@cosmicdrift/kumiko-guards 0.360.0 → 0.361.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.360.0",
+  "version": "0.361.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.360.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.361.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/_lib/push-root.ts

@@ -0,0 +1,25 @@
+import { basename } from "node:path";
+import { findLocalRepo, localRepoDirName } from "./roots";
+
+// A worktree's folder name proves nothing (`kumiko-*` siblings share prefixes), so it is judged by its canonical checkout's directory name.
+function pushRootMatchesCliScope(pushRepoRoot: string, cliScope: string): boolean {
+  if (basename(pushRepoRoot) === cliScope) return true;
+  const local = findLocalRepo(pushRepoRoot);
+  return local !== undefined && (local.name === cliScope || localRepoDirName(local) === cliScope);
+}
+
+// A push root left over from an earlier hook run or a debug session must not redirect a guard at the wrong repo, so it only counts when KUMIKO_CLI_SCOPE names it.
+export function resolvePushRepoRoot(
+  vars: Readonly<Record<string, string | undefined>>,
+): string | undefined {
+  const cliScope = vars["KUMIKO_CLI_SCOPE"]?.trim();
+  const pushRepoRoot = vars["KUMIKO_PUSH_REPO_ROOT"]?.trim();
+  if (!cliScope || !pushRepoRoot) return undefined;
+  if (!pushRootMatchesCliScope(pushRepoRoot, cliScope)) {
+    console.error(
+      `[push-root] KUMIKO_PUSH_REPO_ROOT="${pushRepoRoot}" does not match KUMIKO_CLI_SCOPE="${cliScope}" — ignoring inherited/stale push root.`,
+    );
+    return undefined;
+  }
+  return pushRepoRoot;
+}

package/src/_lib/roots.ts

@@ -9,7 +9,7 @@
  */
 import { execFileSync } from "node:child_process";
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import {
   type LoadedRepoManifest,
   loadRepoManifest,
@@ -115,6 +115,23 @@ function gitToplevelOf(cwd: string): string | undefined {
   return spelled;
 }
 
+/**
+ * The main checkout of the repo containing `from`, independent of what a linked
+ * worktree's folder is called. Undefined when git cannot answer or the common
+ * dir is not a `<repo>/.git`.
+ */
+function canonicalCheckoutOf(from: string): string | undefined {
+  const commonDir = git(from, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  if (commonDir === undefined || basename(commonDir) !== ".git") return undefined;
+  const checkout = dirname(commonDir);
+  return existsSync(checkout) ? checkout : undefined;
+}
+
+/** Directory name of the repo's canonical checkout; `local.name` when git names none. */
+export function localRepoDirName(local: RepoRoot): string {
+  return basename(canonicalCheckoutOf(local.absPath) ?? local.name);
+}
+
 function rootFrom(name: string, dir: string, loaded: LoadedRepoManifest): RepoRoot {
   return {
     name,

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.361.0",
+    "type": "fix",
+    "title": "comment-lang guard scans tooling repos, handles division before a comment and ignores a stale KUMIKO_PUSH_REPO_ROOT",
+    "detail": "comment-lang scans tooling repos, no longer rescans a division as a regex literal, and honours KUMIKO_PUSH_REPO_ROOT only when KUMIKO_CLI_SCOPE names that checkout. The scan-scope helpers scanFiles and scanRoots are exported."
+  },
   {
     "version": "0.360.0",
     "type": "fix",

package/src/guard-comment-lang.ts

@@ -2,8 +2,9 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
 import { ts } from "ts-morph";
 import { gitEnv } from "./_lib/git-env";
-import { cliFlagsError, isLocalFinding } from "./_lib/guard-kit";
+import { ALL_REPO_KINDS, cliFlagsError, isLocalFinding } from "./_lib/guard-kit";
 import { lineHasIgnoreTag } from "./_lib/ignore-tag";
+import { resolvePushRepoRoot } from "./_lib/push-root";
 import { resolveRepoRoots } from "./_lib/roots";
 import { type ScanSpec, scanFiles } from "./_lib/scan-scope";
 
@@ -28,6 +29,7 @@ const IGNORE_TAG = "kumiko-lint-ignore comment-lang";
 
 const SCAN: ScanSpec = {
   scope: "source",
+  kinds: ALL_REPO_KINDS,
   extensions: ["ts", "tsx"],
   frameworkWithin: ["packages/*/src/**"],
 };
@@ -66,6 +68,48 @@ function germanCommentSite(
   };
 }
 
