@cosmicdrift/kumiko-guards 0.370.0 → 0.371.1

package/hooks/pre-push

@@ -11,8 +11,9 @@ if [ -z "$REPO_ROOT" ]; then
   exit 1
 fi
 
-# Walk up to / so a worktree without its own node_modules resolves via the
-# parent install; `[ -x ]` also skips a broken (uninstalled) symlink.
+# Walk up so a worktree without its own node_modules resolves via the parent
+# install, but not past an enclosing repository: a bin above that boundary
+# belongs to another project. `[ -x ]` also skips a broken (uninstalled) symlink.
 BIN=""
 DIR="$REPO_ROOT"
 while true; do
@@ -24,6 +25,9 @@ while true; do
   if [ "$DIR" = "/" ]; then
     break
   fi
+  if [ "$DIR" != "$REPO_ROOT" ] && [ -e "$DIR/.git" ]; then
+    break
+  fi
   DIR="$(dirname "$DIR")"
 done
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.370.0",
+  "version": "0.371.1",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -28,7 +28,7 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.370.0",
+    "@cosmicdrift/kumiko-repo-manifest": "0.371.1",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/_lib/roots.ts

@@ -183,10 +183,25 @@ function isDerivedAppFallback(root: RepoRoot): boolean {
   return root.manifestSource === "derived" && root.kind === "app";
 }
 
+/** The repo of the nearest `kumiko.json` at or above `start`, which is the app root in a git tree that holds several. */
+function nearestManifestRepo(start: string): RepoRoot | undefined {
+  for (let curr = start; ; curr = dirname(curr)) {
+    if (existsSync(join(curr, REPO_MANIFEST_FILE))) {
+      const repo = repoAt(curr);
+      if (repo) return repo;
+    }
+    if (curr === dirname(curr)) return undefined;
+  }
+}
+
 /**
  * The repository `cwd` belongs to.
  *
- * Git first: `rev-parse --show-toplevel` is the checkout root from any
+ * A `kumiko.json` file wins over everything: the nearest one above `cwd` is the
+ * repo root even when the git checkout root lies further up (an app inside a
+ * larger checkout).
+ *
+ * Otherwise git first: `rev-parse --show-toplevel` is the checkout root from any
  * subdirectory, package or worktree, independent of folder names. The
  * package.json walk remains for non-git trees; there a derived-manifest "app"
  * candidate (no kumiko.json, just a bare `src/` layout) is only a fallback, so
@@ -195,6 +210,8 @@ function isDerivedAppFallback(root: RepoRoot): boolean {
  */
 export function findLocalRepo(cwd: string = process.cwd()): RepoRoot | undefined {
   const start = resolve(cwd);
+  const fromManifest = nearestManifestRepo(start);
+  if (fromManifest) return fromManifest;
   const toplevel = gitToplevelOf(start);
   const fromGit = toplevel !== undefined ? repoAt(toplevel) : undefined;
   if (fromGit) return fromGit;

package/src/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.371.0",
+    "type": "improvement",
+    "title": "test-timeouts guard flags hook timeouts and scans recipes",
+    "detail": "The test-timeouts guard now also fails on a timeout argument to beforeAll, beforeEach, afterAll and afterEach, as a number or as a { timeout } object, including renamed and namespace imports from bun:test. The samples/recipes exemption is gone, recipe tests and their e2e dirs are scanned like every other test. The kumiko.json of the framework repo scans tests under scripts and bin as well. There is no baseline."
+  },
+  {
+    "version": "0.371.0",
+    "type": "improvement",
+    "title": "import-extensions guard skips imports of build output",
+    "detail": "A relative specifier with a dist/ path segment, such as a published bin importing ../dist/cli.js, is no longer reported. The .js there is the only file that exists."
+  },
+  {
+    "version": "0.371.0",
+    "type": "improvement",
+    "title": "Pre-push shim stops at the repo boundary, nearest kumiko.json wins, process.env guard covers bin",
+    "detail": "The pre-push shim searches upward only through ancestors up to the git root and fails with a message when nothing is found. findLocalRepo prefers the nearest kumiko.json over the git root. guard-no-direct-process-env scans bin/**/*.ts including bin/ops."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/src/guard-import-extensions.ts

@@ -24,6 +24,9 @@ const SCAN: ScanSpec = {
 
 const EXCLUDE = /(\.d\.ts$|\/fixtures\/)/;
 const RELATIVE_JS_SPECIFIER = /^\.{1,2}\/.*\.jsx?$/;
+// A published bin that imports its own build output (`../dist/cli.js`) has no
+// `.ts` sibling to name; the `.js` there is the only file that exists.
+const BUILD_OUTPUT_SEGMENT = /(^|\/)dist\//;
 
 interface Finding {
   readonly line: number;
@@ -33,7 +36,8 @@ interface Finding {
 function relativeJsSpecifier(node: Node | undefined): string | undefined {
   const literal = node?.asKind(SyntaxKind.StringLiteral);
   const value = literal?.getLiteralValue();
-  return value !== undefined && RELATIVE_JS_SPECIFIER.test(value) ? value : undefined;
+  if (value === undefined || !RELATIVE_JS_SPECIFIER.test(value)) return undefined;
+  return BUILD_OUTPUT_SEGMENT.test(value) ? undefined : value;
 }
 
