@cosmicdrift/kumiko-guards 0.374.0 → 0.378.0

package/README.md

@@ -67,16 +67,18 @@ drops it.
 A POSIX-sh pre-push hook, wired by copying the package's `hooks/pre-push`
 shim to `.husky/pre-push`. The shim execs the nearest executable
 `node_modules/.bin/kumiko-pre-push` from the repo root upwards (so worktrees
-without their own `node_modules` resolve via the parent install) and fails
-closed with a `bun install` / `PRE_PUSH_SKIP=1` hint when none exists. Inside
+without their own `node_modules` resolve via the parent install, up to and
+including `$HOME`, skipping ancestors owned by another user or writable by
+group/others) and fails closed with a `bun install` hint when none exists. Inside
 the cosmicdriftgamestudio parent workspace it runs a scoped `bun check` for
 the pushing repo only; in a standalone clone it runs the repo's own
 `package.json` `test` script. From a `.wt/<name>` worktree under the parent
 workspace it runs a tracked `scripts/check-wt.sh` if present, otherwise the
 worktree's own `package.json` scripts `typecheck`, `lint`, `test`, and
 `test:dom` (whichever are declared), directly in the worktree — the parent's
-`bun check` would otherwise check the main checkout instead. Set
-`PRE_PUSH_SKIP=1` to bypass.
+`bun check` would otherwise check the main checkout instead. There is no
+bypass switch. A `check-wt.sh` that wraps this hook sets `KUMIKO_CHECK_WT=1`
+so the hook does not call it again.
 
 Extension point: a tracked, executable `scripts/pre-push-extra.sh` runs
 before the main check in every branch (worktree, parent-scoped, and

package/hooks/pre-push

@@ -1,10 +1,4 @@
 #!/usr/bin/env sh
-# PRE_PUSH_SKIP is checked here too so the bypass works even without node_modules.
-if [ "${PRE_PUSH_SKIP:-0}" = "1" ]; then
-  echo "[pre-push] PRE_PUSH_SKIP=1 — hook skipped"
-  exit 0
-fi
-
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 if [ -z "$REPO_ROOT" ]; then
   echo "[pre-push] FATAL: git rev-parse --show-toplevel failed — refusing push" >&2
@@ -14,15 +8,35 @@ fi
 # Walk up so a worktree without its own node_modules resolves via the parent
 # install, but not past an enclosing repository: a bin above that boundary
 # belongs to another project. `[ -x ]` also skips a broken (uninstalled) symlink.
+# A bin in an ancestor that is owned by someone else or group/world-writable
+# (/tmp, /Users/Shared) is attacker-plantable and must never be exec'd, and
+# $HOME is the upper trust boundary (inclusive), compared by physical path
+# because git prints REPO_ROOT resolved: a trailing slash or a symlinked home
+# would otherwise never match and the walk would continue to /.
+HOME_BOUND=""
+if [ -n "$HOME" ] && [ -d "$HOME" ]; then
+  HOME_BOUND="$(cd "$HOME" 2>/dev/null && pwd -P)"
+fi
 BIN=""
 DIR="$REPO_ROOT"
 while true; do
-  CANDIDATE="$DIR/node_modules/.bin/kumiko-pre-push"
-  if [ -x "$CANDIDATE" ]; then
-    BIN="$CANDIDATE"
-    break
+  TRUSTED=1
+  if [ "$DIR" != "$REPO_ROOT" ]; then
+    if [ ! -O "$DIR" ] || [ -n "$(find "$DIR" -maxdepth 0 \( -perm -0020 -o -perm -0002 \) -print 2>/dev/null)" ]; then
+      TRUSTED=0
+    fi
+  fi
+  if [ "$TRUSTED" = 1 ]; then
+    BIN_DIR="$DIR/node_modules/.bin"
+    CANDIDATE="$BIN_DIR/kumiko-pre-push"
+    # The bin dir itself must be user-owned and not group/world-writable, or a
+    # planted entry could replace the real bin.
+    if [ -x "$CANDIDATE" ] && [ -O "$BIN_DIR" ] && [ -z "$(find "$BIN_DIR" -maxdepth 0 \( -perm -0020 -o -perm -0002 \) -print 2>/dev/null)" ]; then
+      BIN="$CANDIDATE"
+      break
+    fi
   fi
-  if [ "$DIR" = "/" ]; then
+  if [ "$DIR" = "/" ] || { [ -n "$HOME_BOUND" ] && [ "$DIR" = "$HOME_BOUND" ]; }; then
     break
   fi
   if [ "$DIR" != "$REPO_ROOT" ] && [ -e "$DIR/.git" ]; then
@@ -33,7 +47,7 @@ done
 
