@cosmicdrift/kumiko-guards 0.335.0 → 0.336.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.335.0",
+  "version": "0.336.1",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.335.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.336.1",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/_lib/guard-kit.ts

@@ -125,6 +125,10 @@ export function relFromRepoRoot(
   return filePath.slice(filePath.indexOf(marker));
 }
 
+export function relativeToCwd(absolutePath: string): string {
+  return pathRelative(process.cwd(), absolutePath);
+}
+
 export function isAllowlisted(relPath: string, allowlist: readonly RegExp[]): boolean {
   return allowlist.some((re) => re.test(relPath));
 }

package/src/_lib/scan-scope.ts

@@ -164,7 +164,7 @@ function scanRoot(spec: ScanSpec, root: RepoRoot): RootScan {
   return { root, files, sourceSurface: sourceSurfaceHits.length };
 }
 
-function keepsRootKind(spec: ScanSpec, root: RepoRoot): boolean {
+export function keepsRootKind(spec: ScanSpec, root: RepoRoot): boolean {
   if (spec.kinds) return spec.kinds.includes(root.kind);
   return root.kind !== "tooling";
 }

package/src/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "improvement",
+    "title": "Guards reject --guard without --write-baseline and catch more raw-form-HTML, locale and timeout cases",
+    "detail": "Guards are stricter and more consistent: `guards --guard=<name>` without `--write-baseline` is rejected instead of silently running every guard, the raw-form-HTML check also catches tags after `=`, `[` or in spaceless ternaries, the German locale check flags lowercase \"organisation\", `test-timeouts` flags `setDefaultTimeout` and `describe.configure({ timeout })`, the no-framed-extension-sections guard correlates registry keys and usages by resolved value, and the fake-tests helper lookup is scope-aware. UI guards report repo-relative file paths. The pre-push worktree detection compares absolute git dirs."
+  },
+  {
+    "version": "0.336.0",
+    "type": "improvement",
+    "title": "secret-literal checks all fallbacks on a line; as-casts audit is quiet inside the shared runner",
+    "detail": "`secret-literal` now inspects every `?? \"literal\"` fallback on a line instead of only the first, so a hardcoded secret behind a trivial first fallback is flagged. The `as-casts` audit prints its per-site listings only when run standalone; inside the shared runner it prints just the counts and the baseline verdict.",
+    "migration": "A repo with a hardcoded secret fallback hidden behind an earlier trivial fallback on the same line can now fail the secret-literal guard. Replace the literal with a hard failure on a missing env value."
+  },
   {
     "version": "0.335.0",
     "type": "improvement",

package/src/check-as-casts.ts

@@ -405,6 +405,11 @@ function groupByCategory(all: readonly Site[]): Map<Category, Site[]> {
   return byCat;
 }
 
+// The per-site listings are advisory and long; inside the shared runner (every consumer's
+// `bun run check`) they would bury the output of guards that can fail, so only a standalone
+// run of this file prints them.
+const PRINT_SITE_LISTINGS = import.meta.main;
+
 function reportCasts(all: readonly Site[], scanned: number): void {
   const byCat = groupByCategory(all);
   console.log(`as-Cast Audit: ${scanned} files checked, ${all.length} casts total.\n`);
@@ -412,6 +417,8 @@ function reportCasts(all: readonly Site[], scanned: number): void {
     const count = byCat.get(c)?.length ?? 0;
     console.log(`  ${c.padEnd(18)} ${count}`);
   }
+  // skip: site listings are printed only on a standalone run of this guard
+  if (!PRINT_SITE_LISTINGS) return;
 
   const suspects = CATS.filter((c) => c.startsWith("suspect-"));
 

package/src/check-runtime-isolation.ts

@@ -64,7 +64,7 @@ import {
   runRepoChecks,
 } from "./_lib/guard-kit";
 import { frameworkTsConfigPath, type RepoRoot, resolveRepoRoots } from "./_lib/roots";
-import { type ScanSpec, scanFiles, scanRoots } from "./_lib/scan-scope";
+import { keepsRootKind, type ScanSpec, scanFiles } from "./_lib/scan-scope";
 import {
   classify,
   computeClientReachablePaths,
@@ -177,7 +177,7 @@ export const check: RepoCheck = {
     // The kind filter (scan-scope.ts keepsRootKind) excludes "tooling" roots by
     // default — that's a deliberate scope choice, not a vacuous scan, so it must
     // report notApplicable instead of matchedFiles: 0.
-    if (scanRoots(SCAN, [root]).length === 0) {
+    if (!keepsRootKind(SCAN, root)) {
       return { violations: [], matchedFiles: 0, notApplicable: true };
     }
     const rootAbsPath = root.absPath;

package/src/check-secret-literals.ts

@@ -42,7 +42,7 @@ const IS_TEST = /\.(?:test|integration)\.tsx?$/;
 const DEV_ENTRYPOINT = /(?:^|\/)bin\/server\.ts$/;
 
