@cosmicdrift/kumiko-guards 0.336.1 → 0.338.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.336.1",
+  "version": "0.338.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.336.1",
+    "@cosmicdrift/kumiko-repo-manifest": "0.338.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "i18n-keys guard decodes escaped literals, framed-sections guard skips test usages, renderer-boundaries guard blocks bare fetch and reports all JSX tags per line, pre-push shim no longer execs binaries from shared ancestor dirs",
+    "detail": "The i18n-keys guard reads string literals with `getLiteralText()` so escaped keys match their definitions. The no-framed-extension-sections guard ignores test files when collecting component usages. The renderer-boundaries guard now also rejects a bare `fetch(` call in `packages/renderer/src`, and reports every JSX tag on a line. The `.husky/pre-push` shim only resolves `kumiko-pre-push` from the repo's own `node_modules` or the parent-workspace root, never from arbitrary ancestor directories."
+  },
   {
     "version": "0.336.0",
     "type": "improvement",

package/src/check-runtime-isolation.ts

@@ -187,8 +187,14 @@ export const check: RepoCheck = {
 
     const counts = countByKey(rootAbsPath, allViolations);
     const resolveLine = (key: string): number => {
-      const relFile = key.split("::")[0];
-      return allViolations.find((v) => path.relative(rootAbsPath, v.file) === relFile)?.line ?? 1;
+      const separator = key.indexOf("::");
+      const relFile = key.slice(0, separator);
+      const importedSpec = key.slice(separator + 2);
+      return (
+        allViolations.find(
+          (v) => path.relative(rootAbsPath, v.file) === relFile && v.importedSpec === importedSpec,
+        )?.line ?? 1
+      );
     };
     const violations: GuardViolation[] = ratchetFor(rootAbsPath).check(
       counts,

package/src/guard-i18n-keys.ts

@@ -71,7 +71,7 @@ function collectUsedKeys(sf: SourceFile): UsedKey[] {
       !first?.isKind(SyntaxKind.NoSubstitutionTemplateLiteral)
     )
       continue;
-    const literal = first.getText().slice(1, -1);
+    const literal = first.getLiteralText();
     if (!literal.includes(":")) continue;
     keys.push({
       key: literal,
@@ -90,7 +90,7 @@ function findEnclosingFeatureName(node: Node): string | null {
       if (call.getExpression().getText() === "defineFeature") {
         const first = call.getArguments()[0];
         if (first?.isKind(SyntaxKind.StringLiteral)) {
-          return first.getText().slice(1, -1);
+          return first.getLiteralText();
         }
       }
     }
@@ -108,7 +108,7 @@ function extractKeysFromTranslationsObject(
     const nameNode = prop.getNameNode();
     let keyName: string;
     if (nameNode.isKind(SyntaxKind.StringLiteral)) {
-      keyName = nameNode.getText().slice(1, -1);
+      keyName = nameNode.getLiteralText();
     } else if (nameNode.isKind(SyntaxKind.Identifier)) {
       keyName = nameNode.getText();
     } else continue;
@@ -119,8 +119,7 @@ function extractKeysFromTranslationsObject(
     for (const localeProp of initializer.getProperties()) {
       if (!localeProp.isKind(SyntaxKind.PropertyAssignment)) continue;
       const localeName = localeProp.getNameNode();
-      if (localeName.isKind(SyntaxKind.StringLiteral))
-        locales.add(localeName.getText().slice(1, -1));
+      if (localeName.isKind(SyntaxKind.StringLiteral)) locales.add(localeName.getLiteralText());
       else if (localeName.isKind(SyntaxKind.Identifier)) locales.add(localeName.getText());
     }
     out.push({ key: keyName, locales, line: prop.getStartLineNumber() });
@@ -148,7 +147,7 @@ function extractLocaleFirstKeys(
       if (!prop.isKind(SyntaxKind.PropertyAssignment)) continue;
       const nameNode = prop.getNameNode();
       if (nameNode.isKind(SyntaxKind.StringLiteral)) {
-        keySet.add(nameNode.getText().slice(1, -1));
+        keySet.add(nameNode.getLiteralText());
       }
     }
   }
@@ -160,7 +159,7 @@ function extractLocaleFirstKeys(
       const has = map.getProperties().some((prop) => {
         if (!prop.isKind(SyntaxKind.PropertyAssignment)) return false;
         const nameNode = prop.getNameNode();
-        return nameNode.isKind(SyntaxKind.StringLiteral) && nameNode.getText().slice(1, -1) === key;
+        return nameNode.isKind(SyntaxKind.StringLiteral) && nameNode.getLiteralText() === key;
       });
       if (has) locales.add(locale);
     }

