@cosmicdrift/kumiko-guards 0.1.0

package/src/guard-no-date-api.ts

@@ -0,0 +1,186 @@
+#!/usr/bin/env bun
+/**
+ * Guard: finds Date-API patterns in production code where they are banned.
+ *
+ * Checked patterns (all Date-specific, Temporal has its own equivalents):
+ *   - `new Date(...)`            → Temporal.Now.instant() / Temporal.Instant.from
+ *   - `.toISOString()`           → Temporal.Instant.toString() (canonical ISO)
+ *   - `.getTime()`               → Temporal.Instant.epochMilliseconds
+ *
+ * `Date.now()` and `Date.parse()` are NOT checked — Date.now() is the
+ * idiomatic way to measure a duration (`Date.now() - startedAt`), and
+ * Temporal.Now.instant().epochMilliseconds is 4x longer for no benefit.
+ *
+ * Background: kumiko has a Temporal-based time API via `ctx.tz`. Feature
+ * code should use wall-clock + IANA-TZ via ctx.tz.parse / ctx.tz.now /
+ * ctx.tz.fromLocatedJson, NOT `new Date(...)` directly — that's the JS-Date
+ * trap (implicit local-TZ conversion in the browser, Hermes lacked
+ * Temporal for a long time, etc.). Sprint F carried this through
+ * atomically.
+ *
+ * Allowlist: paths that legitimately need the Date API (HTTP header specs,
+ * polyfill detection, Date↔Temporal bridges, JSON wire-format backwards
+ * compat). Test files are generally allowed.
+ *
+ * Usage:
+ *   bun guards/guard-no-date-api.ts
+ *
+ * Exit 1 on violations in non-allowlisted files, 0 when clean.
+ */
+
+import * as path from "node:path";
+import { type SourceFile, SyntaxKind } from "ts-morph";
+import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+
+const ROOT = process.cwd();
+
+const SCAN: ScanSpec = {
+  scope: "source",
+  extensions: ["ts"],
+  frameworkWithin: ["packages/*/src/**", "samples/**"],
+};
+
+// Files that are NOT checked — tests, type defs, generated code.
+const EXCLUDE = /(__tests__|\.test\.ts$|\.integration\.ts$|\.d\.ts$|\.g\.ts$)/;
+
+// Framework internals are still allowed to `new Date()`: they implement the
+// TZ layer themselves or hang off the DB driver where Date is the native
+// wire format. Migration plan: paths get removed from this allowlist per
+// feature/sample as they migrate to ctx.tz. Goal: the allowlist shrinks.
+const ALLOWLIST = [
+  // Framework time layer itself
+  /packages\/framework\/src\/time\//,
+  // DB layer: drizzle column wrapper, migration tooling — Date is a
+  // primitive wire format there
+  /packages\/framework\/src\/db\//,
+  // Bun.SQL layer (post-Drizzle replacement) — same boundary as db/,
+  // converts Date→Temporal at the driver boundary.
+  /packages\/framework\/src\/bun-db\//,
+  // Event-store internals: createdAt stamps, snapshot time, archive time
+  /packages\/framework\/src\/event-store\//,
+  // Pipeline: system hooks, idempotency cache (low-level timestamps)
+  /packages\/framework\/src\/pipeline\//,
+  // Errors: timestamp in the error body
+  /packages\/framework\/src\/errors\//,
+  // Jobs: job-run timestamps (the job runner is a time source for cron)
+  /packages\/framework\/src\/jobs\//,
+  // API layer: request timestamps in logs
+  /packages\/framework\/src\/api\//,
+  // Logging
+  /packages\/framework\/src\/logging\//,
+  // i18n
+  /packages\/framework\/src\/i18n\//,
+  // Observability
+  /packages\/framework\/src\/observability\//,
+  // Engine internals (factories, registry, config) — when they need Date
+  // it's defaults/audit stamps working together with the DB layer.
