@cosmicdrift/kumiko-guards 0.353.0 → 0.354.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.353.0",
+  "version": "0.354.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.353.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.354.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/_lib/guard-kit.ts

@@ -32,7 +32,7 @@ import {
 } from "./security-baseline";
 
 export { type BaselineRegression, compareToBaseline, findRepoRootFor } from "./baseline-compare";
-export type { ScanExtension, ScanScope, ScanSpec } from "./scan-scope";
+export { ALL_REPO_KINDS, type ScanExtension, type ScanScope, type ScanSpec } from "./scan-scope";
 
 export type GuardViolation = {
   readonly file: string;

package/src/_lib/ignore-tag.ts

@@ -1,8 +1,25 @@
 import { type Node, SyntaxKind } from "ts-morph";
 
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** True when `line` carries `tag` (`<prefix> <slug>`), either alone or as one
+ *  entry of a comma-separated slug list: `// kumiko-lint-ignore a,b <reason>`. */
+export function lineHasIgnoreTag(line: string, tag: string): boolean {
+  if (line.includes(tag)) return true;
+  const slugStart = tag.lastIndexOf(" ");
+  if (slugStart < 0) return false;
+  const prefix = escapeRegExp(tag.slice(0, slugStart));
+  const slug = escapeRegExp(tag.slice(slugStart + 1));
+  return new RegExp(`${prefix}\\s+(?:[\\w-]+,)*${slug}(?=[\\s,]|$)`).test(line);
+}
+
 function lineHasTag(node: Node, line: number, tag: string): boolean {
   const lines = node.getSourceFile().getFullText().split("\n");
-  return (lines[line - 1] ?? "").includes(tag) || (lines[line - 2] ?? "").includes(tag);
+  return (
+    lineHasIgnoreTag(lines[line - 1] ?? "", tag) || lineHasIgnoreTag(lines[line - 2] ?? "", tag)
+  );
 }
 
 /** Inline allowlist convention: `// kumiko-lint-ignore <slug> <reason>` on the

package/src/_lib/scan-scope.ts

@@ -1,9 +1,12 @@
 import { realpathSync } from "node:fs";
 import { join, sep } from "node:path";
-import type { RepoKind } from "@cosmicdrift/kumiko-repo-manifest";
+import { type RepoKind, repoKindSchema } from "@cosmicdrift/kumiko-repo-manifest";
 import { Glob } from "bun";
 import type { RepoRoot } from "./roots";
 
+// Security-shaped guards name this explicitly: the default skips "tooling" roots, and a one-word manifest kind must not switch them off.
+export const ALL_REPO_KINDS: readonly RepoKind[] = repoKindSchema.options;
+
 export type ScanScope = "source" | "tests";
 export type ScanExtension = "ts" | "tsx";
 

package/src/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "improvement",
+    "title": "Real-Provider-Isolation guard allows real runs in schedule- or workflow_dispatch-only workflows",
+    "detail": "The Real-Provider-Isolation guard allows `test:real`, `e2e:real` and `KUMIKO_REAL_PROVIDERS` in CI workflows whose `on:` triggers are exclusively `schedule` and/or `workflow_dispatch`, so an app can run its real-provider suite weekly or by hand. Any other trigger next to them (`push`, `pull_request`, `pull_request_target`, `workflow_call`, ...) or a workflow without a parseable `on:` is still a violation."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "Security guards scan the tooling root, direct-fetch guard-allow needs a concrete reason, types postgres peer accepts the prerelease alias",
+    "detail": "Final review batch G: guards and tooling\nThe security guards (`direct-fetch`, `direct-entity-writes`, `tenant-escalation`, `unsafe-json-parse`, `html-escape`, `no-direct-fs`, `restricted-symbols`, `admin-api`, `access-denied-test`, `open-to-all-reason`, `escape-hatch-declared`) now scan a `tooling` root too. `direct-fetch` rejects a `guard-allow` marker without a specific reason. The `direct-entity-writes` canary also blocks when table declarations exist but write resolution finds nothing. `@cosmicdrift/kumiko-types` accepts the `postgres` prerelease alias in its peer range."
+  },
   {
     "version": "0.352.0",
     "type": "improvement",