 if [ -z "$BIN" ]; then
   echo "[pre-push] kumiko-pre-push not found in any node_modules/.bin above $REPO_ROOT." >&2
-  echo "Run \`bun install\`, or set PRE_PUSH_SKIP=1 to bypass this hook." >&2
+  echo "Run \`bun install\`." >&2
   exit 1
 fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.374.0",
+  "version": "0.378.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -21,6 +21,14 @@
     ".": {
       "types": "./src/index.ts",
       "default": "./src/index.ts"
+    },
+    "./repo-manifest": {
+      "types": "./src/repo-manifest/index.ts",
+      "default": "./src/repo-manifest/index.ts"
+    },
+    "./repo-manifest/app-ports": {
+      "types": "./src/repo-manifest/app-ports/index.ts",
+      "default": "./src/repo-manifest/app-ports/index.ts"
     }
   },
   "bin": {
@@ -28,8 +36,8 @@
     "kumiko-pre-push": "./src/pre-push.sh"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-repo-manifest": "0.374.0",
-    "ts-morph": "^28.0.0"
+    "ts-morph": "^28.0.0",
+    "zod": "^4.4.3"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -41,5 +49,16 @@
     "hooks",
     "README.md",
     "LICENSE"
-  ]
+  ],
+  "peerDependencies": {
+    "@cosmicdrift/kumiko-framework": ">=0.366.0 <1.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@cosmicdrift/kumiko-framework": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@cosmicdrift/kumiko-framework": "0.378.0"
+  }
 }

package/src/_lib/agent-docs.ts

@@ -14,7 +14,7 @@ import { type ExportedDeclarations, type JSDocableNode, Node, Project, ts } from
 export const AGENT_DOCS_DIR = "packages/framework/agents";
 
 const FEATURE_MANIFEST_REL = "samples/apps/use-all-bundled/feature-manifest.json";
-const RENDERER_WEB_INDEX_REL = "packages/renderer-web/src/index.ts";
+const RENDERER_WEB_INDEX_REL = "packages/renderer/src/web/index.ts";
 const RECIPES_REL = "samples/recipes";
 const RECIPE_SLUG_RE = /^[a-z0-9-]+$/;
 const SOURCE_EXTENSIONS = [".ts", ".tsx"];
@@ -286,7 +286,7 @@ function renderWidgets(repoRoot: string): string {
     const rows = entries.map(([name, description]) => [`\`${name}\``, description]);
     sections.push(`## ${group}\n\n${table(["Name", "Description"], rows)}`);
   }
-  const intro = "Value exports of `@cosmicdrift/kumiko-renderer-web`.";
+  const intro = "Value exports of `@cosmicdrift/kumiko-renderer/web`.";
   return finishFile(RENDERER_WEB_INDEX_REL, `# Widgets\n\n${intro}\n\n${sections.join("\n\n")}`);
 }
 

package/src/_lib/primitives-access.ts

@@ -1,16 +1,20 @@
 import type { SourceFile } from "ts-morph";
 
-const RENDERER_WEB_MODULE = "@cosmicdrift/kumiko-renderer-web";
+const RENDERER_WEB_MODULES: ReadonlySet<string> = new Set([
+  "@cosmicdrift/kumiko-renderer/web",
+  "@cosmicdrift/kumiko-renderer-web",
+]);
 