+  /packages\/framework\/src\/engine\/(types|registry|config-helpers|create-app|define-feature|state-machine|access|field-access|boot-validator|qualified-name)\.ts$/,
+  // Testing helpers
+  /packages\/framework\/src\/testing\//,
+  // Search adapter internals
+  /packages\/framework\/src\/search\//,
+  // File storage (coming in Gap-04)
+  /packages\/framework\/src\/files\//,
+
+  // Sprint F's atomic switch migrated bundled-features + samples to
+  // Temporal.Now.instant() — no blanket allowlist anymore. Beammycar's
+  // migration reads legacy-DB Date columns (V2 schema, no Temporal): the
+  // `pg` driver rows arrive as JS `Date`, the `dateToInstant` helper
+  // bridges them to `Temporal.Instant` via `.getTime()`. A pure bridge
+  // layer.
+  /samples\/showcases\/beammycar\/src\/migration\//,
+
+  // === Legitimate Date-API spots ===
+  // Polyfill detection: typeof globalThis.Temporal vs new Date(0) — no
+  // Temporal available because we're checking if it's there right now.
+  /packages\/framework\/src\/time\/polyfill\.ts$/,
+  // HTTP Date headers (RFC 7231): Last-Modified / Expires / signed-URL
+  // expiresAt are Date-typed in the HTTP spec, not a Temporal format.
+  /packages\/framework\/src\/files\/file-routes\.ts$/,
+  // Error serialization: timestamp in the JSON wire body for backwards
+  // compat with every client that has expected an ISO string since Sprint A.
+  /packages\/framework\/src\/errors\/serialize\.ts$/,
+  // Entity cache: parsing arbitrary input (could be Date or ISO string),
+  // Number.isNaN(d.getTime()) as a validity check.
+  /packages\/framework\/src\/pipeline\/entity-cache\.ts$/,
+  // Event-store insertSubsequentEvent: raw SQL row.created_at can be Date|string
+  // (postgres-js driver-config dependent), normalised to Temporal.Instant via
+  // .getTime() bridge.
+  /packages\/framework\/src\/event-store\/event-store\.ts$/,
+  // HTTP Last-Modified/ETag header: Bun/Node Response API expects a native
+  // Date object from fs.Stats.mtimeMs — wire boundary, not a Temporal format.
+  /packages\/server-runtime\/src\/run-prod-app-static-files\.ts$/,
+  // Bun.SQL timestamptz columns arrive as native Date (driver wire format,
+  // same reason as packages/framework/src/bun-db/ above).
+  /packages\/publish\/src\/rollback\.ts$/,
+];
+
+interface Violation {
+  file: string;
+  line: number;
+  snippet: string;
+  pattern: "new Date" | ".toISOString" | ".getTime";
+}
+
+function isAllowlisted(filePath: string): boolean {
+  const rel = path.relative(ROOT, filePath);
+  return ALLOWLIST.some((re) => re.test(rel));
+}
+
+function findDateApiUsages(sf: SourceFile): Omit<Violation, "file">[] {
+  const result: Omit<Violation, "file">[] = [];
+
+  // Pattern 1: `new Date(...)`
+  for (const expr of sf.getDescendantsOfKind(SyntaxKind.NewExpression)) {
+    if (expr.getExpression().getText() === "Date") {
+      result.push({
+        line: expr.getStartLineNumber(),
+        snippet: expr.getText(),
+        pattern: "new Date",
+      });
+    }
+  }
+
+  // Pattern 2: `.toISOString()` and `.getTime()` — property access in a call.
+  // Temporal.Instant has neither method, so any hit is a Date-API call.
