@cosmicdrift/kumiko-guards 0.337.1 → 0.339.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.337.1",
+  "version": "0.339.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.337.1",
+    "@cosmicdrift/kumiko-repo-manifest": "0.339.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/_lib/guard-kit.ts

@@ -12,12 +12,13 @@
  * kumiko.json manifest instead of hardcoded repo-kind globs.
  */
 
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { relative as pathRelative, resolve } from "node:path";
+import { existsSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { relative as pathRelative, resolve, sep } from "node:path";
 import { Project, type SourceFile } from "ts-morph";
 import { compareToBaseline, findRepoRootFor } from "./baseline-compare";
 import {
   explainRepoRoots,
+  findLocalRepo,
   frameworkTsConfigPath,
   type RepoRoot,
   type RootResolution,
@@ -62,6 +63,49 @@ export function isSecurityGuard(guard: Pick<AstGuard, "security">): boolean {
   return guard.security === true;
 }
 
+// Followers call the predicate per import hop; findLocalRepo re-reads
+// package.json and the manifest each time.
+const localRepoRootByCwd = new Map<string, string | undefined>();
+
+function localRepoRoot(): string | undefined {
+  const cwd = process.cwd();
+  if (!localRepoRootByCwd.has(cwd)) localRepoRootByCwd.set(cwd, findLocalRepo(cwd)?.absPath);
+  return localRepoRootByCwd.get(cwd);
+}
+
+function realOrResolved(path: string): string {
+  try {
+    return realpathSync(path);
+  } catch {
+    // In-memory test files and paths not on disk: compare as spelled.
+    return resolve(path);
+  }
+}
+
+/**
+ * True for a file outside the local repo's root — a neighbour repo of the
+ * parent workspace reached through a workspace symlink or a `../..` import. Such
+ * a file is as external as a package under node_modules: a guard may not scan it
+ * or follow imports into it, or a `.wt/<repo>` worktree reports findings that a
+ * fresh CI checkout (no parent workspace) never sees. The root comes from
+ * `findLocalRepo`, not a path heuristic; without a local repo nothing is
+ * decidable and nothing counts as outside.
+ */
+export function isOutsideRepoRoot(
+  filePath: string,
+  repoRoot: string | undefined = localRepoRoot(),
+): boolean {
+  if (repoRoot === undefined) return false;
+  const root = realOrResolved(repoRoot);
+  const file = realOrResolved(filePath);
+  return file !== root && !file.startsWith(root + sep);
+}
+
+/** Import followers stop at these: a package from node_modules or a file outside the repo root. */
+export function isExternalSourcePath(filePath: string): boolean {
+  return filePath.includes("/node_modules/") || isOutsideRepoRoot(filePath);
+}
+
 export function buildSharedProject(
   guards: readonly AstGuard[],
   roots: readonly RepoRoot[] = resolveRepoRoots(),
@@ -88,7 +132,7 @@ export function buildSharedProject(
         }
       }),
     ),
-  ];
+  ].filter((path) => roots.some((root) => !isOutsideRepoRoot(path, root.absPath)));
   // Exact paths, never re-glob: filenames like `[id].tsx` are literal here.
   for (const path of union) project.addSourceFileAtPath(path);
   return project;

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "fix",
+    "title": "Guards ignore neighbour repos of the parent workspace",
+    "detail": "The root comes from `findLocalRepo`, not a path heuristic. `isOutsideRepoRoot(filePath, repoRoot?)` compares real paths, so symlinks into a neighbour repo count as outside. `buildSharedProject` drops such files and `no-framed-extension-sections` stops following imports into them.",
+    "migration": "keine"
+  },
   {
     "version": "0.337.0",
     "type": "fix",

package/src/guard-no-framed-extension-sections.ts

@@ -41,7 +41,13 @@ import {
   SyntaxKind,
   VariableDeclarationKind,
 } from "ts-morph";
-import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import {
+  type AstGuard,
+  type GuardViolation,
+  isExternalSourcePath,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
 import { hasIgnoreTag } from "./_lib/ignore-tag";
 
 const ROOT = process.cwd();
@@ -58,11 +64,12 @@ const MAX_HOPS = 4;
 const FRAMED_TAG = /^(Card|SectionCard|CollapsibleSection)$/;
 
 // A vendored package's shipped .tsx source is still resolvable through
-// node_modules — treat it the same as a truly unresolvable specifier
+// node_modules, and in a parent workspace a workspace link resolves into a
+// neighbour repo — treat both the same as a truly unresolvable specifier
 // ("package component, checked inside the package itself"), not as a hop
 // into the App-Repo's own extension code.
 function isExternalSourceFile(sf: SourceFile): boolean {
-  return sf.getFilePath().includes("/node_modules/");
+  return isExternalSourcePath(sf.getFilePath());
 }
 
 function stringConstantValue(node: Node): string | undefined {