package/src/check-complexity.ts

@@ -45,7 +45,7 @@ import {
   runStandalone,
   type ScanSpec,
 } from "./_lib/guard-kit";
-import { hasIgnoreTag } from "./_lib/ignore-tag";
+import { hasIgnoreTag, lineHasIgnoreTag } from "./_lib/ignore-tag";
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
 
 const ROOT = process.cwd();
@@ -111,7 +111,7 @@ function hasBudgetTag(fn: Node): boolean {
   const jsDocStartLine = fn.getStartLineNumber(true);
   if (jsDocStartLine === fn.getStartLineNumber()) return false;
   const lines = fn.getSourceFile().getFullText().split("\n");
-  return (lines[jsDocStartLine - 2] ?? "").includes(BUDGET_TAG);
+  return lineHasIgnoreTag(lines[jsDocStartLine - 2] ?? "", BUDGET_TAG);
 }
 
 export function computeComplexity(fn: Node): number {

package/src/check-real-provider-isolation.ts

@@ -3,15 +3,18 @@
  * Real-Provider-Isolation-Guard (stack-agnostisch, #3118).
  *
  * Real-provider specs (`*.real.test.ts`, `*.real.spec.ts`) hit live third-party
- * services and must only ever run manually, opt-in, via `bun run test:real` /
+ * services and must only ever run opt-in (manually or scheduled) via `bun run test:real` /
  * `bun run e2e:real` — never inside a default `bun test`/`playwright test`
- * glob and never inside CI (an accidental `KUMIKO_REAL_PROVIDERS=1` in a
+ * glob and never inside push/PR-triggered CI (an accidental `KUMIKO_REAL_PROVIDERS=1` in a
  * workflow spends real quota/credentials on every push).
  *
  * Flags:
  *   (a) any CI workflow (`.github/workflows/*.{yml,yaml}`) that references
- *       KUMIKO_REAL_PROVIDERS, `test:real`, or `e2e:real` — CI must never run
- *       real-provider tests, full stop, so any mention is a violation.
+ *       KUMIKO_REAL_PROVIDERS, `test:real`, or `e2e:real`, unless its `on:`
+ *       triggers are exclusively `schedule` and/or `workflow_dispatch`. A
+ *       scheduled or manually started real run spends quota at a known rate;
+ *       a push/pull_request (or reusable `workflow_call`) trigger would spend
+ *       it on every push, so those stay violations.
  *   (b) one of the template's own non-`real` bunfig files (`bunfig.toml`,
  *       `bunfig.integration.toml`, `bunfig.dom.toml` — see BUNFIG_FILES in
  *       packages/testing/src/bunfig.ts) whose pathIgnorePatterns doesn't
@@ -56,11 +59,35 @@ function ciWorkflowViolation(line: string): boolean {
   );
 }
 