+  for (const expr of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const callee = expr.getExpression();
+    if (callee.getKind() !== SyntaxKind.PropertyAccessExpression) continue;
+    const name = callee.asKindOrThrow(SyntaxKind.PropertyAccessExpression).getName();
+    if (name === "toISOString" || name === "getTime") {
+      result.push({
+        line: expr.getStartLineNumber(),
+        snippet: expr.getText(),
+        pattern: name === "toISOString" ? ".toISOString" : ".getTime",
+      });
+    }
+  }
+
+  return result;
+}
+
+export const guard: AstGuard = {
+  name: "No-Date-API Guard",
+  scan: SCAN,
+  hint: "Ersetze mit Temporal.Now.instant() / Temporal.Instant.from / .toString() / .epochMilliseconds — siehe docs/plans/architecture/timezones.md.",
+  run(files) {
+    const violations: Array<{ file: string; line: number; message: string }> = [];
+
+    for (const sf of files) {
+      const file = sf.getFilePath();
+      if (EXCLUDE.test(file)) continue;
+      if (isAllowlisted(file)) continue;
+      for (const usage of findDateApiUsages(sf)) {
+        violations.push({
+          file: path.relative(ROOT, file),
+          line: usage.line,
+          message: `[${usage.pattern}] ${usage.snippet}`,
+        });
+      }
+    }
+
+    return { violations };
+  },
+};
+
+if (import.meta.main) runStandalone(guard);

package/src/guard-no-direct-fs.ts

@@ -0,0 +1,232 @@
+#!/usr/bin/env bun
+/**
+ * Guard: finds direct `node:fs`/`fs` imports outside an allowlist.
+ *
+ * Background: several path-traversal bugs happened because request-input
+ * paths were passed straight to `node:fs` instead of through the one
+ * guarded place (`packages/framework/src/files/local-provider.ts` —
+ * `resolveContainedPath()` resolves against `basePath` and rejects anything
+ * outside it). New runtime code should use `FileStorageProvider` instead of
+ * wiring up `fs` itself again.
+ *
+ * Scans every packages/<pkg>/src directory (each root, like guard-no-date-api
+ * / guard-restricted-symbols) — the traversal risk isn't limited to one repo.
+ * Build/CLI/script/e2e tooling is filtered out via an EXCLUDE directory
+ * pattern rather than a file-by-file allowlist; everything else under src
+ * stays checked, including in app repos (e.g. marketing render jobs).
+ *
+ * Allowlist entries are repo-scoped (repo name or "*") so a path justified in
+ * one repo cannot silently free node:fs in another under the same relative
+ * path.
+ *
+ * Usage:
+ *   bun guards/guard-no-direct-fs.ts
+ *
+ * Exit 1 on violations in non-allowlisted files, 0 when clean.
+ */
+
+import { relative as pathRelative } from "node:path";
+import { Node, type SourceFile, SyntaxKind } from "ts-morph";
+import {
+  type AstGuard,
+  findRepoRootFor,
+  relFromRepoRoot,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
+import { resolveRepoRoots } from "./_lib/roots";
+
+const SCAN: ScanSpec = {
+  scope: "source",
+  extensions: ["ts"],
+  frameworkWithin: ["packages/*/src/**", "samples/**"],
+};
+
+// Tests + build/CLI/script/e2e tooling: no request input as a path.
+// (^|/) so relative paths like `tools/docgen/...` match — a leading-slash-
+// only pattern only worked when relFromRepoRoot fell back to absolute paths.
+const EXCLUDE =
+  /(__tests__|\.test\.ts$|\.integration\.ts$|\.spec\.ts$|\.d\.ts$|(^|\/)(scripts|e2e|tools|bin)\/)/;
+
+const FS_MODULES = new Set(["fs", "node:fs", "fs/promises", "node:fs/promises"]);
+
+type AllowEntry = {
+  readonly repo: string | "*";
+  readonly pattern: RegExp;
+};
+
+const ALLOWLIST: readonly AllowEntry[] = [
+  // The one guarded place: path-traversal check via resolveContainedPath().
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/files\/local-provider\.ts$/ },
+
+  // Dev-server: CLI/scaffolding/codegen, runs locally on the developer's
+  // machine, no request input as a path.
+  { repo: "kumiko-framework", pattern: /^packages\/dev-server\/src\// },
+
+  // CLI (@cosmicdrift/kumiko-cli): local dev/CI tooling reading the repo tree, no request input as path.
+  { repo: "kumiko-framework", pattern: /^packages\/cli\/src\// },
+
+  // Framework: migrations/schema tooling, DB codegen, boot validator —
+  // CLI/build time, no request input.