+// After these tokens a `/` is division, not the start of a regex literal.
+const DIVISION_PRECEDING_KINDS: ReadonlySet<ts.SyntaxKind> = new Set([
+  ts.SyntaxKind.Identifier,
+  ts.SyntaxKind.ThisKeyword,
+  ts.SyntaxKind.TrueKeyword,
+  ts.SyntaxKind.FalseKeyword,
+  ts.SyntaxKind.NullKeyword,
+  ts.SyntaxKind.NumericLiteral,
+  ts.SyntaxKind.BigIntLiteral,
+  ts.SyntaxKind.StringLiteral,
+  ts.SyntaxKind.NoSubstitutionTemplateLiteral,
+  ts.SyntaxKind.TemplateTail,
+  ts.SyntaxKind.RegularExpressionLiteral,
+  ts.SyntaxKind.CloseParenToken,
+  ts.SyntaxKind.CloseBracketToken,
+  ts.SyntaxKind.CloseBraceToken,
+  ts.SyntaxKind.PlusPlusToken,
+  ts.SyntaxKind.MinusMinusToken,
+]);
+
+const TRIVIA_KINDS: ReadonlySet<ts.SyntaxKind> = new Set([
+  ts.SyntaxKind.SingleLineCommentTrivia,
+  ts.SyntaxKind.MultiLineCommentTrivia,
+  ts.SyntaxKind.WhitespaceTrivia,
+  ts.SyntaxKind.NewLineTrivia,
+]);
+
+// The raw scanner always yields SlashToken for `/`; without the rescan a regex
+// body like /\{/ would shift braceDepth and end a template early. After an
+// operand the rescan would instead swallow `/ 2; // {` as a regex and hide the comment.
+function rescanSlashAsRegex(
+  scanner: ts.Scanner,
+  kind: ts.SyntaxKind,
+  previousSignificant: ts.SyntaxKind | undefined,
+): ts.SyntaxKind {
+  if (previousSignificant !== undefined && DIVISION_PRECEDING_KINDS.has(previousSignificant)) {
+    return kind;
+  }
+  const reScanned = scanner.reScanSlashToken();
+  return reScanned === ts.SyntaxKind.RegularExpressionLiteral ? reScanned : kind;
+}
+
 function closesTemplateSubstitution(
   templateBraceDepths: readonly number[],
   braceDepth: number,
@@ -91,6 +135,7 @@ export function scanGermanComments(fullText: string, file: string): Site[] {
 
   const templateBraceDepths: number[] = [];
   let braceDepth = 0;
+  let previousSignificant: ts.SyntaxKind | undefined;
 
   let kind = scanner.scan();
   while (kind !== ts.SyntaxKind.EndOfFileToken) {
@@ -107,13 +152,9 @@ export function scanGermanComments(fullText: string, file: string): Site[] {
         break;
       }
       case ts.SyntaxKind.SlashToken:
-      case ts.SyntaxKind.SlashEqualsToken: {
-        // The raw scanner always yields SlashToken for `/`; without the rescan a
-        // regex body like /\{/ would shift braceDepth and end a template early.
-        const reScanned = scanner.reScanSlashToken();
-        if (reScanned === ts.SyntaxKind.RegularExpressionLiteral) kind = reScanned;
+      case ts.SyntaxKind.SlashEqualsToken:
+        kind = rescanSlashAsRegex(scanner, kind, previousSignificant);
         break;
-      }
       case ts.SyntaxKind.TemplateHead:
       case ts.SyntaxKind.TemplateMiddle:
         templateBraceDepths.push(braceDepth);
@@ -132,6 +173,7 @@ export function scanGermanComments(fullText: string, file: string): Site[] {
       default:
         break;
     }
+    if (!TRIVIA_KINDS.has(kind)) previousSignificant = kind;
     kind = scanner.scan();
   }
   return sites;
@@ -422,7 +464,7 @@ export function runCommentLangCli(
     return 1;
   }
 
-  const pushRoot = env["KUMIKO_PUSH_REPO_ROOT"];
+  const pushRoot = resolvePushRepoRoot(env);
   const root = pushRoot && existsSync(pushRoot) ? pushRoot : cwd;
 
   try {

package/src/index.ts

@@ -21,6 +21,7 @@ export {
   type SuiteInventory,
 } from "./_lib/guard-kit";
 export { findLocalRepo, type RepoRoot, resolveRepoRoots } from "./_lib/roots";
+export { type RootScan, type ScanOptions, scanFiles, scanRoots } from "./_lib/scan-scope";
 export {
   loadSecurityBaseline,
   parseSecurityBaseline,