 // A `?? "literal"` / `|| "literal"` nullish/or fallback to a string literal.
-const STRING_FALLBACK = /(?:\?\?|\|\|)\s*(['"`])([^'"`\n]+)\1/;
+const STRING_FALLBACK = /(?:\?\?|\|\|)\s*(['"`])([^'"`\n]+)\1/g;
 // A secret-like identifier. Matched only against the text LEFT of the fallback
 // (assignee / property name): `cfg.title ?? "Secret Santa"` is a label, not a secret.
 const SECRET_NAME =
@@ -116,19 +116,24 @@ export function scanLinesForSecretLiterals(lines: readonly string[]): SecretLite
   for (let i = 0; i < lines.length; i++) {
     const raw = lines[i] ?? "";
     const code = maskedLines[i] ?? "";
-    const match = STRING_FALLBACK.exec(code);
-    if (!match) continue;
-    const literal = match[2];
-    if (!literal || literal.length < MIN_SECRET_LENGTH || TRIVIAL_LITERAL.test(literal)) continue;
-    const left = code.slice(0, match.index);
-    const name =
-      SECRET_NAME.exec(left)?.[0] ??
-      (SECRET_LITERAL_TOKEN.test(literal)
-        ? (LHS_NAME.exec(left)?.[1] ?? UNNAMED_PLACEHOLDER)
-        : undefined);
-    if (name === undefined) continue;
     if (raw.includes(IGNORE_TAG) || (lines[i - 1] ?? "").includes(IGNORE_TAG)) continue;
-    hits.push({ lineNumber: i + 1, name, literalLength: literal.length });
+    // Every fallback on the line is inspected; the name is read only from the text since the
+    // previous fallback, so an earlier assignee cannot lend its name to a later literal.
+    let previousEnd = 0;
+    for (const match of code.matchAll(STRING_FALLBACK)) {
+      const left = code.slice(previousEnd, match.index);
+      previousEnd = match.index + match[0].length;
+      const literal = match[2];
+      if (!literal || literal.length < MIN_SECRET_LENGTH || TRIVIAL_LITERAL.test(literal)) continue;
+      const name =
+        SECRET_NAME.exec(left)?.[0] ??
+        (SECRET_LITERAL_TOKEN.test(literal)
+          ? (LHS_NAME.exec(left)?.[1] ?? UNNAMED_PLACEHOLDER)
+          : undefined);
+      if (name === undefined) continue;
+      hits.push({ lineNumber: i + 1, name, literalLength: literal.length });
+      break;
+    }
   }
   return hits;
 }

package/src/guard-escape-hatch-declared.ts

@@ -78,6 +78,7 @@ import {
   type PropertyAssignment,
   type SourceFile,
   SyntaxKind,
+  VariableDeclarationKind,
 } from "ts-morph";
 import { isFrameworkImportOf } from "./_lib/framework-import";
 import { isGenericReason, resolveReasonText } from "./_lib/generic-reason";
@@ -421,12 +422,22 @@ function isExplicitlyUnresolvableReason(node: Node): boolean {
     (decl) =>
       decl.isKind(SyntaxKind.ImportSpecifier) ||
       decl.isKind(SyntaxKind.ImportClause) ||
-      decl.isKind(SyntaxKind.NamespaceImport),
+      decl.isKind(SyntaxKind.NamespaceImport) ||
+      isNonConstVariableDeclaration(decl),
+  );
+}
+
+function isNonConstVariableDeclaration(decl: Node): boolean {
+  if (!decl.isKind(SyntaxKind.VariableDeclaration)) return false;
+  const list = decl.getParent();
+  return (
+    list.isKind(SyntaxKind.VariableDeclarationList) &&
+    list.getDeclarationKind() !== VariableDeclarationKind.Const
   );
 }
 
 const UNRESOLVABLE_REASON_HINT =
-  " A declareEscapeHatch({ reason }) call was found here, but its reason is an import, a function call, or a template with substitutions — none of those can be statically judged, so declareEscapeHatch needs a string literal or a module-local const instead.";
+  " A declareEscapeHatch({ reason }) call was found here, but its reason is an import, a function call, or a template with substitutions (or a `let`/non-`const` binding) — none of those can be statically judged, so declareEscapeHatch needs a string literal or a module-local const instead.";
 