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/migrations\/kumiko-drift\.ts$/ },
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/schema-cli\.ts$/ },
+  // same CLI-tooling pattern as schema-cli.ts — repo-tree/node_modules walking for the upgrade command, not app-level file storage
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/upgrade-cli\.ts$/ },
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/es-ops\/runner\.ts$/ },
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/db\/migrate-generator\.ts$/ },
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/db\/migrate-runner\.ts$/ },
+  { repo: "kumiko-framework", pattern: /^packages\/framework\/src\/db\/rebuild-marker\.ts$/ },
+  {
+    repo: "kumiko-framework",
+    pattern: /^packages\/framework\/src\/engine\/boot-validator\/custom-screen-write-qns\.ts$/,
+  },
+  {
+    repo: "kumiko-framework",
+    pattern: /^packages\/framework\/src\/engine\/codemod\/pipeline-codemod\.ts$/,
+  },
+
+  // server-runtime: prod bundle build + static asset delivery from the
+  // build output (no user-controlled path).
+  { repo: "kumiko-framework", pattern: /^packages\/server-runtime\/src\/build-prod-bundle\.ts$/ },
+  {
+    repo: "kumiko-framework",
+    pattern: /^packages\/server-runtime\/src\/run-prod-app-static-files\.ts$/,
+  },
+
+  // create-kumiko-app: Scaffolding-CLI.
+  { repo: "kumiko-framework", pattern: /^packages\/create-kumiko-app\/src\/manifest\.ts$/ },
+
+  // Sample apps: codegen/screenshot-mount helper, no request input.
+  { repo: "kumiko-framework", pattern: /^samples\/apps\/use-all-bundled\/schema\/generate\.ts$/ },
+  {
+    repo: "kumiko-framework",
+    pattern: /^samples\/apps\/showcase\/src\/app\/mount-public-screenshots\.ts$/,
+  },
+
+  // kumiko-enterprise: ai-cli reads/writes locally on the developer's
+  // machine (--api-key/KUMIKO_CORPUS_PATH), no server request path.
+  { repo: "kumiko-enterprise", pattern: /^packages\/ai-cli\/src\/index\.ts$/ },
+  // Few-shot corpus loader: reads docs/few-shot-corpus.json via an upward
+  // walk from cwd, no user input as a path.
+  { repo: "kumiko-enterprise", pattern: /^packages\/ai-foundation\/src\/prompt\/corpus\.ts$/ },
+
+  // App repos: marketing landing-page renderer, iterates over a fixed
+  // language enum (LANGS/SUPPORTED_LANGS) — no user input in the path.
+  // repo:"*" — same relative path is intentional across flat-layout apps.
+  { repo: "*", pattern: /(^|\/)src\/marketing\/render-landing\.ts$/ },
+  { repo: "*", pattern: /(^|\/)src\/marketing\/rebuild-pages-job\.ts$/ },
+
+  // kumiko-enterprise publish pipeline: materialize.ts is the guarded
+  // place (writeMaterializedTree — resolve()+startsWith(root+sep) check,
+  // same pattern as local-provider.ts). build.ts/feature.ts/validate.ts
+  // now only touch fs for tempdir housekeeping (mkdtemp/rm, fixed
+  // suffixes) and a static package.json upwalk — no user path, no direct
+  // write anymore.
+  { repo: "kumiko-enterprise", pattern: /^packages\/publish\/src\/materialize\.ts$/ },
+  { repo: "kumiko-enterprise", pattern: /^packages\/publish\/src\/build\.ts$/ },
+  { repo: "kumiko-enterprise", pattern: /^packages\/publish\/src\/feature\.ts$/ },
+  { repo: "kumiko-enterprise", pattern: /^packages\/publish\/src\/validate\.ts$/ },
+];
+
+export function isRepoAllowlisted(
+  repoName: string | undefined,
+  relPath: string,
+  allowlist: readonly AllowEntry[] = ALLOWLIST,
+): boolean {
+  // Fail-closed without a resolved root: only "*" entries can match, so a
+  // synthetic in-memory path cannot hitch a ride on a framework/enterprise
+  // justification (same hole guard-direct-fetch closed).
+  return allowlist.some(
+    (e) =>
+      (e.repo === "*" || (repoName !== undefined && e.repo === repoName)) &&
+      e.pattern.test(relPath),
+  );
+}
+
+interface Violation {
+  line: number;
+  moduleSpecifier: string;
+}
+
+function findDynamicFsRequires(sf: SourceFile): Violation[] {
+  const violations: Violation[] = [];
+
+  // Dynamic `import("fs")` and CommonJS `require("fs")` bypass the static
+  // import/export declarations — both are CallExpressions in the AST.
