@cosmicdrift/kumiko-guards 0.386.0 → 0.388.0

package/src/guard-raw-interactive-elements.ts

@@ -9,7 +9,7 @@
  * <button>/<input>/<select>/<textarea>/<dialog>/<form> are deliberately NOT
  * in this guard: <button>/<input>/<select>/<textarea>/<dialog> are already
  * enforced by guard-primitives-discipline.ts (its own CI step, not this
- * bundle), and <form> is a documented exception (PR #488, agent-layer.tsx:71
+ * bundle), and <form> is a documented exception (agent-layer.tsx:71
  * uses a native <form onSubmit> on purpose) — adding either back here would
  * duplicate or contradict an existing rule.
  *

package/src/guard-renderer-boundaries.ts

@@ -11,6 +11,9 @@
  * emits SVG strings and the live dispatcher is a fetch client, so the symbol and JSX-tag rules would be noise there. They stay free
  * of react-dom, jsdom and any import of `src/web`.
  *
+ * `headless` additionally may not import react, the renderer root or anything outside its own
+ * folder (server/mail bundles import it); the shared layer may not import `live`.
+ *
  * Deliberately simple: a regex scan over the source text. False positives
  * (e.g. "window" in a string literal) are possible but rare — the guard is a
  * maintenance alarm, not a semantic proof.
@@ -41,6 +44,24 @@ const FORBIDDEN_IMPORTS = [
   /from ["']@cosmicdrift\/kumiko-dispatcher-live["']/,
 ];
 
+// `headless` is consumed server-side (prod bundle, mail HTML): it must stay free of React and of
+// the shared layer, so it may only import itself and third-party packages other than react.
+const HEADLESS_FORBIDDEN_IMPORTS = [
+  /from ["']react(?:\/.*)?["']/,
+  /from ["']@cosmicdrift\/kumiko-renderer(?:\/(?!headless(?:["'/]))[^"']*)?["']/,
+];
+
+// The fetch/document.cookie dispatcher client belongs to consumers of `live`, not the shared layer.
+const SHARED_FORBIDDEN_IMPORTS = [
+  /from ["'](?:\.\.?\/)+live(?:\/.*)?["']/,
+  /from ["']@cosmicdrift\/kumiko-renderer\/live(?:\/.*)?["']/,
+];
+
+// dev-console.ts is a dependency-free console wrapper, safe in server bundles.
+const HEADLESS_ALLOWED_LEAF = /(?:^|\/)dev-console(?:\.ts)?$/;
+
+const RELATIVE_SPECIFIER = /from ["'](\.\.?\/[^"']*)["']/;
+
 // Runtime symbols that mean DOM/browser. `\b` prevents substring matches
 // (e.g. "origin" not matched as "origin.foo"). This is a coarse guard — a
 // ts-morph-based check would be more precise, but not worth the effort here.
@@ -82,6 +103,34 @@ type Violation = {
   readonly excerpt: string;
 };
 
+const RENDERER_SRC = `${path.sep}packages${path.sep}renderer${path.sep}src${path.sep}`;
+
+// Absolute path of `packages/renderer/src/<dir>` containing `file`, or "" when it is elsewhere.
+function rendererSrcSubdir(file: string, dir: string): string {
+  const marker = `${RENDERER_SRC}${dir}${path.sep}`;
+  const index = file.indexOf(marker);
+  return index === -1 ? "" : file.slice(0, index + marker.length - 1);
+}
+
+function isInside(dir: string, target: string): boolean {
+  return target === dir || target.startsWith(dir + path.sep);
+}
+
+function escapesHeadless(file: string, line: string): boolean {
+  const headlessDir = rendererSrcSubdir(file, "headless");
+  const specifier = RELATIVE_SPECIFIER.exec(line)?.[1];
+  if (headlessDir === "" || specifier === undefined) return false;
+  if (HEADLESS_ALLOWED_LEAF.test(specifier)) return false;
+  return !isInside(headlessDir, path.resolve(path.dirname(file), specifier));
+}
+
+function isSharedLayer(file: string): boolean {
+  return (
+    file.includes(RENDERER_SRC) &&
+    ["headless", "live", "web"].every((dir) => rendererSrcSubdir(file, dir) === "")
+  );
+}
+
 function walk(dir: string, skippedDirs: readonly string[] = []): string[] {
   const out: string[] = [];
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
@@ -111,15 +160,18 @@ export function findViolations(file: string, root: string, importRulesOnly = fal
     const trimmed = line.trim();
     if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
 