 // Walks the same ancestor chain as isInsideEscapeHatchDeclaredFunction, but
 // looks for a declareEscapeHatch statement whose reason is one of the three

package/src/guard-fake-tests.ts

@@ -77,40 +77,47 @@ function isDirectAssertionCall(call: CallExpression): boolean {
   return ASSERTION_API_METHODS.has(name);
 }
 
-// A bare identifier `foo(...)` counts as an assertion when `foo` is declared
-// in the SAME file (function declaration, or a variable initialized with an
-// arrow/function expression, at any nesting level) and its own body asserts —
+// A bare identifier `foo(...)` counts as an assertion when `foo` resolves
+// (by symbol, so a same-named helper in another scope is not confused with it)
+// to a declaration in the SAME file (function declaration, or a variable
+// initialized with an arrow/function expression) whose own body asserts —
 // recursively, so a chain of thin wrappers around expect() still counts.
-function resolveSameFileHelper(sf: SourceFile, name: string): Node | undefined {
-  const fn = sf
-    .getDescendantsOfKind(SyntaxKind.FunctionDeclaration)
-    .find((f) => f.getName() === name);
-  if (fn) return fn;
-  const varDecl = sf
-    .getDescendantsOfKind(SyntaxKind.VariableDeclaration)
-    .find((v) => v.getName() === name);
-  const init = varDecl?.getInitializer();
-  if (
-    init &&
-    (init.isKind(SyntaxKind.ArrowFunction) || init.isKind(SyntaxKind.FunctionExpression))
-  ) {
-    return init;
+function resolveSameFileHelper(sf: SourceFile, identifier: Node): Node | undefined {
+  for (const decl of identifier.getSymbol()?.getDeclarations() ?? []) {
+    if (decl.getSourceFile() !== sf) continue;
+    if (decl.isKind(SyntaxKind.FunctionDeclaration)) return decl;
+    if (!decl.isKind(SyntaxKind.VariableDeclaration)) continue;
+    const init = decl.getInitializer();
+    if (
+      init &&
+      (init.isKind(SyntaxKind.ArrowFunction) || init.isKind(SyntaxKind.FunctionExpression))
+    ) {
+      return init;
+    }
   }
   return undefined;
 }
 
-// depth limit + visited set: a helper chain deeper than the limit is treated
-// as unproven (violation), and a recursive helper never infinite-loops.
-function bodyHasAssertion(node: Node, sf: SourceFile, depth: number, visited: Set<Node>): boolean {
-  if (visited.has(node)) return false;
-  visited.add(node);
+// depth limit + shallowest-visit memo: a helper chain deeper than the limit is
+// treated as unproven (violation), a recursive helper never infinite-loops, and
+// a helper first reached at the depth limit is still explored when reached
+// again via a shorter path.
+function bodyHasAssertion(
+  node: Node,
+  sf: SourceFile,
+  depth: number,
+  shallowestVisit: Map<Node, number>,
+): boolean {
+  const seenAt = shallowestVisit.get(node);
+  if (seenAt !== undefined && seenAt <= depth) return false;
+  shallowestVisit.set(node, depth);
   for (const call of node.getDescendantsOfKind(SyntaxKind.CallExpression)) {
     if (isDirectAssertionCall(call)) return true;
     if (depth >= MAX_HELPER_DEPTH) continue;
     const expr = call.getExpression();
     if (!expr.isKind(SyntaxKind.Identifier)) continue;
-    const helper = resolveSameFileHelper(sf, expr.getText());
-    if (helper && bodyHasAssertion(helper, sf, depth + 1, visited)) return true;
+    const helper = resolveSameFileHelper(sf, expr);
+    if (helper && bodyHasAssertion(helper, sf, depth + 1, shallowestVisit)) return true;
   }
   return false;
 }
@@ -141,7 +148,7 @@ function scanFile(sf: SourceFile): Violation[] {
     const isArrowOrFn =
       body.isKind(SyntaxKind.ArrowFunction) || body.isKind(SyntaxKind.FunctionExpression);
     if (!isArrowOrFn) continue;
-    const hasAssertion = bodyHasAssertion(body, sf, 0, new Set());
+    const hasAssertion = bodyHasAssertion(body, sf, 0, new Map());
     if (!hasAssertion) {
       const nameArg = args[0]?.getText().slice(0, 50) ?? "<anonymous>";
       violations.push({