+  for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const callee = call.getExpression();
+    const isRequireCall =
+      callee.getKind() === SyntaxKind.Identifier && callee.getText() === "require";
+    const isDynamicImport = callee.getKind() === SyntaxKind.ImportKeyword;
+    if (!isRequireCall && !isDynamicImport) continue;
+    const arg = call.getArguments()[0];
+    if (arg && Node.isStringLiteral(arg) && FS_MODULES.has(arg.getLiteralValue())) {
+      violations.push({ line: call.getStartLineNumber(), moduleSpecifier: arg.getLiteralValue() });
+    }
+  }
+  return violations;
+}
+
+function findDirectFsImports(sf: SourceFile): Violation[] {
+  const violations: Violation[] = [];
+
+  for (const decl of sf.getImportDeclarations()) {
+    const spec = decl.getModuleSpecifierValue();
+    if (FS_MODULES.has(spec)) {
+      violations.push({ line: decl.getStartLineNumber(), moduleSpecifier: spec });
+    }
+  }
+  for (const decl of sf.getExportDeclarations()) {
+    const spec = decl.getModuleSpecifierValue();
+    if (spec && FS_MODULES.has(spec)) {
+      violations.push({ line: decl.getStartLineNumber(), moduleSpecifier: spec });
+    }
+  }
+  for (const importEqualsDecl of sf.getDescendantsOfKind(SyntaxKind.ImportEqualsDeclaration)) {
+    const ref = importEqualsDecl.getModuleReference();
+    if (!Node.isExternalModuleReference(ref)) continue;
+    const arg = ref.getExpression();
+    if (arg && Node.isStringLiteral(arg) && FS_MODULES.has(arg.getLiteralValue())) {
+      violations.push({
+        line: importEqualsDecl.getStartLineNumber(),
+        moduleSpecifier: arg.getLiteralValue(),
+      });
+    }
+  }
+
+  violations.push(...findDynamicFsRequires(sf));
+
+  return violations;
+}
+
+export const guard: AstGuard = {
+  name: "No-Direct-Fs Guard",
+  scan: SCAN,
+  security: true,
+  hint: "Direkter node:fs-Import außerhalb der Allowlist — nutze FileStorageProvider (packages/framework/src/files/) statt fs selbst zu verdrahten. Path-Traversal-Guard existiert nur dort (resolveContainedPath). Legitimer neuer Tooling-Caller? Allowlist in guard-no-direct-fs.ts erweitern, mit Begründung + repo-Scope.",
+  run(files) {
+    const violations: Array<{ file: string; line: number; message: string }> = [];
+    const roots = resolveRepoRoots();
+
+    for (const sf of files) {
+      const file = sf.getFilePath();
+      const rel = relFromRepoRoot(file, roots);
+      if (EXCLUDE.test(rel)) continue;
+      const root = findRepoRootFor(file, roots);
+      if (isRepoAllowlisted(root?.name, rel)) continue;
+      for (const v of findDirectFsImports(sf)) {
+        violations.push({
+          // cwd-relative, not repo-relative `rel` — the security baseline
+          // needs an unambiguous path to resolve back to (repo, relPath).
+          file: pathRelative(process.cwd(), file),
+          line: v.line,
+          message: `[${v.moduleSpecifier}] direct fs import outside allowlist`,
+        });
+      }
+    }
+
+    return { violations };
+  },
+};
+
+if (import.meta.main) runStandalone(guard);

package/src/guard-no-direct-process-env.ts

@@ -0,0 +1,126 @@
+#!/usr/bin/env bun
+/**
+ * No-Direct-Process-Env Guard.
+ *
+ * Apps with composed env-schemas (`bin/env.ts`) must read runtime config from
+ * the validated `env` export — not scattered `process.env.X` in prod paths.
