * defaulted `import.meta.url` inside a SHARED module resolves to *this* file,
+ * which is never anybody's `process.argv[1]` — so a caller that forgot the
+ * second argument would get `false` forever and no-op silently. That is exactly
+ * the fail-open defect this module exists to remove, re-introduced by its own
+ * convenience default. Making it required and first means a call site cannot be
+ * written wrong.
+ *
+ * ## Why ANY resolution error returns false
+ *
+ * `realpathSync` throws ENOENT, EACCES, ELOOP and ENOTDIR, not just ENOENT. A
+ * fallback that narrows to ENOENT and then compares `resolve(argv1)` reinstates
+ * the un-normalized comparison the realpath exists to avoid, so the symlink
+ * defect survives on precisely the path meant to be the safety net.
+ *
+ * Returning `false` on an unresolvable `argv[1]` is sound rather than merely
+ * convenient: node resolved and LOADED the entry point from that path moments
+ * earlier, so a path that cannot be resolved now is not the path this module
+ * was loaded through. Comparing an unnormalized spelling instead would answer
+ * "maybe" with a confident "yes".
+ *
+ * ## Why BOTH sides are realpath'd, not just `argv[1]`
+ *
+ * "`import.meta.url` is always the real path" is true by default and false under
+ * `--preserve-symlinks-main`, which tells node not to resolve the main entry.
+ * Normalizing only `argv[1]` then compares a real path against a symlinked one
+ * and answers `false` for an entry point that WAS invoked directly — the same
+ * fail-open this module exists to remove, reappearing on the flag that most
+ * looks like it should not matter. Measured: a symlinked entry point reports
+ * `true` normally and `false` under the flag.
+ *
+ * Realpathing both sides is free in the ordinary case, where `moduleUrl` is
+ * already canonical and `realpathSync` is the identity.
+ *
+ * @module scripts/lib/invoked-as-script
+ */
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * Both sides are realpath'd before comparison — see the module remarks for why a
+ * raw comparison silently answers "no" under a symlinked path, and why
+ * normalizing only `argv[1]` leaves the same hole open under
+ * `--preserve-symlinks-main`.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  // `node -e`, `node --eval`, `node --print` and the REPL leave `argv[1]`
+  // undefined. Nothing was asked to run, so nothing should.
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}