package/src/guard-loadall-events.ts

@@ -19,7 +19,7 @@
  */
 
 import * as path from "node:path";
-import { type CallExpression, type Identifier, type SourceFile, SyntaxKind } from "ts-morph";
+import { type CallExpression, type SourceFile, SyntaxKind } from "ts-morph";
 import {
   type AstGuard,
   type GuardViolation,
@@ -88,7 +88,7 @@ export function collectViolations(sourceFile: SourceFile): Violation[] {
 function getCalleeName(call: CallExpression): string | null {
   const expr = call.getExpression();
   if (expr.getKind() === SyntaxKind.Identifier) {
-    return (expr as Identifier).getText();
+    return expr.getText();
   }
   if (expr.getKind() === SyntaxKind.PropertyAccessExpression) {
     return expr.asKindOrThrow(SyntaxKind.PropertyAccessExpression).getName();

package/src/guard-no-framed-extension-sections.ts

@@ -337,6 +337,7 @@ function findComponentNameUsages(sf: SourceFile): { name: string; kind: MountKin
 function buildUsageKindsByName(files: readonly SourceFile[]): Map<string, Set<MountKind>> {
   const byName = new Map<string, Set<MountKind>>();
   for (const sf of files) {
+    if (EXCLUDE.test(sf.getFilePath())) continue;
     for (const { name, kind } of findComponentNameUsages(sf)) {
       const kinds = byName.get(name) ?? new Set<MountKind>();
       kinds.add(kind);

package/src/guard-renderer-boundaries.ts

@@ -12,8 +12,8 @@
  * Checked:
  *   - Imports:  react-dom/*, jsdom, @cosmicdrift/kumiko-renderer-web, @cosmicdrift/kumiko-renderer-native
  *   - Symbols:  window., document., location., history., localStorage,
- *               sessionStorage, navigator., EventSource, fetch
- *               (bare — unqualified)
+ *               sessionStorage, navigator., EventSource, fetch(
+ *               (bare — unqualified), HTMLElement, createRoot
  *
  * __tests__ folders are excluded — tests mount in jsdom, that's expected.
  */
@@ -43,6 +43,7 @@ const FORBIDDEN_SYMBOLS = [
   /\bsessionStorage\b/,
   /\bnavigator\s*\./,
   /\bEventSource\b/,
+  /(?<![.\w])fetch\s*\(/,
   /\bHTMLElement\b/,
   /\bcreateRoot\b/,
 ];
@@ -56,7 +57,7 @@ const FORBIDDEN_SYMBOLS = [
 // Ignored: fragment `<>`, components `<Capitalized`, attribute values like
 // `<string>` in a type-annotation context (the regex only matches right
 // after whitespace/newline/>, not after an identifier character).
-const FORBIDDEN_JSX_TAG = /(^|\s|>|\()<([a-z][a-zA-Z0-9-]*)[\s/>]/;
+const FORBIDDEN_JSX_TAG = /(^|\s|>|\()<([a-z][a-zA-Z0-9-]*)(?=[\s/>])/g;
 
 type Violation = {
   readonly file: string;
@@ -113,8 +114,7 @@ export function findViolations(file: string, root: string): Violation[] {
         });
       }
     }
-    const jsxMatch = line.match(FORBIDDEN_JSX_TAG);
-    if (jsxMatch !== null) {
+    for (const jsxMatch of line.matchAll(FORBIDDEN_JSX_TAG)) {
       violations.push({
         file: path.relative(root, file),
         line: i + 1,

package/src/guard-upgrade-state.ts

@@ -126,9 +126,12 @@ export function resolveKumikoUpgradeBin(
   return Bun.which("kumiko-upgrade", { PATH: pathEnv }) ?? undefined;
 }
 