 // Shared by every "raw HTML tag instead of framework primitive" guard
 // (guard-no-custom-primitives, guard-raw-interactive-elements): proves the
 // primitive set was reachable in this file — either an import from
-// @cosmicdrift/kumiko-renderer-web (any symbol), or a `usePrimitives` named
-// import, which lives in @cosmicdrift/kumiko-renderer (headless layer), not
-// only in -web (see kumiko-enterprise/packages/ai-agent/src/web/turn-cards.tsx).
+// @cosmicdrift/kumiko-renderer/web (any symbol; the deprecated
+// @cosmicdrift/kumiko-renderer-web shim counts too), or a `usePrimitives`
+// named import, which lives in the shared layer of @cosmicdrift/kumiko-renderer,
+// not only in /web (see kumiko-enterprise/packages/ai-agent/src/web/turn-cards.tsx).
 export function hasPrimitivesAccess(sf: SourceFile): boolean {
   for (const imp of sf.getImportDeclarations()) {
-    if (imp.getModuleSpecifierValue() === RENDERER_WEB_MODULE) return true;
+    if (RENDERER_WEB_MODULES.has(imp.getModuleSpecifierValue())) return true;
     if (imp.getNamedImports().some((named) => named.getName() === "usePrimitives")) {
       return true;
     }

package/src/_lib/roots.ts

@@ -17,12 +17,12 @@ import {
   type RepoManifest,
   RepoManifestError,
   type RepoManifestSource,
-} from "@cosmicdrift/kumiko-repo-manifest";
+} from "../repo-manifest/index.ts";
 import { gitEnv } from "./git-env";
 
-export type { RepoKind } from "@cosmicdrift/kumiko-repo-manifest";
+export type { RepoKind } from "../repo-manifest/index.ts";
 
-import type { RepoKind } from "@cosmicdrift/kumiko-repo-manifest";
+import type { RepoKind } from "../repo-manifest/index.ts";
 
 // Worktrees (`.wt/kumiko-framework-*`) keep this package name, so it is stable across checkouts.
 const FRAMEWORK_PACKAGE_NAME = "kumiko-framework";

package/src/_lib/scan-scope.ts

@@ -1,7 +1,7 @@
 import { realpathSync } from "node:fs";
 import { join, sep } from "node:path";
-import { type RepoKind, repoKindSchema } from "@cosmicdrift/kumiko-repo-manifest";
 import { Glob } from "bun";
+import { type RepoKind, repoKindSchema } from "../repo-manifest/index.ts";
 import type { RepoRoot } from "./roots";
 
 // Security-shaped guards name this explicitly: the default skips "tooling" roots, and a one-word manifest kind must not switch them off.

package/src/changes.json

@@ -1,4 +1,66 @@
 [
+  {
+    "version": "0.378.0",
+    "type": "fix",
+    "title": "Direct-entity-writes guard catches imported event-store tables",
+    "detail": "Table identifiers are resolved through import aliases to their definition, so direct insert/update/delete on an event-store table imported from another file of the scanned repo is no longer missed. Findings now show the full receiver (ctx.db). Existing consumers can get new findings that were previously hidden."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "Faster, leaner guard run",
+    "detail": "Four AST guards skip files that cannot contain their anchor names before walking every node, and Direct-Entity-Writes only resolves symbols for table arguments named like an event-sourced table. Findings are identical."
+  },
+  {
+    "version": "0.378.0",
+    "type": "fix",
+    "title": "Pre-push shim skips untrusted ancestors and stops at $HOME",
+    "detail": "The shim walked up to / and could exec a kumiko-pre-push planted in /tmp or another shared directory. The walk now ends at $HOME and skips ancestors that another user owns or that group or others can write to."
+  },
+  {
+    "version": "0.378.0",
+    "type": "fix",
+    "title": "Pre-push shim also vets node_modules/.bin",
+    "detail": "The shim now requires node_modules/.bin itself to be owned by the user and not group or world writable before executing kumiko-pre-push from it, in the guards hook and the dev-server husky template."
+  },
+  {
+    "version": "0.377.0",
+    "type": "improvement",
+    "title": "guard-unsafe-append-event",
+    "detail": "Flags ctx.unsafeAppendEvent outside migrations/, upcasters/ and tests. Existing call sites are frozen per file in .kumiko-unsafe-append-event-baseline.json and the count may only shrink; repos without the file get a warning only."
+  },
+  {
+    "version": "0.377.0",
+    "type": "improvement",
+    "title": "repo-manifest moved into guards",
+    "detail": "The kumiko.json schema and loader are exported from @cosmicdrift/kumiko-guards/repo-manifest, the app port reader from @cosmicdrift/kumiko-guards/repo-manifest/app-ports. @cosmicdrift/kumiko-repo-manifest now only re-exports them and is removed after the consumer pass of wave 4. @cosmicdrift/kumiko-framework is an optional peer for the app-ports subpath.",
+    "migration": "Run bun kumiko-upgrade --apply, or bun kumiko codemod package-merge . --write. It rewrites imports of @cosmicdrift/kumiko-repo-manifest (and its /app-ports subpath) to @cosmicdrift/kumiko-guards/repo-manifest and replaces the dependency in package.json with kumiko-guards.",
+    "codemod": "scripts/codemod/package-merge.ts"
+  },
+  {
+    "version": "0.377.0",
+    "type": "improvement",
+    "title": "renderer-boundaries guard scans headless and live for imports only",
+    "detail": "The headless and live subtrees of kumiko-renderer must not import react-dom, jsdom or renderer-web; the symbol and JSX rules of the shared layer no longer apply to them. The section-fields-raw scope follows the moved headless sources."
+  },
+  {
+    "version": "0.377.0",
+    "type": "improvement",
+    "title": "renderer-boundaries guard leaves the web subtree unscanned",
+    "detail": "renderer/src/web may use the DOM and every web dependency; the shared renderer root and headless/live must not import it. The tailwind-scan-surface guard follows the new stylesheet location through package exports and shim imports."
+  },
+  {
+    "version": "0.377.0",
+    "type": "improvement",
+    "title": "comment-lang touched mode pairs renames",
+    "detail": "The touched mode diffs a moved file against its old path, so moving a file no longer counts every German comment in it as new."
+  },
+  {
+    "version": "0.376.0",
+    "type": "improvement",
+    "title": "The pre-push bypass is gone",
+    "detail": "PRE_PUSH_SKIP no longer skips the hook, neither in the shipped hook nor in kumiko-pre-push. KUMIKO_CHECK_WT=1 only stops the hook from re-entering a wrapping scripts/check-wt.sh. The i18n-keys guard treats keys defined by installed @cosmicdrift packages as known."
+  },
   {
     "version": "0.371.0",
     "type": "improvement",