+ *
+ * Scans bin/main.ts, other bin ts files (excl. allowlist), and src (excl. tests)
+ * in every repo that ships `bin/env.ts`. Allowed raw process.env:
+ *   - bin/env.ts     — sole parseEnv input
+ *   - bin/server.ts  — dev entrypoint (runDevApp)
+ *   - bin/kumiko.ts  — schema/migrate CLI (DATABASE_URL, INIT_CWD)
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { Glob } from "bun";
+import { type RepoCheck, reportResults, runRepoChecks } from "./_lib/guard-kit";
+import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
+import { scanLinesForPredicate } from "./_lib/scan-lines";
+
+// .tsx deliberately excluded — client screens have no runtime process.env
+// access (bundler boundary), only .ts server/bin code reads process.env
+// directly. Add .tsx here if that ever stops being true.
+const SCAN_PATTERNS: ReadonlyArray<string> = ["bin/*.ts", "src/**/*.ts"];
+
+/** bin/*.ts paths that may read process.env directly (see header). */
+export const ALLOWED_BIN_FILES: ReadonlySet<string> = new Set([
+  "bin/env.ts",
+  "bin/server.ts",
+  "bin/kumiko.ts",
+]);
+
+const EXCLUDE_DIR = /(?:^|\/)(?:node_modules|dist|__tests__)\//;
+const IS_TEST = /\.(?:test|integration)\.tsx?$/;
+
+// process.env.FOO | process.env.foo | process.env["FOO"] | process.env[`FOO`]
+const PROCESS_ENV_REF = /process\.env(?:\.[A-Za-z_][A-Za-z0-9_]*|\[(?:'[^']+'|"[^"]+"|`[^`]+`)\])/;
+
+export type ProcessEnvFinding = {
+  readonly file: string;
+  readonly line: number;
+  readonly text: string;
+};
+
+/** Returns true when the line contains a live process.env reference. */
+export function processEnvOnLine(line: string): boolean {
+  const code = line.replace(/\/\/.*$/, "");
+  return PROCESS_ENV_REF.test(code);
+}
+
+export function isScannableBinFile(rel: string): boolean {
+  return rel.startsWith("bin/") && rel.endsWith(".ts") && !ALLOWED_BIN_FILES.has(rel);
+}
+
+// Fail-scope deliberately covers every repo with bin/env.ts (rather than only
+// hard-failing kumiko-studio and warning on the rest). Kept as a
+// known-candidate allowlist (documents which repos use the bin/env.ts
+// convention at all — "solon" is deliberately not on it) and intersected
+// with the resolved roots, so a restricted scope actually narrows what this
+// guard scans instead of always walking every repo regardless of scope
+// (infra#721 follow-up — a money-horse-scoped push must not fail on a
+// finding in publicstatus).
+const CANDIDATE_ENV_TS_REPOS: ReadonlySet<string> = new Set([
+  "kumiko-studio",
+  "publicstatus",
+  "money-horse",
+  "phronexsis",
+]);
+
+export function reposWithEnvTs(roots: ReadonlyArray<RepoRoot> = resolveRepoRoots()): RepoRoot[] {
+  return roots.filter(
+    (root) => CANDIDATE_ENV_TS_REPOS.has(root.name) && existsSync(join(root.absPath, "bin/env.ts")),
+  );
+}
+
+export function findDirectProcessEnv(roots?: ReadonlyArray<RepoRoot>): ProcessEnvFinding[] {
+  return scanDirectProcessEnv(roots).findings;
+}
+
+/**
+ * Like findDirectProcessEnv, additionally reports the number of files read
+ * and repos with bin/env.ts — without that an empty scan can't be told apart
+ * from a clean one (infra#433).