-    for (const pattern of FORBIDDEN_IMPORTS) {
-      if (pattern.test(line)) {
-        violations.push({
-          file: path.relative(root, file),
-          line: i + 1,
-          rule: "forbidden-import",
-          excerpt: trimmed,
-        });
-      }
+    const importPatterns = [
+      ...FORBIDDEN_IMPORTS,
+      ...(rendererSrcSubdir(file, "headless") !== "" ? HEADLESS_FORBIDDEN_IMPORTS : []),
+      ...(isSharedLayer(file) ? SHARED_FORBIDDEN_IMPORTS : []),
+    ];
+    if (importPatterns.some((pattern) => pattern.test(line)) || escapesHeadless(file, line)) {
+      violations.push({
+        file: path.relative(root, file),
+        line: i + 1,
+        rule: "forbidden-import",
+        excerpt: trimmed,
+      });
     }
     if (importRulesOnly) continue;
     for (const pattern of FORBIDDEN_SYMBOLS) {

package/src/guard-restricted-symbols.ts

@@ -5,9 +5,8 @@
  *
  * `getUnscopedAggregateStreamMaxVersion` / `getUnscopedAggregateStreamTenant`
  * (packages/framework/src/event-store/event-store.ts) have no tenant
- * filter — they are an existence oracle for foreign tenants (see
- * kumiko-framework#1269). Legitimate only for seed-/system-internal code
- * that deliberately works across tenants.
+ * filter — they are an existence oracle for foreign tenants. Legitimate only
+ * for seed-/system-internal code that deliberately works across tenants.
  *
  * Usage:
  *   bun guards/guard-restricted-symbols.ts