package/src/guard-agent-docs-drift.ts

@@ -2,7 +2,7 @@
 /**
  * Guard: the generated agent docs under `packages/framework/agents/` must
  * match what `bun run gen:agent-docs` renders from the current sources
- * (feature manifest, renderer-web exports, sample recipes), and every
+ * (feature manifest, renderer web exports, sample recipes), and every
  * `agents/<file>.md` path the hand-written `packages/framework/AGENTS.md`
  * points at must exist in that generated set.
  *

package/src/guard-api-object-form.ts

@@ -41,6 +41,8 @@ const REGISTRAR_TYPE_MARKER = "FeatureRegistrar";
 const FEATURE_FACTORY_NAME = "defineFeature";
 const REGISTRAR_RECEIVER_NAMES: ReadonlySet<string> = new Set(["r", "registrar"]);
 const EXCLUDED_PATH = /(\/__tests__\/fixtures\/|\.d\.ts$)/;
+// Cheap text superset of what positionalCallMethod can match; skips the AST walk for most files.
+const REGISTRAR_METHOD_ACCESS = new RegExp(`\\.\\s*(?:${REGISTRAR_METHODS.join("|")})\\b`);
 const UPGRADE_HINT = "run `bun kumiko-upgrade --apply` (codemod object-form)";
 
 type ReceiverResolution = "registrar" | "other" | "unresolved";
@@ -145,39 +147,51 @@ function positionalCallMethod(call: CallExpression): RegistrarMethod | undefined
 
 export type ObjectFormFinding = { file: string; line: number; message: string };
 
