@cosmicdrift/kumiko-guards 0.313.0 → 0.315.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.313.0",
+  "version": "0.315.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.313.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.315.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.314.0",
+    "type": "fix",
+    "title": "Tailwind-Scan-Surface Guard classifies files against the runner's roots",
+    "detail": "The guard ignored the roots its runner passes to run() and re-derived the\nsingle repo of the current working directory. Under a multi-root runner,\na file from a checkout outside cwd fell through to the packages/ marker\nfallback, which misreads a checkout path that itself contains a packages/\nsegment. run() now uses the roots it is given, like the other guards."
+  },
   {
     "version": "0.311.0",
     "type": "breaking",

package/src/guard-tailwind-scan-surface.ts

@@ -108,11 +108,14 @@ export interface Finding {
   readonly token: string;
 }
 
-function isTargetFile(sf: SourceFile): boolean {
-  return relFromRepoRoot(sf.getFilePath()).startsWith(TARGET_DIR);
+function isTargetFile(sf: SourceFile, roots: readonly RepoRoot[]): boolean {
+  return relFromRepoRoot(sf.getFilePath(), roots).startsWith(TARGET_DIR);
 }
 
-function scan(files: readonly SourceFile[]): {
+function scan(
+  files: readonly SourceFile[],
+  roots: readonly RepoRoot[],
+): {
   findings: Finding[];
   scanned: number;
 } {
@@ -121,7 +124,7 @@ function scan(files: readonly SourceFile[]): {
   let scanned = 0;
 
   for (const sf of files) {
-    if (isTargetFile(sf)) {
+    if (isTargetFile(sf, roots)) {
       if (EXCLUDE.test(sf.getFilePath())) continue;
       targets.push(sf);
       scanned++;
@@ -537,7 +540,7 @@ export function analyse(
   compareBaseline: boolean,
   roots: readonly RepoRoot[] = resolveRepoRoots(),
 ): GuardOutcome {
-  const { findings } = scan(files);
+  const { findings } = scan(files, roots);
   const coverageFindings = scanSourceCoverage(roots);
   const publishedSurfaceFindings = scanPublishedScanSurface(roots);
   reportPublishedScanSurfaceFindings(publishedSurfaceFindings);
@@ -562,7 +565,7 @@ export const guard: AstGuard = {
     `— reuse a class already emitted there, or move the styling into renderer-web. Justified exception: // ${IGNORE_TAG} <reason>. ` +
     "Package without @source coverage in an app: add an @source entry for both install layouts. " +
     "@source with a node_modules/<pkg>/<segment> path: check whether <pkg> even publishes that segment (package.json files).",
-  run: (files) => analyse(files, true),
+  run: (files, roots = resolveRepoRoots()) => analyse(files, true, roots),
 };
 
 // Flags are read ONLY here, not in run() — the shared runner
@@ -572,7 +575,7 @@ if (import.meta.main) {
   const args = process.argv.slice(2);
   if (args.includes("--write-baseline")) {
     const project = buildSharedProject([guard]);
-    const { findings } = scan(filesForGuard(project, guard));
+    const { findings } = scan(filesForGuard(project, guard), resolveRepoRoots());
     tailwindScanSurfaceBaseline.write(baselineCounts(findings));
     sourceCoverageBaseline.write(
       sourceCoverageBaselineCounts(scanSourceCoverage(resolveRepoRoots())),