package/src/guard-i18n-locale-terminology.ts

@@ -44,7 +44,7 @@ const RULES: Record<"de" | "es", LocaleRule> = {
     // Tenants? covers plural; Organisation(en|s)? without trailing \b so
     // compounds like Organisations-ID / Organisationsstruktur still match
     // (infra#603). TenantAdmin stays safe: \b after Tenant fails on 'A'.
-    forbidden: [/\bTenants?\b/i, /\bOrganisation(en|s)?/],
+    forbidden: [/\bTenants?\b/i, /\bOrganisation(en|s)?/i],
   },
   es: {
     preferred: "Organización",

package/src/guard-no-custom-primitives.ts

@@ -28,6 +28,7 @@ import {
   compareToBaseline,
   filesForGuard,
   type GuardViolation,
+  relativeToCwd,
   runStandalone,
   type ScanSpec,
 } from "./_lib/guard-kit";
@@ -66,7 +67,7 @@ function collectRawFormHtml(sf: SourceFile): RawFormFinding[] {
     if (!RAW_FORM_TAGS.has(tag)) continue;
     if (hasIgnoreTag(el, IGNORE_TAG)) continue;
     findings.push({
-      file: path.relative(ROOT, sf.getFilePath()),
+      file: relativeToCwd(sf.getFilePath()),
       line: el.getStartLineNumber(),
       tag,
     });
@@ -146,7 +147,7 @@ function analyse(
       if (!PRIMITIVE_NAME.test(c.name)) continue;
       if (hasIgnoreTag(c.node, IGNORE_TAG)) continue;
       violations.push({
-        file: sf.getFilePath(),
+        file: relativeToCwd(sf.getFilePath()),
         line: c.line,
         message: `App-local UI primitive "${c.name}" — use a framework widget/primitive`,
       });

package/src/guard-no-framed-extension-sections.ts

@@ -34,7 +34,13 @@
 // two; no usage site found at all, or any other mount kind, stays flagged.
 
 import * as path from "node:path";
-import { Node, type ObjectLiteralExpression, type SourceFile, SyntaxKind } from "ts-morph";
+import {
+  Node,
+  type ObjectLiteralExpression,
+  type SourceFile,
+  SyntaxKind,
+  VariableDeclarationKind,
+} from "ts-morph";
 import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 import { hasIgnoreTag } from "./_lib/ignore-tag";
 
@@ -59,6 +65,34 @@ function isExternalSourceFile(sf: SourceFile): boolean {
   return sf.getFilePath().includes("/node_modules/");
 }
 
+function stringConstantValue(node: Node): string | undefined {
+  if (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node)) {
+    return node.getLiteralText();
+  }
+  if (Node.isAsExpression(node)) return stringConstantValue(node.getExpression());
+  if (!Node.isIdentifier(node)) return undefined;
+  const symbol = node.getSymbol();
+  const resolved = symbol?.isAlias() ? symbol.getAliasedSymbol() : symbol;
+  for (const decl of resolved?.getDeclarations() ?? []) {
+    if (!Node.isVariableDeclaration(decl)) continue;
+    if (decl.getVariableStatement()?.getDeclarationKind() !== VariableDeclarationKind.Const) {
+      continue;
+    }
+    const init = decl.getInitializer();
+    const value = init === undefined ? undefined : stringConstantValue(init);
+    if (value !== undefined) return value;
+  }
+  return undefined;
+}
+
+// Registry keys and `__component` usages meet on the resolved string value, so
+// two features' same-named local consts don't collide and a literal never
+// matches a computed key. An unresolvable identifier keeps a name-based key
+// that no literal can equal, which leaves the component conservatively flagged.
+function registryKeyFor(node: Node): string {
+  return stringConstantValue(node) ?? `unresolved:${node.getText()}`;
+}
+
 function addRegistryMembers(
   sf: SourceFile,
   literal: ObjectLiteralExpression,
@@ -75,7 +109,7 @@ function addRegistryMembers(
       if (valueInit === undefined || valueInit.getKind() !== SyntaxKind.Identifier) continue;
       const nameNode = member.getNameNode();
       const key = Node.isComputedPropertyName(nameNode)
-        ? nameNode.getExpression().getText()
+        ? registryKeyFor(nameNode.getExpression())
         : Node.isStringLiteral(nameNode)
           ? nameNode.getLiteralValue()
           : member.getName();
@@ -292,11 +326,8 @@ function findComponentNameUsages(sf: SourceFile): { name: string; kind: MountKin
     if (prop.getName() !== "__component") continue;
     const init = prop.getInitializer();
     if (init === undefined) continue;
-    const name = Node.isStringLiteral(init)
-      ? init.getLiteralValue()
-      : Node.isIdentifier(init)
-        ? init.getText()
-        : undefined;
+    const name =
+      Node.isStringLiteral(init) || Node.isIdentifier(init) ? registryKeyFor(init) : undefined;
     if (name === undefined) continue;
     usages.push({ name, kind: mountKindFor(prop) });
   }