+ */
+export function scanDirectProcessEnv(roots: ReadonlyArray<RepoRoot> = resolveRepoRoots()): {
+  readonly findings: ProcessEnvFinding[];
+  readonly scannedFiles: number;
+  readonly reposPresent: number;
+} {
+  const findings: ProcessEnvFinding[] = [];
+  let scannedFiles = 0;
+  const repos = reposWithEnvTs(roots);
+  for (const repo of repos) {
+    const repoDir = repo.absPath;
+    for (const pattern of SCAN_PATTERNS) {
+      for (const rel of new Glob(pattern).scanSync({ cwd: repoDir })) {
+        if (EXCLUDE_DIR.test(`/${rel}`) || IS_TEST.test(rel)) continue;
+        if (rel.startsWith("bin/") && !isScannableBinFile(rel)) continue;
+        const abs = join(repoDir, rel);
+        scannedFiles++;
+        scanLinesForPredicate(abs, `${repo.name}/${rel}`, processEnvOnLine, findings);
+      }
+    }
+  }
+  return { findings, scannedFiles, reposPresent: repos.length };
+}
+
+export const check: RepoCheck = {
+  name: "guard-no-direct-process-env",
+  hint: "Read runtime config from bin/env.ts (validated env export), not process.env in bin/main.ts, bin helpers, or src/.",
+  run(roots) {
+    const scan = scanDirectProcessEnv(roots);
+    return {
+      violations: scan.findings.map((f) => ({ file: f.file, line: f.line, message: f.text })),
+      matchedFiles: scan.scannedFiles,
+      // reposPresent as the applicability signal: no repo with bin/env.ts means
+      // not applicable, repos present but nothing scanned means broken resolution.
+      notApplicable: scan.reposPresent === 0,
+    };
+  },
+};
+
+if (import.meta.main) {
+  const failed = reportResults(await runRepoChecks([check]));
+  process.exit(failed > 0 ? 1 : 0);
+}

package/src/guard-no-inline-styles.ts

@@ -0,0 +1,58 @@
+#!/usr/bin/env bun
+// No inline CSS in app code: `style={...}` props and `React.CSSProperties`
+// style objects bypass theme tokens and dark mode. Use widgets/tokens.
+//
+// Part of App-Mounting 2.0 (infra#208).
+
+import { type SourceFile, SyntaxKind } from "ts-morph";
+import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import { hasIgnoreTag } from "./_lib/ignore-tag";
+
+const SCAN: ScanSpec = {
+  scope: "source",
+  extensions: ["ts", "tsx"],
+  frameworkWithin: ["packages/bundled-features/src/**"],
+};
+const EXCLUDE = /(__tests__|\.test\.tsx?$|\.integration\.tsx?$|\.d\.ts$)/;
+const IGNORE_TAG = "kumiko-lint-ignore no-inline-styles";
+
+export const guard: AstGuard = {
+  name: "No-Inline-Styles Guard (App-Repos)",
+  scan: SCAN,
+  hint:
+    "style=/CSSProperties in App-Code durch Widgets + Theme-Tokens ersetzen. " +
+    `Begründete Ausnahme (z.B. dynamische Breite aus Daten): // ${IGNORE_TAG} <Grund>`,
+  run(files: readonly SourceFile[]) {
+    const violations: GuardViolation[] = [];
+    for (const sf of files) {
+      if (EXCLUDE.test(sf.getFilePath())) continue;
+      for (const attr of sf.getDescendantsOfKind(SyntaxKind.JsxAttribute)) {
+        if (attr.getNameNode().getText() !== "style") continue;
+        if (hasIgnoreTag(attr, IGNORE_TAG)) continue;
+        violations.push({
+          file: sf.getFilePath(),
+          line: attr.getStartLineNumber(),
+          message: "style=-Prop in App-Code (Theme-Tokens/Widgets nutzen)",
+        });
+      }
+      // ponytail: name-text comparison doesn't tolerate aliased imports
+      // (import { CSSProperties as CSS }) and false-positives on same-named
+      // local types. The style=-JsxAttribute above is the primary, more
+      // robust signal path — this TypeReference check is deliberately
+      // best-effort.
+      for (const ref of sf.getDescendantsOfKind(SyntaxKind.TypeReference)) {
+        const name = ref.getTypeName().getText();
+        if (name !== "CSSProperties" && name !== "React.CSSProperties") continue;
+        if (hasIgnoreTag(ref, IGNORE_TAG)) continue;
+        violations.push({
+          file: sf.getFilePath(),
+          line: ref.getStartLineNumber(),
+          message: "CSSProperties-Style-Objekt in App-Code (Theme-Tokens/Widgets nutzen)",
+        });
+      }
+    }
+    return { violations };
+  },
+};
+
+if (import.meta.main) runStandalone(guard);