+const COST_BOUNDED_TRIGGERS: ReadonlySet<string> = new Set(["schedule", "workflow_dispatch"]);
+
+function workflowTriggerNames(on: unknown): readonly string[] {
+  if (typeof on === "string") return [on];
+  if (Array.isArray(on)) return on.filter((entry): entry is string => typeof entry === "string");
+  if (on !== null && typeof on === "object") return Object.keys(on);
+  return [];
+}
+
+// Unparseable YAML or a missing `on:` falls through to the line scan (fail closed).
+function runsOnlyOnCostBoundedTriggers(workflowYaml: string): boolean {
+  let parsed: unknown;
+  try {
+    parsed = Bun.YAML.parse(workflowYaml);
+  } catch {
+    return false;
+  }
+  if (parsed === null || typeof parsed !== "object" || !("on" in parsed)) return false;
+  const triggers = workflowTriggerNames(parsed.on);
+  return triggers.length > 0 && triggers.every((name) => COST_BOUNDED_TRIGGERS.has(name));
+}
+
 function scanCiWorkflows(root: RepoRoot, findings: TextLineFinding[]): number {
   let scanned = 0;
   for (const rel of new Glob(CI_WORKFLOW_GLOB).scanSync({ cwd: root.absPath })) {
     scanned++;
-    scanLinesForPredicate(join(root.absPath, rel), rel, ciWorkflowViolation, findings);
+    const abs = join(root.absPath, rel);
+    if (runsOnlyOnCostBoundedTriggers(readFileSync(abs, "utf8"))) continue;
+    scanLinesForPredicate(abs, rel, ciWorkflowViolation, findings);
   }
   return scanned;
 }
@@ -173,7 +200,8 @@ export const check: RepoCheck = {
   name: "Real-Provider-Isolation Guard",
   hint:
     `Real-provider tests run only via \`bun run test:real\`/\`bun run e2e:real\`, ` +
-    `never in CI and never in a default test glob. Regenerate bunfig via ` +
+    `never in a push/pull_request-triggered CI workflow (schedule/workflow_dispatch only) ` +
+    `and never in a default test glob. Regenerate bunfig via ` +
     `\`kumiko-testing bunfig\` instead of hand-editing pathIgnorePatterns.`,
   async run(roots) {
     if (roots.length === 0) {

package/src/check-secret-literals.ts

@@ -27,6 +27,7 @@ import { join } from "node:path";
 import { Glob } from "bun";
 import { ts } from "ts-morph";
 import { type RepoCheck, reportResults, runRepoChecks } from "./_lib/guard-kit";
+import { lineHasIgnoreTag } from "./_lib/ignore-tag";
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
 
 // Server-side only: a declared sourceRoot under a mobile/client app has no server secrets to leak.
@@ -116,7 +117,8 @@ export function scanLinesForSecretLiterals(lines: readonly string[]): SecretLite
   for (let i = 0; i < lines.length; i++) {
     const raw = lines[i] ?? "";
     const code = maskedLines[i] ?? "";
-    if (raw.includes(IGNORE_TAG) || (lines[i - 1] ?? "").includes(IGNORE_TAG)) continue;
+    if (lineHasIgnoreTag(raw, IGNORE_TAG) || lineHasIgnoreTag(lines[i - 1] ?? "", IGNORE_TAG))
+      continue;
     // Every fallback on the line is inspected; the name is read only from the text since the
     // previous fallback, so an earlier assignee cannot lend its name to a later literal.
     let previousEnd = 0;

package/src/guard-access-denied-test.ts

@@ -19,7 +19,13 @@
 import * as path from "node:path";
 import { type SourceFile, SyntaxKind } from "ts-morph";
 import { findRepoRootFor } from "./_lib/baseline-compare";
-import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import {
+  ALL_REPO_KINDS,
+  type AstGuard,
+  type GuardViolation,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
 import {
   escapeRegExp,
   literalStringOf,
@@ -31,6 +37,7 @@ import { TEST_FILE_RE } from "./_lib/test-file";
 
 const ROOT = process.cwd();
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source+tests",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**", "samples/**"],

package/src/guard-admin-api.ts

@@ -22,12 +22,12 @@
 import * as path from "node:path";
 import { type CallExpression, type Identifier, type SourceFile, SyntaxKind } from "ts-morph";
 import { findRepoRootFor } from "./_lib/baseline-compare";
-import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import { ALL_REPO_KINDS, type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
 
 const ROOT = process.cwd();
 
-const SCAN: ScanSpec = { scope: "source", extensions: ["ts"] };
+const SCAN: ScanSpec = { kinds: ALL_REPO_KINDS, scope: "source", extensions: ["ts"] };
 