+function positionalCallFindings(sf: SourceFile, file: string): ObjectFormFinding[] {
+  if (!REGISTRAR_METHOD_ACCESS.test(sf.getFullText())) return [];
+  const out: ObjectFormFinding[] = [];
+  for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const method = positionalCallMethod(call);
+    if (method === undefined) continue;
+    out.push({
+      file,
+      line: call.getStartLineNumber(),
+      message: `positional r.${method}(…) removed in 0.366 — ${UPGRADE_HINT}`,
+    });
+  }
+  return out;
+}
+
+function crudFindings(sf: SourceFile, file: string): ObjectFormFinding[] {
+  // Every crud local name is CRUD_FUNCTION_NAME itself or an import alias of it.
+  if (!sf.getFullText().includes(CRUD_FUNCTION_NAME)) return [];
+  const crudNames = crudLocalNames(sf);
+  const out: ObjectFormFinding[] = [];
+  for (const id of sf.getDescendantsOfKind(SyntaxKind.Identifier)) {
+    if (!crudNames.has(id.getText())) continue;
+    const parent = id.getParent();
+    const isCall = Node.isCallExpression(parent) && parent.getExpression() === id;
+    const isImportOrExport =
+      Node.isImportSpecifier(parent) ||
+      Node.isExportSpecifier(parent) ||
+      id.getFirstAncestorByKind(SyntaxKind.ImportDeclaration) !== undefined;
+    if (!isCall && !isImportOrExport) continue;
+    if (Node.isImportSpecifier(parent) && parent.getAliasNode() === id) continue;
+    out.push({
+      file,
+      line: id.getStartLineNumber(),
+      message: `registerEntityCrud removed in 0.366 — use r.crud(…); ${UPGRADE_HINT}`,
+    });
+  }
+  return out;
+}
+
 export function findPositionalRegistrarCalls(files: readonly SourceFile[]): ObjectFormFinding[] {
   const out: ObjectFormFinding[] = [];
   for (const sf of files) {
     if (EXCLUDED_PATH.test(sf.getFilePath())) continue;
     const file = relativeToCwd(sf.getFilePath());
-    const crudNames = crudLocalNames(sf);
-
-    for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-      const method = positionalCallMethod(call);
-      if (method === undefined) continue;
-      out.push({
-        file,
-        line: call.getStartLineNumber(),
-        message: `positional r.${method}(…) removed in 0.366 — ${UPGRADE_HINT}`,
-      });
-    }
-
-    for (const id of sf.getDescendantsOfKind(SyntaxKind.Identifier)) {
-      if (!crudNames.has(id.getText())) continue;
-      const parent = id.getParent();
-      const isCall = Node.isCallExpression(parent) && parent.getExpression() === id;
-      const isImportOrExport =
-        Node.isImportSpecifier(parent) ||
-        Node.isExportSpecifier(parent) ||
-        id.getFirstAncestorByKind(SyntaxKind.ImportDeclaration) !== undefined;
-      if (!isCall && !isImportOrExport) continue;
-      if (Node.isImportSpecifier(parent) && parent.getAliasNode() === id) continue;
-      out.push({
-        file,
-        line: id.getStartLineNumber(),
-        message: `registerEntityCrud removed in 0.366 — use r.crud(…); ${UPGRADE_HINT}`,
-      });
-    }
+    out.push(...positionalCallFindings(sf, file), ...crudFindings(sf, file));
   }
   return out;
 }

package/src/guard-comment-lang.ts

@@ -266,6 +266,23 @@ function gitOrFail(args: readonly string[], cwd: string, message: string): strin
 
 const REWRITE_HINT = `Translate new German comments to English (why, not what), or if deliberate:\n    // ${IGNORE_TAG} <reason>`;
 
+// A path-limited diff cannot pair a rename, so every comment of a moved file would read as added.
+function readRenamedFrom(gitToplevel: string, mergeBase: string): Map<string, readonly string[]> {
+  const renamedFrom = new Map<string, readonly string[]>();
+  const fields = gitOrFail(
+    ["diff", "--name-status", "-z", "-M", "--diff-filter=R", mergeBase, "HEAD"],
+    gitToplevel,
+    "Touched mode: git diff --name-status failed. Check the git error below.",
+  )
+    .split("\0")
+    .filter(Boolean);
+  for (let i = 0; i + 2 < fields.length; i += 3) {
+    const [, oldPath, newPath] = fields.slice(i, i + 3);
+    if (oldPath !== undefined && newPath !== undefined) renamedFrom.set(newPath, [oldPath]);
+  }
+  return renamedFrom;
+}
+
 function runTouchedMode(
   argv: readonly string[],
   root: string,
@@ -304,6 +321,8 @@ function runTouchedMode(
     .split("\0")
     .filter(Boolean);
 