package/src/guard-tailwind-scan-surface.ts

@@ -4,23 +4,22 @@
  * `packages/bundled-features/src/**` must already be reachable through the
  * real Tailwind `@source` scan surface (`packages/renderer/src` +
  * `samples/**\/src`, see `packages/renderer/src/web/styles.css`).
- * bundled-features itself is NOT part of that scan surface (infra#654, follow-up to
- * kumiko-framework#2498/#2496): expanding `@source` there was verified to
- * work in the monorepo build but makes the standalone npm-consumer case
- * (no monorepo-relative scan path — #359) falsely green. A class used only
- * in bundled-features silently drops out of the compiled CSS at runtime,
- * with no build/lint error.
+ * bundled-features itself is NOT part of that scan surface: expanding
+ * `@source` there was verified to work in the monorepo build but makes the
+ * standalone npm-consumer case (no monorepo-relative scan path) falsely
+ * green. A class used only in bundled-features silently drops out of the
+ * compiled CSS at runtime, with no build/lint error.
  *
- * V1 scope (per issue decision, deliberately not a Tailwind-CLI CSS
- * regen): only plain string-literal `className="..."` JSX attributes are
- * extracted on the bundled-features side — no `cn(...)`, no template
- * literals, no dynamic class maps. The allow-set (the real scan surface)
- * is read generously instead — every string/template-literal in those
- * files, not just `className` attributes — because Tailwind's own scanner
- * is a text scan, not JSX-attribute-aware; under-approximating the allow
- * side would turn into false positives on a guard that blocks CI. Tokens
- * compare WITH their modifier prefixes intact (`hover:mb-2` is its own
- * Tailwind candidate, distinct from `mb-2`).
+ * V1 scope, deliberately not a Tailwind-CLI CSS regen: only plain
+ * string-literal `className="..."` JSX attributes are extracted on the
+ * bundled-features side — no `cn(...)`, no template literals, no dynamic
+ * class maps. The allow-set (the real scan surface) is read generously
+ * instead — every string/template-literal in those files, not just
+ * `className` attributes — because Tailwind's own scanner is a text scan,
+ * not JSX-attribute-aware; under-approximating the allow side would turn
+ * into false positives on a guard that blocks CI. Tokens compare WITH their
+ * modifier prefixes intact (`hover:mb-2` is its own Tailwind candidate,
+ * distinct from `mb-2`).
  *
  * Baseline-regression guard: pins the
  * currently-known violation count per file. Reductions are allowed but
@@ -174,11 +173,11 @@ const tailwindScanSurfaceBaseline = (baselineRoot: string) =>
 // ships .tsx with `className` under its own scan surface (renderer/src +
 // samples/**/src) needs its own `@source` entry in the app's
 // styles.css — nothing else scans it. Missed cases so far: kumiko-designer
-// in studio (studio#289), kumiko-ai-agent in publicstatus (publicstatus#442)
-// — both fixed by hand, both silent (no build/lint error) until noticed
-// visually. This does not need ts-morph: it reads package.json + styles.css
-// + a plain text scan of the dependency's shipped .tsx files directly off
-// disk, independent of the scan-selected SourceFile list above.
+// in studio, kumiko-ai-agent in publicstatus — both fixed by hand, both
+// silent (no build/lint error) until noticed visually. This does not need
+// ts-morph: it reads package.json + styles.css + a plain text scan of the
+// dependency's shipped .tsx files directly off disk, independent of the
+// scan-selected SourceFile list above.
 const APP_STYLES_REL = "src/styles.css";
 const PACKAGE_SCOPE = /^@cosmicdrift(?:gamestudio)?\//;
 const CLASSNAME_ATTR = /\bclassName\s*=/;
@@ -390,14 +389,14 @@ export function scanSourceCoverage(roots: readonly RepoRoot[]): SourceCoverageFi
 }
 
 // Third, independent rule: an `@source` glob that is already present and
-// resolves on disk (studio#289's own fix) can still match nothing once the
-// referenced package is installed from a registry instead of a workspace
-// symlink — the symlink exposes the package's full source checkout (`src/`
-// included), a registry tarball only ships what its `package.json` `files`
-// allowlists. This is exactly the bug that got past the guard the first
-// time, so it's a hard violation, not a warning: no baseline/ratchet, every
-// finding fails the run directly (still only under baseline comparison —
-// `--no-baseline` reports it like the other rules but doesn't fail).
+// resolves on disk can still match nothing once the referenced package is
+// installed from a registry instead of a workspace symlink — the symlink
+// exposes the package's full source checkout (`src/`) included, a registry
+// tarball only ships what its `package.json` `files` allowlists. This is
+// exactly the bug that got past the guard the first time, so it's a hard
+// violation, not a warning: no baseline/ratchet, every finding fails the run
+// directly (still only under baseline comparison — `--no-baseline` reports it
+// like the other rules but doesn't fail).
 const NODE_MODULES_PKG_SEGMENT = /node_modules\/((?:@[^/]+\/)?[^/]+)\/([^/]+)/;
 