-async function runKumikoUpgrade(
+const KUMIKO_UPGRADE_TIMEOUT_MS = 120_000;
+
+export async function runKumikoUpgrade(
   version: string,
   cwd: string,
+  timeoutMs: number = KUMIKO_UPGRADE_TIMEOUT_MS,
 ): Promise<{ ok: true; json: UpgradeJson } | { ok: false; error: string }> {
   const binPath = resolveKumikoUpgradeBin(cwd);
   if (!binPath) {
@@ -142,14 +145,22 @@ async function runKumikoUpgrade(
     cmd: [binPath, "--from", version, "--json"],
     cwd,
     env: { ...process.env, INIT_CWD: cwd },
+    stdin: "ignore",
     stdout: "pipe",
     stderr: "pipe",
+    timeout: timeoutMs,
   });
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(proc.stdout).text(),
     new Response(proc.stderr).text(),
     proc.exited,
   ]);
+  if (proc.signalCode !== null) {
+    return {
+      ok: false,
+      error: `\`kumiko-upgrade --from ${version} --json\` timed out after ${timeoutMs} ms (killed by ${proc.signalCode})`,
+    };
+  }
   if (exitCode !== 0) {
     return {
       ok: false,

package/src/runtime-isolation-classify.ts

@@ -15,16 +15,15 @@ import { closeSync, existsSync, openSync, readFileSync, readSync } from "node:fs
 import * as path from "node:path";
 import type { ImportDeclaration, SourceFile } from "ts-morph";
 
-export type Runtime = "runtime" | "client" | "prod" | "dev" | "tooling" | "test";
+const RUNTIME_KINDS = ["runtime", "client", "prod", "dev", "tooling", "test"] as const;
 
-export const ALL_RUNTIMES: ReadonlySet<string> = new Set([
-  "runtime",
-  "client",
-  "prod",
-  "dev",
-  "tooling",
-  "test",
-]);
+export type Runtime = (typeof RUNTIME_KINDS)[number];
+
+export const ALL_RUNTIMES: ReadonlySet<string> = new Set(RUNTIME_KINDS);
+
+function isRuntime(value: unknown): value is Runtime {
+  return typeof value === "string" && ALL_RUNTIMES.has(value);
+}
 
 export const COMPAT: Record<Runtime, ReadonlySet<Runtime>> = {
   runtime: new Set(["runtime", "client", "prod"]),
@@ -284,7 +283,8 @@ export function classifyByDirective(
   if (head === null) return null;
   for (const line of head.split("\n").slice(0, DIRECTIVE_HEAD_LINES)) {
     const m = line.match(/\/\/\s*@runtime\s+(\w+)/);
-    if (m && ALL_RUNTIMES.has(m[1] ?? "")) return m[1] as Runtime;
+    const declared = m?.[1];
+    if (isRuntime(declared)) return declared;
   }
   return null;
 }
@@ -346,9 +346,11 @@ function readWorkspaceRuntime(dir: string, cache: Map<string, Runtime | null>):
   const pkgPath = path.join(dir, "package.json");
   let result: Runtime | null = null;
   try {
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-    const r = pkg.kumiko?.runtime;
-    if (typeof r === "string" && ALL_RUNTIMES.has(r)) result = r as Runtime;
+    const pkg: unknown = JSON.parse(readFileSync(pkgPath, "utf8"));
+    const kumiko = typeof pkg === "object" && pkg !== null && "kumiko" in pkg ? pkg.kumiko : null;
+    const declared =
+      typeof kumiko === "object" && kumiko !== null && "runtime" in kumiko ? kumiko.runtime : null;
+    if (isRuntime(declared)) result = declared;
   } catch {
     // package.json missing or unreadable — unmarked
   }