+  const renamedFrom = readRenamedFrom(gitToplevel, mergeBase);
+
   // The commits being pushed are checked, not the working tree: contents come from
   // HEAD so line numbers match the `mergeBase..HEAD` diff. Scan scope is keyed
   // relative to root, git output relative to the toplevel.
@@ -321,7 +340,17 @@ function runTouchedMode(
     if (candidates.length === 0) continue;
     const addedLines = parseAddedLineRanges(
       gitOrFail(
-        ["--literal-pathspecs", "diff", "--unified=0", mergeBase, "HEAD", "--", file],
+        [
+          "--literal-pathspecs",
+          "diff",
+          "-M",
+          "--unified=0",
+          mergeBase,
+          "HEAD",
+          "--",
+          file,
+          ...(renamedFrom.get(file) ?? []),
+        ],
         gitToplevel,
         `Touched mode: git diff --unified=0 failed for ${file}. Check the git error below.`,
       ),

package/src/guard-direct-entity-writes.ts

@@ -156,21 +156,26 @@ export function unwrapTableExpression(node: Node): Node {
 // declaration disambiguates them.
 type TableId = string; // "${filePath}::${name}"
 
-function declIdOf(id: import("ts-morph").Identifier): TableId | undefined {
+function declIdOf(id: Identifier): TableId | undefined {
   const symbol = id.getSymbol();
   if (!symbol) return undefined;
-  const decls = symbol.getDeclarations();
+  // An imported identifier's own declaration is the ImportSpecifier; follow the alias
+  // chain (barrels, renames) so the ID matches the one built at the definition.
+  const resolved = symbol.isAlias() ? (symbol.getAliasedSymbol() ?? symbol) : symbol;
+  const decls = resolved.getDeclarations();
   if (decls.length === 0) return undefined;
   // Param-only symbols are factory pass-throughs — skip.
   if (decls.every((d) => d.getKind() === SyntaxKind.Parameter)) return undefined;
   const first = decls[0];
   if (!first) return undefined;
-  return `${first.getSourceFile().getFilePath()}::${id.getText()}`;
+  const name = Node.hasName(first) ? first.getName() : id.getText();
+  return `${first.getSourceFile().getFilePath()}::${name}`;
 }
 
 export function collectEsTables(files: readonly SourceFile[]): Set<TableId> {
   const tables = new Set<TableId>();
   for (const sf of files) {
+    if (!sf.getFullText().includes("createEventStoreExecutor")) continue;
     for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
       const expr = call.getExpression();
       if (expr.getText() !== "createEventStoreExecutor") continue;
@@ -251,6 +256,8 @@ function rebuildableEntityTableDeclId(
   return declIdOf(nameNode.asKindOrThrow(SyntaxKind.Identifier));
 }
 
+const ENTITY_METHOD_ACCESS = /\.\s*entity\b/;
+
 // Tables registered via `r.entity({ name, ...entityDef })` as a rebuildable implicit
 // projection, linked entity→table via the shared entity-def symbol (see header), not by name string.
 export function collectEntityProjectionTables(files: readonly SourceFile[]): Set<TableId> {
@@ -259,6 +266,7 @@ export function collectEntityProjectionTables(files: readonly SourceFile[]): Set
 
   // Pass 1: entity-def decls that r.entity makes rebuildable (+ {table} override).
   for (const sf of files) {
+    if (!ENTITY_METHOD_ACCESS.test(sf.getFullText())) continue;
     for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
       const registration = entityRegistrationOf(call);
       if (!registration) continue;
@@ -270,6 +278,7 @@ export function collectEntityProjectionTables(files: readonly SourceFile[]): Set
   // Pass 2: `const xTable = buildEntityTable(<name>, <entityDef>)` where entityDef
   // is in the rebuildable set → xTable is a rebuildable entity table.
   for (const sf of files) {
+    if (!sf.getFullText().includes("buildEntityTable")) continue;
     for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
       const did = rebuildableEntityTableDeclId(call, rebuildableEntities);
       if (did) tables.add(did);
@@ -427,14 +436,37 @@ function hasAnyTableWriteOrDeclaration(files: readonly SourceFile[]): boolean {
   return false;
 }
 