 export interface PublishedScanSurfaceFinding {

package/src/guard-tenant-escalation.ts

@@ -61,8 +61,8 @@ type RoleHandler = { name: string; file: string; line: number };
 // A `schema:` property that references an outlined const (`schema:
 // CancelInvitationSchema`) has no `role:`/`roles:` text of its own — the field
 // lives in the const's declaration. Resolving the identifier to its
-// declaration covers that ~43% of write handlers (#1556-adjacent bug: a
-// text-only check silently skips them). Falls back to the property's own text
+// declaration covers that ~43% of write handlers; a text-only check silently
+// skips them. Falls back to the property's own text
 // when the initializer isn't a resolvable identifier.
 function resolvedSchemaText(schemaProp: Node): string {
   const init = schemaProp.asKind(SyntaxKind.PropertyAssignment)?.getInitializer();
@@ -208,7 +208,7 @@ function globalUserWriteMissingCheck(
   // Presets that resolve to platform-wide actors only (engine/
   // config-helpers `access`): no tenant boundary exists to cross.
   // Everything else — access.admin, and the openToAll handlers that
-  // gate on isAdminActor at runtime (#1556's shape) — is reachable by
+  // gate on isAdminActor at runtime (this shape) — is reachable by
   // a tenant-scoped TenantAdmin.
   if (PLATFORM_WIDE_ACCESS.test(accessProp.getText())) return undefined;
   if (!TARGETS_OTHER_USER.test(resolvedSchemaText(schema))) return undefined;

package/src/guard-test-template-drift.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 /**
  * Guard: apps must not locally reimplement the e2e/screenshot template that
- * `@cosmicdrift/kumiko-testing` already owns (#3118). Flags, in Playwright
+ * `@cosmicdrift/kumiko-testing` already owns. Flags, in Playwright
  * configs and e2e/screenshot specs/helpers:
  *   (a) a `playwright*.config.ts` that imports `defineConfig` from
  *       `@playwright/test` directly instead of `defineAppE2eConfig` from

package/src/guard-test-timeouts.ts

@@ -23,7 +23,7 @@
  * the message.
  *
  * No baseline, no ratchet: any finding
- * fails. #3118's transition period (a `.kumiko-test-timeouts-baseline.json`
+ * fails. The transition period (a `.kumiko-test-timeouts-baseline.json`
  * grandfathering pre-existing sleep loops) is over — every consumer must fix
  * or mark the cause, not accumulate a pinned count.
  *
@@ -32,7 +32,7 @@
  * Consumer (via the published `kumiko-guards` CLI):
  *   kumiko-guards guards --guard=test-timeouts
  */
-import { type CallExpression, Node, type SourceFile, SyntaxKind } from "ts-morph";
+import { type CallExpression, Node, type SourceFile, SyntaxKind, type Type } from "ts-morph";
 import {
   type AstGuard,
   type GuardOutcome,
@@ -182,12 +182,20 @@ function declarationBaseCallee(callee: Node): Node {
 }
 
 // An identifier can be the Playwright test body (`test(title, details, body)`) or an options
-// variable like `{ retry: 2 }`, so it only counts when its type is a number or carries `timeout`.
+// variable like `{ retry: 2 }`, so only its type decides. Every other non-function expression
+// (conditional, member access, call) is treated as a timeout so a union or untyped value cannot hide one.
 function isTimeoutArgument(arg: Node): boolean {
   if (Node.isObjectLiteralExpression(arg)) return hasTimeoutProperty(arg);
   if (Node.isArrowFunction(arg) || Node.isFunctionExpression(arg)) return false;
+  if (!Node.isIdentifier(arg)) return true;
   const type = arg.getType();
-  return type.isNumber() || type.isNumberLiteral() || type.getProperty("timeout") !== undefined;
+  if (type.isAny() || type.isUnknown()) return true;
+  const carriesNumber = (t: Type): boolean => t.isNumber() || t.isNumberLiteral();
+  return (
+    carriesNumber(type) ||
+    (type.isUnion() && type.getUnionTypes().some(carriesNumber)) ||
+    type.getProperty("timeout") !== undefined
+  );
 }
 
 function declarationTimeoutReason(

package/src/guard-thin-wrappers.ts

@@ -335,16 +335,51 @@ function extractMarkerReason(node: FnNode): string | null {
   return null;
 }
 