 // Test files may use the API freely — they are the primary verifiers.
 // App code is never shipped through tests.

package/src/guard-comment-lang.ts

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import { ts } from "ts-morph";
 import { gitEnv } from "./_lib/git-env";
 import { cliFlagsError, isLocalFinding } from "./_lib/guard-kit";
+import { lineHasIgnoreTag } from "./_lib/ignore-tag";
 import { resolveRepoRoots } from "./_lib/roots";
 import { type ScanSpec, scanFiles } from "./_lib/scan-scope";
 
@@ -71,7 +72,7 @@ export function scanGermanComments(fullText: string, file: string): Site[] {
       case ts.SyntaxKind.SingleLineCommentTrivia:
       case ts.SyntaxKind.MultiLineCommentTrivia: {
         const text = scanner.getTokenText();
-        if (!text.includes(IGNORE_TAG) && isGermanComment(text)) {
+        if (!lineHasIgnoreTag(text, IGNORE_TAG) && isGermanComment(text)) {
           const line = fullText.slice(0, scanner.getTokenStart()).split("\n").length;
           sites.push({
             file,

package/src/guard-cross-feature-imports.ts

@@ -40,6 +40,7 @@
 import * as path from "node:path";
 import type { SourceFile } from "ts-morph";
 import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import { lineHasIgnoreTag } from "./_lib/ignore-tag";
 
 const ROOT = process.cwd();
 
@@ -178,9 +179,9 @@ function isIgnored(sf: SourceFile, importLine: number): boolean {
   const text = sf.getFullText();
   const lines = text.split("\n");
   const onLine = lines[importLine - 1] ?? "";
-  if (onLine.includes(IGNORE_TAG)) return true;
+  if (lineHasIgnoreTag(onLine, IGNORE_TAG)) return true;
   const above = lines[importLine - 2] ?? "";
-  return above.trim().startsWith("//") && above.includes(IGNORE_TAG);
+  return above.trim().startsWith("//") && lineHasIgnoreTag(above, IGNORE_TAG);
 }
 
 function findCrossFeatureViolations(sf: SourceFile): Omit<Violation, "file">[] {

package/src/guard-direct-entity-writes.ts

@@ -51,11 +51,12 @@ import {
   type SourceFile,
   SyntaxKind,
 } from "ts-morph";
-import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import { ALL_REPO_KINDS, type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 
 const ROOT = process.cwd();
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**", "samples/**"],
@@ -323,11 +324,23 @@ function isTableWriteCall(call: CallExpression): boolean {
   );
 }
 
-function hasAnyTableWrite(files: readonly SourceFile[]): boolean {
+function isTableBuilderCall(call: CallExpression): boolean {
+  const callee = call.getExpression();
+  const calleeName =
+    callee.getKind() === SyntaxKind.PropertyAccessExpression
+      ? callee.asKindOrThrow(SyntaxKind.PropertyAccessExpression).getName()
+      : callee.getText();
+  return TABLE_BUILDER_NAMES.has(calleeName);
+}
+
+// Table declarations count as evidence too: when write resolution breaks
+// structurally (`tables.userTable`, re-exports) no write is recognised, but the
+// declarations are still visible, so the empty-set canary must not go green.
+function hasAnyTableWriteOrDeclaration(files: readonly SourceFile[]): boolean {
   for (const sf of files) {
     if (EXCLUDE.test(sf.getFilePath())) continue;
     for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-      if (isTableWriteCall(call)) return true;
+      if (isTableWriteCall(call) || isTableBuilderCall(call)) return true;
     }
   }
   return false;
@@ -399,14 +412,14 @@ export const guard: AstGuard = {
     if (esTables.size === 0) {
       // An empty set means either the repo has no event store at all, or the
       // scan lost the ES definitions while table writes are still present.
-      if (!hasAnyTableWrite(files)) return { violations: [] };
+      if (!hasAnyTableWriteOrDeclaration(files)) return { violations: [] };
       return {
         violations: [
           {
             file: "<scan>",
             line: 0,
             message:
-              "BLOCKED: guard found table writes but no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
+              "BLOCKED: guard found table writes or table declarations but no createEventStoreExecutor or r.entity projection tables — scan is probably misconfigured.",
           },
         ],
       };