package/src/guard-no-inline-styles.ts

@@ -5,7 +5,13 @@
 // Part of App-Mounting 2.0 (infra#208).
 
 import { type SourceFile, SyntaxKind } from "ts-morph";
-import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import {
+  type AstGuard,
+  type GuardViolation,
+  relativeToCwd,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
 import { hasIgnoreTag } from "./_lib/ignore-tag";
 
 const SCAN: ScanSpec = {
@@ -30,7 +36,7 @@ export const guard: AstGuard = {
         if (attr.getNameNode().getText() !== "style") continue;
         if (hasIgnoreTag(attr, IGNORE_TAG)) continue;
         violations.push({
-          file: sf.getFilePath(),
+          file: relativeToCwd(sf.getFilePath()),
           line: attr.getStartLineNumber(),
           message: "style= prop in app code (use theme tokens/widgets)",
         });
@@ -45,7 +51,7 @@ export const guard: AstGuard = {
         if (name !== "CSSProperties" && name !== "React.CSSProperties") continue;
         if (hasIgnoreTag(ref, IGNORE_TAG)) continue;
         violations.push({
-          file: sf.getFilePath(),
+          file: relativeToCwd(sf.getFilePath()),
           line: ref.getStartLineNumber(),
           message: "CSSProperties style object in app code (use theme tokens/widgets)",
         });

package/src/guard-no-logic-in-views.ts

@@ -19,7 +19,13 @@ import {
   type SourceFile,
   SyntaxKind,
 } from "ts-morph";
-import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import {
+  type AstGuard,
+  type GuardViolation,
+  relativeToCwd,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
 import { hasIgnoreTag } from "./_lib/ignore-tag";
 
 const SCAN: ScanSpec = {
@@ -134,7 +140,7 @@ export const guard: AstGuard = {
         if (name === "" || !isViewLogic(name, fn)) continue;
         if (hasIgnoreTag(fn, IGNORE_TAG)) continue;
         violations.push({
-          file: sf.getFilePath(),
+          file: relativeToCwd(sf.getFilePath()),
           line: fn.getStartLineNumber(),
           message: `View logic "${name}" belongs in lib/ (with a test) — web/ only components/hooks`,
         });

package/src/guard-no-raw-hooks.ts

@@ -11,7 +11,13 @@
 // Part of App-Mounting 2.0 (infra#208).
 
 import { Node, type SourceFile, SyntaxKind } from "ts-morph";
-import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import {
+  type AstGuard,
+  type GuardViolation,
+  relativeToCwd,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
 import { hasIgnoreTag } from "./_lib/ignore-tag";
 