+// A typed lookup table (`const T: Record<K, Fn> = {…}` or `{…} satisfies …`) fixes one
+// signature per slot; a one-call entry adapts that signature, so inlining it would mean
+// dropping the table, not the wrapper.
+function isTypedTableLiteral(literal: Node): boolean {
+  let parent = literal.getParent();
+  while (parent?.isKind(SyntaxKind.AsExpression)) parent = parent.getParent();
+  if (parent?.isKind(SyntaxKind.SatisfiesExpression)) return true;
+  return parent?.isKind(SyntaxKind.VariableDeclaration) === true && !!parent.getTypeNode();
+}
+
+function collectTypedTableValueNames(sf: SourceFile): Set<string> {
+  const names = new Set<string>();
+  for (const literal of sf.getDescendantsOfKind(SyntaxKind.ObjectLiteralExpression)) {
+    if (!isTypedTableLiteral(literal)) continue;
+    for (const property of literal.getProperties()) {
+      if (property.isKind(SyntaxKind.ShorthandPropertyAssignment)) names.add(property.getName());
+      if (!property.isKind(SyntaxKind.PropertyAssignment)) continue;
+      const value = property.getInitializer();
+      if (value?.isKind(SyntaxKind.Identifier)) names.add(value.getText());
+    }
+  }
+  return names;
+}
+
+function isInlineTypedTableValue(node: FnNode): boolean {
+  const property = node.getParent();
+  const literal = property?.isKind(SyntaxKind.PropertyAssignment)
+    ? property.getParent()
+    : undefined;
+  return literal !== undefined && isTypedTableLiteral(literal);
+}
+
 // ── Scan ──────────────────────────────────────────────────────────────────
 
 export function collectFindings(sf: SourceFile): Finding[] {
   const file = path.relative(ROOT, sf.getFilePath());
   const findings: Finding[] = [];
+  const typedTableValueNames = collectTypedTableValueNames(sf);
 
   const check = (node: FnNode) => {
     const fnName = getFnName(node);
     // skip: anonymous functions cannot be reported by name
     if (!fnName) return;
+    // skip: a typed table slot, see isTypedTableLiteral
+    if (typedTableValueNames.has(fnName) || isInlineTypedTableValue(node)) return;
 
     const callee = getSingleDirectCallee(node);
     // skip: not a single-callee wrapper

package/src/guard-write-handler-qns.ts

@@ -30,7 +30,7 @@ const SCAN: ScanSpec = {
   frameworkWithin: ["packages/*/src/**", "samples/**"],
 };
 
-// Tests nutzen absichtlich generische QNs wie dispatcher.write("x", {}).
+// Tests intentionally use generic QNs such as dispatcher.write("x", {}).
 const EXCLUDE = /(__tests__|\.test\.tsx$|\.integration\.tsx$|\/node_modules\/|\/dist\/)/;
 
