@cosmicdrift/kumiko-guards 0.288.0 → 0.289.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.288.0",
+  "version": "0.289.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -27,7 +27,7 @@
     "kumiko-guards": "./src/cli.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.288.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.289.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/_lib/sql-inventory.ts

@@ -11,7 +11,7 @@
  * I/O: Bun.Glob + Bun.file; directoryExists uses node:fs (same as roots.ts).
  */
 import { existsSync, statSync } from "node:fs";
-import type { RepoRoot } from "./roots";
+import { type RepoRoot, sourceRootDirs } from "./roots";
 
 /** POSIX path join without Node path module. */
 function joinPath(base: string, ...segments: string[]): string {
@@ -107,20 +107,10 @@ export const BLOCKING_SQL_KINDS: ReadonlyArray<SqlInventoryKind> = ["unsafe", "a
 
 const TS_GLOB = new Bun.Glob("**/*.{ts,tsx}");
 
-export type SqlScanLayout = "multi-package" | "flat" | "none";
-
-// kumiko-platform deliberately returns "none" (0 files) — its docs-samples tree needs its own allowlist review before this guard scans it (follow-up issue).
-export function sqlScanLayoutFor(root: Pick<RepoRoot, "name" | "kind">): SqlScanLayout {
-  if (root.name === "kumiko-platform") return "none";
-  if (root.kind === "framework" || root.kind === "library") return "multi-package";
-  return "flat";
-}
-
-/** Scan dirs per repo layout — multi-package keeps the packages/samples/scripts/bin layout, flat is a bare src/ + bin/. */
-function scanDirsFor(layout: SqlScanLayout): readonly string[] {
-  if (layout === "multi-package") return ["packages", "samples", "scripts", "bin"];
-  if (layout === "none") return [];
-  return ["src", "bin"];
+// kumiko-platform deliberately returns no scan dirs (0 files) — its docs-samples tree needs its own allowlist review before this guard scans it (follow-up issue).
+export function sqlScanDirsFor(root: RepoRoot): readonly string[] {
+  if (root.name === "kumiko-platform") return [];
+  return sourceRootDirs(root).map((dir) => dir.slice(root.absPath.length).replace(/^\/+/, ""));
 }
 
 function normalizePathForMatch(filePath: string): string {
@@ -155,9 +145,9 @@ function directoryExists(path: string): boolean {
   }
 }
 
-async function collectTsFiles(repoRoot: string, layout: SqlScanLayout): Promise<string[]> {
+async function collectTsFiles(repoRoot: string, scanDirs: readonly string[]): Promise<string[]> {
   const out: string[] = [];
-  for (const sub of scanDirsFor(layout)) {
+  for (const sub of scanDirs) {
     const cwd = joinPath(repoRoot, sub);
     if (!directoryExists(cwd)) continue;
     for await (const rel of TS_GLOB.scan({ cwd, onlyFiles: true })) {
@@ -226,9 +216,9 @@ function scanFileText(relPath: string, text: string, hits: SqlInventoryHit[]): v
 
 export async function scanRepo(
   repoRoot: string,
-  layout: SqlScanLayout,
+  scanDirs: readonly string[],
 ): Promise<SqlInventoryReport> {
-  const relFiles = await collectTsFiles(repoRoot, layout);
+  const relFiles = await collectTsFiles(repoRoot, scanDirs);
   const hits: SqlInventoryHit[] = [];
 
   for (const rel of relFiles) {

package/src/check-runtime-isolation.ts

@@ -63,7 +63,7 @@ import {
   runRepoChecks,
 } from "./_lib/guard-kit";
 import { frameworkTsConfigPath, type RepoRoot, resolveRepoRoots } from "./_lib/roots";
-import { type ScanSpec, scanFiles } from "./_lib/scan-scope";
+import { type ScanSpec, scanFiles, scanRoots } from "./_lib/scan-scope";
 import {
   classify,
   computeClientReachablePaths,
@@ -166,6 +166,12 @@ export const check: RepoCheck = {
   run(roots) {
     const root = roots[0];
     if (!root) return { violations: [], matchedFiles: 0, notApplicable: true };
+    // The kind filter (scan-scope.ts keepsRootKind) excludes "tooling" roots by
+    // default — that's a deliberate scope choice, not a vacuous scan, so it must
+    // report notApplicable instead of matchedFiles: 0.
+    if (scanRoots(SCAN, [root]).length === 0) {
+      return { violations: [], matchedFiles: 0, notApplicable: true };
+    }
     const rootAbsPath = root.absPath;
 
     const { allViolations, outsideRoot, scannedFiles } = scanRoot(root);

package/src/check-secret-literals.ts

@@ -28,13 +28,12 @@ import { type RepoCheck, reportResults, runRepoChecks } from "./_lib/guard-kit";
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
 import { scanLinesForPredicate } from "./_lib/scan-lines";
 