 // Match property/identifier names instead of call text — otherwise
@@ -40,7 +46,8 @@ export const guard: AstGuard = {
   name: "No-Raw-Hooks Guard (App-Repos)",
   scan: SCAN,
   hint:
-    "Use the framework hook set: useQuery (live: true for SSE), useMutation, useDisclosure. " +
+    "Use the framework hook set: useQuery (live: true for SSE), useMutation, useDisclosure, " +
+    "useReportStepComplete (wizard extension steps). " +
     `Real special case (DOM integration or similar): // ${IGNORE_TAG} <reason>`,
   run(files: readonly SourceFile[]) {
     const violations: GuardViolation[] = [];
@@ -52,7 +59,7 @@ export const guard: AstGuard = {
         if (BANNED_HOOKS.has(name)) {
           if (hasIgnoreTag(call, IGNORE_TAG)) continue;
           violations.push({
-            file: sf.getFilePath(),
+            file: relativeToCwd(sf.getFilePath()),
             line: call.getStartLineNumber(),
             message: `${name} in App-Screen — use framework hooks (useQuery/useMutation/useDisclosure)`,
           });
@@ -61,7 +68,7 @@ export const guard: AstGuard = {
         if (name === "fetch") {
           if (hasIgnoreTag(call, IGNORE_TAG)) continue;
           violations.push({
-            file: sf.getFilePath(),
+            file: relativeToCwd(sf.getFilePath()),
             line: call.getStartLineNumber(),
             message: "fetch() in App-Screen — use useQuery/useMutation or an API client (*.ts)",
           });

package/src/guard-primitives-discipline.ts

@@ -167,10 +167,11 @@ function walk(dir: string, out: string[]): void {
 }
 
 function buildTagPattern(tag: string): RegExp {
-  // Match `<tag` at the JSX opening: after whitespace, a paren, or >.
+  // Match `<tag` at the JSX opening: at line start or after a char that can't
+  // end an identifier/member access (`cond?<input/>:<div/>` hits, `Array<input` doesn't).
   // Negative lookahead `[a-zA-Z0-9-]` so `<input` doesn't match `<inputfoo`.
   // Doesn't match the closing tag (`</tag>`) — that would be redundant.
-  return new RegExp(`(^|[\\s(>{,;])<${tag}(?![a-zA-Z0-9-])`, "u");
+  return new RegExp(`(^|[^\\w$.])<${tag}(?![a-zA-Z0-9-])`, "u");
 }
 
 const TAG_PATTERNS = FORBIDDEN_TAGS.map((t) => ({ ...t, pattern: buildTagPattern(t.tag) }));

package/src/guard-raw-classname.ts

@@ -9,7 +9,13 @@
 // respective migration PR (ui-guards input in _app-test.yml).
 
 import { type JsxAttribute, type SourceFile, SyntaxKind } from "ts-morph";
-import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import {
+  type AstGuard,
+  type GuardViolation,
+  relativeToCwd,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
 import { hasIgnoreTag } from "./_lib/ignore-tag";
 
 const SCAN: ScanSpec = {
@@ -97,7 +103,7 @@ export const guard: AstGuard = {
           const bad = offendingTokens(part.text);
           if (bad.length === 0) continue;
           violations.push({
-            file: sf.getFilePath(),
+            file: relativeToCwd(sf.getFilePath()),
             line: part.line,
             message: `design-bearing Tailwind classes in app code: ${bad.join(", ")}`,
           });

package/src/guard-test-timeouts.ts

@@ -2,7 +2,8 @@
 /**
  * Guard: tests wait for a condition, not for time. Flags, in test files and
  * Playwright specs/helpers:
- *   (a) `test.setTimeout(...)`, `test.slow(...)` — raising a timeout hides the
+ *   (a) `test.setTimeout(...)`, `test.slow(...)`, `setDefaultTimeout(...)`,
+ *       `*.describe.configure({ timeout })` — raising a timeout hides the
  *       cause of a slow or flaky test
  *   (b) `<page>.waitForTimeout(...)` — a fixed sleep instead of a condition
  *   (c) sleep loops — a `while`/`do`/`for`/`for…of`/`for…in` whose body calls
@@ -67,6 +68,8 @@ const LOOP_LABELS: ReadonlyMap<SyntaxKind, string> = new Map([
 const SLEEP_CALLEES: ReadonlySet<string> = new Set(["sleep", "Bun.sleep"]);
 const TIMEOUT_RAISING_CALLEES: ReadonlySet<string> = new Set(["test.setTimeout", "test.slow"]);
 const SET_TIMEOUT_CALLEE = /(^|\.)setTimeout$/;
+const SET_DEFAULT_TIMEOUT_CALLEE = /(^|\.)setDefaultTimeout$/;
+const DESCRIBE_CONFIGURE_CALLEE = /(^|\.)describe\.configure$/;
 
 export interface Finding {
   file: string;
@@ -127,10 +130,26 @@ function exceptionNote(node: Node): "allowed" | "incomplete" | "none" {
   return nearby.some((text) => text.includes(EXCEPTION_TAG)) ? "incomplete" : "none";
 }
 