 /**

package/src/pre-push.sh

@@ -18,8 +18,8 @@
 #      sub-repo's own package.json `test` script — refuses the push if that
 #      script is missing.
 #
-# Before the checks below, the hook runs a gitleaks scan of origin/main..HEAD
-# when the binary is installed.
+# Before the checks below, the hook runs a gitleaks scan of origin/main..<pushed sha>
+# for every pushed ref when the binary is installed.
 #
 # Extension point: a tracked, executable scripts/pre-push-extra.sh runs
 # before the main check in every branch above, with KUMIKO_PUSH_REPO_ROOT
@@ -123,11 +123,27 @@ if ! command -v gitleaks >/dev/null 2>&1; then
 elif ! git -C "$REPO_ROOT" rev-parse --verify --quiet origin/main >/dev/null 2>&1; then
   echo "[pre-push] origin/main not found — secret scan skipped" >&2
 else
-  echo "[pre-push] gitleaks git origin/main..HEAD"
-  if ! (cd "$REPO_ROOT" && gitleaks git --no-banner --redact --log-opts="origin/main..HEAD" .); then
-    echo "[pre-push] gitleaks found secrets — refusing push" >&2
-    exit 1
+  # git passes "<local ref> <local sha> <remote ref> <remote sha>" per pushed ref on stdin;
+  # scan those tips (not HEAD), skip deletes. Without stdin (direct call) fall back to HEAD.
+  SCAN_TIPS=""
+  PUSH_LINES=0
+  if [ ! -t 0 ]; then
+    while read -r _local_ref LOCAL_SHA _remote_ref _remote_sha; do
+      [ -n "$LOCAL_SHA" ] || continue
+      PUSH_LINES=$((PUSH_LINES + 1))
+      case "$LOCAL_SHA" in *[!0]*) SCAN_TIPS="$SCAN_TIPS $LOCAL_SHA" ;; esac
+    done
+  fi
+  if [ "$PUSH_LINES" -eq 0 ]; then
+    SCAN_TIPS=" HEAD"
   fi
+  for SCAN_TIP in $SCAN_TIPS; do
+    echo "[pre-push] gitleaks git origin/main..$SCAN_TIP"
+    if ! (cd "$REPO_ROOT" && gitleaks git --no-banner --redact --log-opts="origin/main..$SCAN_TIP" .); then
+      echo "[pre-push] gitleaks found secrets — refusing push" >&2
+      exit 1
+    fi
+  done
 fi
 
 # infra#559/#569: from a worktree, `--git-common-dir` resolves to the main

package/src/repo-manifest/app-ports/static-app-config.ts

@@ -39,20 +39,24 @@ function propertyName(node: Node): string | undefined {
 }
 
 function objectProperty(object: ObjectLiteralExpression, name: string): Node | undefined {
+  let found: Node | undefined;
+  let opaqueAfterFound = false;
   for (const property of object.getProperties()) {
-    if (
-      property.isKind(SyntaxKind.SpreadAssignment) ||
-      property.isKind(SyntaxKind.ShorthandPropertyAssignment)
-    ) {
-      throw new StaticConfigError(
-        `${name}: spread and shorthand properties cannot be read statically`,
-      );
-    }
-    if (propertyName(property) === name && property.isKind(SyntaxKind.PropertyAssignment)) {
-      return property.getInitializerOrThrow();
+    if (property.isKind(SyntaxKind.SpreadAssignment)) {
+      opaqueAfterFound = true;
+    } else if (property.isKind(SyntaxKind.ShorthandPropertyAssignment)) {
+      if (property.getName() === name) opaqueAfterFound = true;
+    } else if (propertyName(property) === name && property.isKind(SyntaxKind.PropertyAssignment)) {
+      found = property.getInitializerOrThrow();
+      opaqueAfterFound = false;
     }
   }
-  return undefined;
+  if (opaqueAfterFound) {
+    throw new StaticConfigError(
+      `${name}: spread and shorthand properties cannot be read statically`,
+    );
+  }
+  return found;
 }
 
 function numericLiteral(node: Node | undefined, path: string): number {

package/src/run-guards.ts

@@ -25,6 +25,7 @@ import { guard as complexity } from "./check-complexity";
 import { guard as predicateExtraction } from "./check-predicates";
 import { guard as adminApi } from "./guard-admin-api";
 import { guard as appFeatureStructure } from "./guard-app-feature-structure";
+import { guard as commentIssueRefOnly } from "./guard-comment-issue-ref-only";
 import { guard as crossFeatureImports } from "./guard-cross-feature-imports";
 import { guard as directEntityWrites } from "./guard-direct-entity-writes";
 import { guard as directFetch } from "./guard-direct-fetch";
@@ -82,6 +83,7 @@ export const GUARDS = [
   testTimeouts,
   testTemplateDrift,
   fileSize,
+  commentIssueRefOnly,
 ];
 
 export const GUARD_FLAGS = [
@@ -95,6 +97,8 @@ const GUARD_NAME_PREFIX = "--guard=";
 
 export type RunGuardsCliDeps = {
   readonly writeBaselineRoots?: readonly RepoRoot[];
+  readonly acquireSlot?: () => () => void;
+  readonly buildProject?: typeof buildSharedProject;
 };
 