+// A TableId ends in `::<identifier text>`, so a table argument whose text is no ES table name
+// can never match; filtering on the name avoids a symbol lookup (TS program build) per call.
+function tableNamesOf(tableIds: ReadonlySet<TableId>): Set<string> {
+  return new Set([...tableIds].map((tableId) => tableId.slice(tableId.lastIndexOf("::") + 2)));
+}
+
+// Local names an import can give a table in this file (`import { a as b }` -> b). Syntactic,
+// so a rename or barrel re-export never hides an ES table from the name prefilter.
+function importedBindingNames(sf: SourceFile): Set<string> {
+  const names = new Set<string>();
+  for (const declaration of sf.getImportDeclarations()) {
+    const defaultName = declaration.getDefaultImport()?.getText();
+    if (defaultName) names.add(defaultName);
+    for (const specifier of declaration.getNamedImports()) {
+      names.add(specifier.getAliasNode()?.getText() ?? specifier.getName());
+    }
+  }
+  return names;
+}
+
 export function scanDirectWrites(
   sf: SourceFile,
   esTables: ReadonlySet<TableId>,
 ): Omit<Violation, "file">[] {
   const out: Omit<Violation, "file">[] = [];
+  // Superset of every name a write may use for an ES table: definition names plus import bindings.
+  const candidateNames = new Set([...tableNamesOf(esTables), ...importedBindingNames(sf)]);
   for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
     const w = resolveWrite(call);
     if (!w) continue;
+    if (!candidateNames.has(w.tableArg.getText())) continue;
 
     // Walk the receiver chain down to its leftmost identifier. For `db.insert`
     // that's `db`; for `ctx.db.raw` (function-form arg0) that's `ctx`; for
@@ -457,7 +489,7 @@ export function scanDirectWrites(
       if (isInsideProjectionApply(call)) continue;
       out.push({
         line: call.getStartLineNumber(),
-        receiver: receiverName,
+        receiver: w.receiver.getText(),
         op: w.op,
         table: w.tableArg.getText(),
         snippet: call.getText().slice(0, 120),
@@ -468,7 +500,7 @@ export function scanDirectWrites(
 
     out.push({
       line: call.getStartLineNumber(),
-      receiver: receiverName,
+      receiver: w.receiver.getText(),
       op: w.op,
       table: w.tableArg.getText(),
       snippet: call.getText().slice(0, 120),

package/src/guard-direct-fetch.ts

@@ -46,8 +46,8 @@ const EXCLUDE =
 // Prefixed by RepoRoot.name (not kind): kind "app" is shared across
 // unregistered repos (infra#560).
 
-// packages/http/src/egress.ts IS the egress() implementation.
-const ALLOWLIST = [/^kumiko-framework\/packages\/http\/src\/egress\.ts$/];
+// packages/framework/src/http/egress.ts IS the egress() implementation.
+const ALLOWLIST = [/^kumiko-framework\/packages\/framework\/src\/http\/egress\.ts$/];
 const ALLOW_MARKER = "guard-allow: same-origin fetch";
 
 interface Violation {

package/src/guard-escape-hatch-declared.ts

@@ -128,6 +128,7 @@ function scannableFiles(files: readonly SourceFile[]): SourceFile[] {
 export function systemScopeDirs(files: readonly SourceFile[]): string[] {
   const dirs: string[] = [];
   for (const sf of scannableFiles(files)) {
+    if (!sf.getFullText().includes("systemScope")) continue;
     for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
       const expr = call.getExpression();
       if (
@@ -189,6 +190,10 @@ function isTenantDbExpression(node: Node): boolean {
   return (node.getSymbol()?.getDeclarations() ?? []).some(isTenantDbDeclaration);
 }
 