package/src/guard-direct-fetch.ts

@@ -21,8 +21,9 @@
 
 import { relative as pathRelative } from "node:path";
 import { type CallExpression, type Node, type SourceFile, SyntaxKind } from "ts-morph";
-import { literalReasonText } from "./_lib/generic-reason";
+import { isGenericReason, literalReasonText } from "./_lib/generic-reason";
 import {
+  ALL_REPO_KINDS,
   type AstGuard,
   findRepoRootFor,
   isAllowlisted,
@@ -33,6 +34,7 @@ import {
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**", "samples/**"],
@@ -57,12 +59,20 @@ interface Violation {
 // `const self = this` binding was a systematic FP (infra#582).
 const GLOBAL_FETCH_RECEIVERS = new Set(["globalThis", "window"]);
 
-function hasAllowMarker(sf: SourceFile, line: number): boolean {
+// The marker is a per-line skip for a security guard, so it only counts with a
+// non-generic reason after it — a bare marker still reports the finding.
+function hasAllowMarkerWithReason(sf: SourceFile, line: number): boolean {
   const lines = sf.getFullText().split("\n");
   const idx = line - 1;
-  const cur = lines[idx] ?? "";
-  const prev = lines[idx - 1] ?? "";
-  return cur.includes(ALLOW_MARKER) || prev.includes(ALLOW_MARKER);
+  return [lines[idx] ?? "", lines[idx - 1] ?? ""].some((text) => {
+    const markerAt = text.indexOf(ALLOW_MARKER);
+    if (markerAt < 0) return false;
+    const reason = text
+      .slice(markerAt + ALLOW_MARKER.length)
+      .replace(/^\s*(?:—|–|-|:)\s*/, "")
+      .trim();
+    return !isGenericReason(reason);
+  });
 }
 
 /** Same-origin path literal (`"/api/..."`, '`/demo`') — not an SSRF risk. */
@@ -117,7 +127,7 @@ export const guard: AstGuard = {
   security: true,
   hint:
     "Replace raw fetch(...) with egress(policy)(...) from @cosmicdrift/kumiko-framework/http (framework#2147). " +
-    'Same-origin path literal (`"/api/..."`) is allowed; otherwise put `// guard-allow: same-origin fetch` on the line above. ' +
+    'Same-origin path literal (`"/api/..."`) is allowed; otherwise put `// guard-allow: same-origin fetch — <specific reason>` on the line above (a bare marker does not count). ' +
     "Local bindings named fetch are flagged (false positive — unblock via that marker). " +
     'Known gap: bracket access (globalThis["fetch"](...)).',
   run(files, roots: readonly RepoRoot[] = resolveRepoRoots()) {
@@ -132,7 +142,7 @@ export const guard: AstGuard = {
         root === undefined ? undefined : `${root.name}/${pathRelative(root.absPath, file)}`;
       if (key !== undefined && isAllowlisted(key, ALLOWLIST)) continue;
       for (const v of findRawFetchCalls(sf)) {
-        if (hasAllowMarker(sf, v.line)) continue;
+        if (hasAllowMarkerWithReason(sf, v.line)) continue;
         violations.push({
           // cwd-relative, not repo-relative `rel` — the security baseline
           // needs an unambiguous path to resolve back to (repo, relPath).