 // Shared by the direct `bun run-guards.ts` invocation below and by the
@@ -113,7 +117,7 @@ export function runGuardsCli(argv: readonly string[], deps: RunGuardsCliDeps = {
     return 1;
   }
   if (flags.includes("--explain")) {
-    for (const line of explainGuards(GUARDS, buildSharedProject(GUARDS))) {
+    for (const line of explainGuards(GUARDS, (deps.buildProject ?? buildSharedProject)(GUARDS))) {
       console.log(line);
     }
     return 0;
@@ -153,12 +157,15 @@ export function runGuardsCli(argv: readonly string[], deps: RunGuardsCliDeps = {
     );
     return 0;
   }
-  const strictSecurityBaseline = flags.includes("--strict-security-baseline");
+  return runAllGuards(flags.includes("--strict-security-baseline"), deps);
+}
+
+function runAllGuards(strictSecurityBaseline: boolean, deps: RunGuardsCliDeps): number {
   const guards = strictSecurityBaseline ? GUARDS.filter(isSecurityGuard) : GUARDS;
   // Taken before the ts-morph project is built: that is where the memory goes.
-  const releaseSlot = acquireGuardRunSlot();
+  const releaseSlot = (deps.acquireSlot ?? acquireGuardRunSlot)();
   try {
-    const project = buildSharedProject(guards);
+    const project = (deps.buildProject ?? buildSharedProject)(guards);
     printGuardKitBanner(guards.length, project);
     return reportResults(runGuards(guards, project, { strictSecurityBaseline }));
   } finally {

package/src/run-ui-guards.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-// UI-guard bundle (App-Mounting 2.0, infra#208): one process, shared ts-morph
+// UI-guard bundle (App-Mounting 2.0): one process, shared ts-morph
 // Project over the UI enforcement guards.
 import {
   buildSharedProject,

package/src/runtime-isolation-classify.ts

@@ -49,7 +49,6 @@ const PATH_RULES: readonly (readonly [RegExp, Runtime])[] = [
   // sample and import kumiko-testing/e2e; without this rule they read as
   // runtime code importing the test tier. Deliberately not any nested e2e/.
   [/^(?:e2e|packages\/[^/]+\/e2e|samples\/(?:.+\/)?e2e)\//, "test"],
-  [/(?:^|\/)dev\//, "dev"],
   [/(?:^|\/)scripts\//, "tooling"],
   [/(?:^|\/)bin\//, "tooling"],
   [/\/drizzle\/[^/]+\.ts$/, "tooling"],
@@ -75,6 +74,8 @@ const PATH_RULES: readonly (readonly [RegExp, Runtime])[] = [
   // some other package.
   [/(?:^|\/)web\//, "client"],
   [/\/web\.tsx?$/, "client"],
+  // After the web/ carve-out: client code under web/dev/ must stay client.
+  [/(?:^|\/)dev\//, "dev"],
   [/^packages\/framework\/src\/(?:time|utils|engine\/types|errors)\//, "client"],
 
   // More single-file carve-outs, same "package marker is coarser than the
@@ -108,7 +109,7 @@ export function classifyByPath(repoRelativePath: string): Runtime | null {
  * for `kumiko-build` entries (`resolveClientEntries` in kumiko-framework's
  * `packages/server-runtime/src/build-prod-bundle.ts`): `src/client.tsx`/
  * `src/client.ts` (single-entry) or `src/client-<suffix>.tsx?` (declared via
- * package.json `kumiko.clientEntries`, fw#2320 — no longer auto-discovered
+ * package.json `kumiko.clientEntries`; no longer auto-discovered
  * by this filename alone). Framework/enterprise packages never match —
  * their sources live under `packages/*\/src/`, not a repo-root `src/`. Kept
  * independent of the framework's own regex (cross-package import would be a