+// Text prefilters: a node walk per rule per file is the guard's dominant cost, and
+// a rule's anchor name must appear verbatim in any file it can fire on.
+const RAW_ACCESS = /\.\s*raw\b/;
+
 function findRawFindings(
   sf: SourceFile,
   root: string,
@@ -196,6 +201,7 @@ function findRawFindings(
 ): EscapeHatchFinding[] {
   if (isInSystemScope(sf.getFilePath(), systemDirs)) return [];
   const out: EscapeHatchFinding[] = [];
+  if (!RAW_ACCESS.test(sf.getFullText())) return out;
   for (const pa of sf.getDescendantsOfKind(SyntaxKind.PropertyAccessExpression)) {
     if (pa.getName() !== "raw") continue;
     if (!isTenantDbExpression(pa.getExpression())) continue;
@@ -217,6 +223,7 @@ function findUnsafeRawFindings(
 ): EscapeHatchFinding[] {
   if (isInSystemScope(sf.getFilePath(), systemDirs)) return [];
   const out: EscapeHatchFinding[] = [];
+  if (!sf.getFullText().includes("unsafeRaw")) return out;
   for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
     const expr = call.getExpression();
     if (!expr.isKind(SyntaxKind.PropertyAccessExpression)) continue;
@@ -531,6 +538,8 @@ function findSystemIdentityFindings(
   systemDirs: readonly string[],
 ): EscapeHatchFinding[] {
   const out: EscapeHatchFinding[] = [];
+  const text = sf.getFullText();
+  if (!text.includes("queryAs") && !text.includes("writeAs")) return out;
   for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
     const expr = call.getExpression();
     if (!expr.isKind(SyntaxKind.PropertyAccessExpression)) continue;
@@ -562,6 +571,7 @@ function findUnsafeAllTenantsFindings(
   systemDirs: readonly string[],
 ): EscapeHatchFinding[] {
   const out: EscapeHatchFinding[] = [];
+  if (!sf.getFullText().includes("unsafeAllTenants")) return out;
   for (const prop of sf.getDescendantsOfKind(SyntaxKind.PropertyAssignment)) {
     const nameNode = prop.getNameNode();
     if (!nameNode.isKind(SyntaxKind.Identifier) || nameNode.getText() !== "unsafeAllTenants") {
@@ -609,6 +619,8 @@ const GENERIC_REASON_METHODS = new Set(["acknowledgeCrossTenant", "unsafeRaw"]);
 
 function findGenericReasonMethodCalls(sf: SourceFile, root: string): GenericReasonFinding[] {
   const out: GenericReasonFinding[] = [];
+  const text = sf.getFullText();
+  if (![...GENERIC_REASON_METHODS].some((method) => text.includes(method))) return out;
   for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
     const expr = call.getExpression();
     if (!expr.isKind(SyntaxKind.PropertyAccessExpression)) continue;
@@ -634,6 +646,7 @@ function findGenericReasonDeclareEscapeHatchCalls(
   root: string,
 ): GenericReasonFinding[] {
   const out: GenericReasonFinding[] = [];
+  if (!sf.getFullText().includes("declareEscapeHatch")) return out;
   for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
     const callee = call.getExpression();
     if (!callee.isKind(SyntaxKind.Identifier) || callee.getText() !== "declareEscapeHatch") {
@@ -662,6 +675,7 @@ function findGenericReasonObjectProperty(
   propertyName: string,
 ): GenericReasonFinding[] {
   const out: GenericReasonFinding[] = [];
+  if (!sf.getFullText().includes(propertyName)) return out;
   for (const pa of sf.getDescendantsOfKind(SyntaxKind.PropertyAssignment)) {
     if (pa.getName() !== propertyName) continue;
     const init = pa.getInitializer();

package/src/guard-html-escape.ts

@@ -3,7 +3,7 @@
  * Guard: HTML-building template literals must escape every interpolation.
  *
  * XSS protection in this codebase is a callsite convention
- * (escapeHtml/escapeHtmlAttr from kumiko-headless) — this guard makes the
+ * (escapeHtml/escapeHtmlAttr from kumiko-renderer/headless) — this guard makes the
  * convention enforceable. A template literal counts as HTML-building when
  * its static text contains a known HTML/MJML/SVG tag. Every interpolation
  * inside it must then be recognizably safe:
@@ -409,7 +409,7 @@ function scanFile(sf: SourceFile): UnsafeSite[] {
 export const guard: AstGuard = {
   name: "HTML-Escape Guard",
   scan: SCAN,
-  hint: "Escape interpolation in an HTML template literal: escapeHtml()/escapeHtmlAttr() from @cosmicdrift/kumiko-headless. Mark pre-rendered HTML with a `*Html` name; type static copy tables `as const`; deliberate exception with `// html-ok: <why>`.",
+  hint: "Escape interpolation in an HTML template literal: escapeHtml()/escapeHtmlAttr() from @cosmicdrift/kumiko-renderer/headless. Mark pre-rendered HTML with a `*Html` name; type static copy tables `as const`; deliberate exception with `// html-ok: <why>`.",
   run(files) {
     const violations: Array<{ file: string; line: number; message: string }> = [];
     for (const sf of files) {