package/src/guard-escape-hatch-declared.ts

@@ -82,9 +82,16 @@ import {
 } from "ts-morph";
 import { isFrameworkImportOf } from "./_lib/framework-import";
 import { isGenericReason, resolveReasonText } from "./_lib/generic-reason";
-import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import {
+  ALL_REPO_KINDS,
+  type AstGuard,
+  type GuardViolation,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**", "samples/**"],

package/src/guard-html-escape.ts

@@ -42,11 +42,12 @@ import {
   type TemplateExpression,
   type Type,
 } from "ts-morph";
-import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import { ALL_REPO_KINDS, type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 
 const ROOT = process.cwd();
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source",
   extensions: ["ts", "tsx"],
   frameworkWithin: ["packages/*/src/**"],

package/src/guard-no-direct-fs.ts

@@ -38,6 +38,7 @@ import { existsSync } from "node:fs";
 import { join, relative as pathRelative } from "node:path";
 import { Node, type SourceFile, SyntaxKind } from "ts-morph";
 import {
+  ALL_REPO_KINDS,
   type AstGuard,
   baselineRatchet,
   findRepoRootFor,
@@ -49,6 +50,7 @@ import {
 import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**", "samples/**"],

package/src/guard-open-to-all-reason.ts

@@ -17,9 +17,16 @@
 import * as path from "node:path";
 import { type SourceFile, SyntaxKind } from "ts-morph";
 import { isGenericReason, literalReasonText } from "./_lib/generic-reason";
-import { type AstGuard, type GuardViolation, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import {
+  ALL_REPO_KINDS,
+  type AstGuard,
+  type GuardViolation,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**", "samples/**"],

package/src/guard-primitives-discipline.ts

@@ -39,6 +39,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { type RepoCheck, reportResults, runRepoChecks } from "./_lib/guard-kit";
+import { lineHasIgnoreTag } from "./_lib/ignore-tag";
 import { isFlatSrcLayout, type RepoRoot, sourceRootDirs } from "./_lib/roots";
 
 const FORBIDDEN_TAGS: ReadonlyArray<{
@@ -201,7 +202,7 @@ function isPublicPage(file: string): boolean {
 }
 
 function hasIgnore(currentLine: string, prevLine: string): boolean {
-  return currentLine.includes(IGNORE_TAG) || prevLine.includes(IGNORE_TAG);
+  return lineHasIgnoreTag(currentLine, IGNORE_TAG) || lineHasIgnoreTag(prevLine, IGNORE_TAG);
 }
 
 export function checkFile(

package/src/guard-restricted-symbols.ts

@@ -17,6 +17,7 @@
 
 import { type SourceFile, SyntaxKind } from "ts-morph";
 import {
+  ALL_REPO_KINDS,
   type AstGuard,
   isAllowlisted,
   relFromRepoRoot,
@@ -26,6 +27,7 @@ import {
 import { resolveRepoRoots } from "./_lib/roots";
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**", "samples/**"],

package/src/guard-tenant-escalation.ts

@@ -45,13 +45,14 @@
 
 import * as path from "node:path";
 import { type Node, type SourceFile, SyntaxKind } from "ts-morph";
-import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import { ALL_REPO_KINDS, type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 import { literalStringOf, mentionsAsWord, nameForms } from "./_lib/handler-name-forms";
 import { TEST_FILE_RE } from "./_lib/test-file";
 
 const ROOT = process.cwd();
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source+tests",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**", "samples/**"],

package/src/guard-unsafe-json-parse.ts

@@ -11,11 +11,12 @@
 
 import * as path from "node:path";
 import { type Node, type SourceFile, SyntaxKind } from "ts-morph";
-import { type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
+import { ALL_REPO_KINDS, type AstGuard, runStandalone, type ScanSpec } from "./_lib/guard-kit";
 
 const ROOT = process.cwd();
 
 const SCAN: ScanSpec = {
+  kinds: ALL_REPO_KINDS,
   scope: "source",
   extensions: ["ts"],
   frameworkWithin: ["packages/*/src/**"],