 function findJsSpecifiers(sf: SourceFile): Finding[] {

package/src/guard-no-direct-process-env.ts

@@ -5,7 +5,7 @@
  * Apps with composed env-schemas (`bin/env.ts`) must read runtime config from
  * the validated `env` export — not scattered `process.env.X` in prod paths.
  *
- * Scans bin/main.ts, other bin ts files (excl. allowlist), and src (excl. tests)
+ * Scans bin/main.ts, other bin ts files incl. subfolders such as bin/ops/ (excl. allowlist), and src (excl. tests)
  * in every repo that ships `bin/env.ts`. Allowed raw process.env:
  *   - bin/env.ts     — sole parseEnv input
  *   - bin/server.ts  — dev entrypoint (runDevApp)
@@ -21,9 +21,9 @@ import { scanLinesForPredicate } from "./_lib/scan-lines";
 // .tsx deliberately excluded — client screens have no runtime process.env
 // access (bundler boundary), only .ts server/bin code reads process.env
 // directly. Add .tsx here if that ever stops being true.
-const SCAN_PATTERNS: ReadonlyArray<string> = ["bin/*.ts", "src/**/*.ts"];
+const SCAN_PATTERNS: ReadonlyArray<string> = ["bin/**/*.ts", "src/**/*.ts"];
 
-/** bin/*.ts paths that may read process.env directly (see header). */
+/** bin ts paths that may read process.env directly (see header). */
 export const ALLOWED_BIN_FILES: ReadonlySet<string> = new Set([
   "bin/env.ts",
   "bin/server.ts",

package/src/guard-test-timeouts.ts

@@ -7,7 +7,9 @@
  *       `test`/`it`/`describe` calls (`test(name, fn, 30_000)`,
  *       `test(name, fn, { timeout })`, also via `.skip/.only/.if()/.each()()`
  *       and renamed/namespace `bun:test` imports) — raising a timeout hides
- *       the cause of a slow or flaky test
+ *       the cause of a slow or flaky test. The same holds for a timeout
+ *       argument on hooks (`beforeAll/beforeEach/afterAll/afterEach(fn, 60_000)`
+ *       or `(fn, { timeout })`).
  *   (b) `<page>.waitForTimeout(...)` — a fixed sleep instead of a condition
  *   (c) sleep loops — a `while`/`do`/`for`/`for…of`/`for…in` whose body calls
  *       `sleep(...)`/`Bun.sleep(...)` or awaits a `new Promise` that only
@@ -20,7 +22,7 @@
  * without an issue number or a reason does not count and is called out in
  * the message.
  *
- * `samples/recipes/**` is not touched. No baseline, no ratchet: any finding
+ * No baseline, no ratchet: any finding
  * fails. #3118's transition period (a `.kumiko-test-timeouts-baseline.json`
  * grandfathering pre-existing sleep loops) is over — every consumer must fix
  * or mark the cause, not accumulate a pinned count.
@@ -52,13 +54,13 @@ const SCAN: ScanSpec = {
     "packages/*/e2e/**/*.{ts,tsx}",
     "packages/*/src/e2e/**/*.{ts,tsx}",
     "samples/e2e/**/*.{ts,tsx}",
+    "samples/recipes/*/e2e/**/*.{ts,tsx}",
     "samples/apps/*/e2e/**/*.{ts,tsx}",
   ],
 };
 
 const EXCEPTION_TAG = "@timeout-exception";
 const COMPLETE_EXCEPTION = /@timeout-exception:\s*#\d+\s+\S/;
-const RECIPES_DIR = "/samples/recipes/";
 
 const LOOP_LABELS: ReadonlyMap<SyntaxKind, string> = new Map([
   [SyntaxKind.WhileStatement, "while"],
@@ -77,6 +79,8 @@ const TEST_FRAMEWORK_MODULES: ReadonlySet<string> = new Set(["bun:test", "@playw
 const TEST_DECLARATION_CALLEE =
   /^(test|it|describe)(\.(skip|only|todo|if|each|failing|concurrent|serial|skipIf|runIf|todoIf))*$/;
 
+const HOOK_DECLARATION_CALLEE = /^(beforeAll|beforeEach|afterAll|afterEach)$/;
+
 export interface Finding {
   file: string;
   line: number;
@@ -191,6 +195,11 @@ function declarationTimeoutReason(
   aliases: ReadonlyMap<string, string>,
 ): string | undefined {
   const base = canonicalCalleeText(declarationBaseCallee(call.getExpression()).getText(), aliases);
+  if (HOOK_DECLARATION_CALLEE.test(base)) {
+    const [, ...hookExtra] = call.getArguments();
+    if (!hookExtra.some(isTimeoutArgument)) return undefined;
+    return `${base}(…, timeout) raises the timeout instead of fixing the cause`;
+  }
   if (!TEST_DECLARATION_CALLEE.test(base)) return undefined;
   const [, , ...extra] = call.getArguments();
   if (!extra.some(isTimeoutArgument)) return undefined;
@@ -229,7 +238,6 @@ export function scanTimeouts(
   sf: SourceFile,
   roots: readonly RepoRoot[] = resolveRepoRoots(),
 ): Finding[] {
-  if (sf.getFilePath().includes(RECIPES_DIR)) return [];
   const file = relFile(sf, roots);
   const findings: Finding[] = [];
   const add = (node: Node, message: string): void => {