+function hasTimeoutProperty(node: Node | undefined): boolean {
+  return (
+    node !== undefined &&
+    Node.isObjectLiteralExpression(node) &&
+    node.getProperties().some((prop) => {
+      if (Node.isShorthandPropertyAssignment(prop) || Node.isPropertyAssignment(prop)) {
+        return prop.getName() === "timeout";
+      }
+      return false;
+    })
+  );
+}
+
 function raisedTimeoutReason(call: CallExpression): string | undefined {
   const callee = call.getExpression();
   const calleeText = callee.getText();
-  if (TIMEOUT_RAISING_CALLEES.has(calleeText)) {
+  if (TIMEOUT_RAISING_CALLEES.has(calleeText) || SET_DEFAULT_TIMEOUT_CALLEE.test(calleeText)) {
+    return `${calleeText}(…) raises the timeout instead of fixing the cause`;
+  }
+  if (DESCRIBE_CONFIGURE_CALLEE.test(calleeText) && call.getArguments().some(hasTimeoutProperty)) {
     return `${calleeText}(…) raises the timeout instead of fixing the cause`;
   }
   if (Node.isPropertyAccessExpression(callee) && callee.getName() === "waitForTimeout") {

package/src/guard-thin-wrappers.ts

@@ -39,7 +39,7 @@ import {
 } from "ts-morph";
 import { type RepoCheck, reportResults, runRepoChecks } from "./_lib/guard-kit";
 import { frameworkTsConfigPath } from "./_lib/roots";
-import { type ScanSpec, scanFiles, scanRoots } from "./_lib/scan-scope";
+import { keepsRootKind, type ScanSpec, scanFiles } from "./_lib/scan-scope";
 
 const ROOT = process.cwd();
 
@@ -387,7 +387,7 @@ export const check: RepoCheck = {
     // The kind filter (scan-scope.ts keepsRootKind) excludes "tooling" roots by
     // default — that's a deliberate scope choice, not a vacuous scan, so it must
     // report notApplicable instead of matchedFiles: 0.
-    if (scanRoots(SCAN, roots).length === 0) {
+    if (!roots.some((root) => keepsRootKind(SCAN, root))) {
       return { violations: [], matchedFiles: 0, notApplicable: true };
     }
 

package/src/pre-push.sh

@@ -123,7 +123,7 @@ fi
 # canonical sibling path instead of this worktree — checking the wrong
 # code. Run the worktree-local check only when scripts/check-wt.sh is
 # tracked and executable (untracked/symlink stubs must not hijack push).
-if [ "$(git rev-parse --git-dir)" != "$(git rev-parse --git-common-dir)" ] \
+if [ "$(git rev-parse --path-format=absolute --git-dir)" != "$GIT_COMMON_DIR" ] \
    && git -C "$REPO_ROOT" ls-files --error-unmatch scripts/check-wt.sh >/dev/null 2>&1 \
    && [ -x "$REPO_ROOT/scripts/check-wt.sh" ]; then
   echo "[pre-push] worktree detected — worktree check (see scripts/check-wt.sh)…"
@@ -153,7 +153,7 @@ run_guard_bin() {
 # worktree's own package.json scripts directly instead (only when nested
 # under the parent workspace; a standalone worktree's own `bun run test`
 # already checks the right code).
-if [ "$(git rev-parse --git-dir)" != "$(git rev-parse --git-common-dir)" ] \
+if [ "$(git rev-parse --path-format=absolute --git-dir)" != "$GIT_COMMON_DIR" ] \
    && [ -n "$PARENT_DIR" ]; then
   cd "$REPO_ROOT"
   echo "[pre-push] worktree without scripts/check-wt.sh — running this worktree's package.json scripts (typecheck, lint, test, test:dom) and guards (guards, checks, comment-lang)…"

package/src/run-guards.ts

@@ -121,6 +121,10 @@ export function runGuardsCli(argv: readonly string[], deps: RunGuardsCliDeps = {
     console.error(flagsError);
     return 1;
   }
+  if (guardNameArg !== undefined && !flags.includes("--write-baseline")) {
+    console.error("--guard=<name> is only valid with --write-baseline");
+    return 1;
+  }
   if (flags.includes("--explain")) {
     for (const line of explainGuards(GUARDS, buildSharedProject(GUARDS))) {
       console.log(line);