-// Server-side only: apps/server (not apps/mobile — client code, no server secrets).
-const SCAN_PATTERNS: ReadonlyArray<string> = [
-  "bin/**/*.ts",
-  "src/**/*.ts",
-  "apps/server/src/**/*.ts",
-  "packages/*/src/**/*.ts",
-];
+// Server-side only: a declared sourceRoot under a mobile/client app has no server secrets to leak.
+const CLIENT_SOURCE_ROOT = /(?:^|\/)mobile(?:\/|$)/;
+
+function serverSourceRoots(root: RepoRoot): readonly string[] {
+  return root.manifest.sourceRoots.filter((sourceRoot) => !CLIENT_SOURCE_ROOT.test(sourceRoot));
+}
 
 const EXCLUDE_DIR = /(?:^|\/)(?:node_modules|dist|__tests__)\//;
 const IS_TEST = /\.(?:test|integration)\.tsx?$/;
@@ -75,8 +74,8 @@ async function scanRoot(
 ): Promise<{ readonly findings: SecretLiteralFinding[]; readonly scannedFiles: number }> {
   const findings: SecretLiteralFinding[] = [];
   let scannedFiles = 0;
-  for (const pattern of SCAN_PATTERNS) {
-    for (const rel of new Glob(pattern).scanSync({ cwd: root.absPath })) {
+  for (const sourceRoot of serverSourceRoots(root)) {
+    for (const rel of new Glob(`${sourceRoot}/**/*.ts`).scanSync({ cwd: root.absPath })) {
       if (EXCLUDE_DIR.test(`/${rel}`) || IS_TEST.test(rel) || DEV_ENTRYPOINT.test(rel)) {
         continue;
       }

package/src/guard-raw-sql.ts

@@ -14,7 +14,7 @@
 
 import { type RepoCheck, reportResults, runRepoChecks } from "./_lib/guard-kit";
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
-import { BLOCKING_SQL_KINDS, scanRepo, sqlScanLayoutFor } from "./_lib/sql-inventory";
+import { BLOCKING_SQL_KINDS, scanRepo, sqlScanDirsFor } from "./_lib/sql-inventory";
 
 export type RawSqlFinding = {
   readonly repo: string;
@@ -32,7 +32,7 @@ async function scanAllRepos(roots: readonly RepoRoot[]): Promise<{
   let scannedFiles = 0;
 
   for (const root of roots) {
-    const report = await scanRepo(root.absPath, sqlScanLayoutFor(root));
+    const report = await scanRepo(root.absPath, sqlScanDirsFor(root));
     scannedFiles += report.scannedFiles;
 
     for (const hit of report.hits) {
@@ -66,7 +66,7 @@ export const check: RepoCheck = {
     "// kumiko-lint-ignore raw-sql <reason> on the line or the line above.",
   async run(roots) {
     // kumiko-platform's deliberate empty scan-dir list must not read as vacuous (infra#610).
-    const applicableRoots = roots.filter((r) => sqlScanLayoutFor(r) !== "none");
+    const applicableRoots = roots.filter((r) => sqlScanDirsFor(r).length > 0);
     if (applicableRoots.length === 0) {
       return { violations: [], matchedFiles: 0, notApplicable: true };
     }

package/src/guard-thin-wrappers.ts

@@ -39,7 +39,7 @@ import {
 } from "ts-morph";
 import { type RepoCheck, reportResults, runRepoChecks } from "./_lib/guard-kit";
 import { frameworkTsConfigPath } from "./_lib/roots";
-import { type ScanSpec, scanFiles } from "./_lib/scan-scope";
+import { type ScanSpec, scanFiles, scanRoots } from "./_lib/scan-scope";
 
 const ROOT = process.cwd();
 
@@ -385,6 +385,13 @@ const SCAN: ScanSpec = {
 export const check: RepoCheck = {
   name: "Thin-Wrappers Guard",
   run(roots) {
+    // The kind filter (scan-scope.ts keepsRootKind) excludes "tooling" roots by
+    // default — that's a deliberate scope choice, not a vacuous scan, so it must
+    // report notApplicable instead of matchedFiles: 0.
+    if (scanRoots(SCAN, roots).length === 0) {
+      return { violations: [], matchedFiles: 0, notApplicable: true };
+    }
+
     const project = new Project({
       tsConfigFilePath: frameworkTsConfigPath(),
       skipAddingFilesFromTsConfig: true,
@@ -416,7 +423,7 @@ export const check: RepoCheck = {
       violations: [],
       warnings: warnings.length > 0 ? warnings : undefined,
       matchedFiles: scanned,
-      notApplicable: roots.length === 0,
+      notApplicable: false,
     };
   },
 };