@cosmicdrift/kumiko-guards 0.387.0 → 0.389.0

package/src/guard-thin-wrappers.ts

@@ -335,16 +335,51 @@ function extractMarkerReason(node: FnNode): string | null {
   return null;
 }
 
+// A typed lookup table (`const T: Record<K, Fn> = {…}` or `{…} satisfies …`) fixes one
+// signature per slot; a one-call entry adapts that signature, so inlining it would mean
+// dropping the table, not the wrapper.
+function isTypedTableLiteral(literal: Node): boolean {
+  let parent = literal.getParent();
+  while (parent?.isKind(SyntaxKind.AsExpression)) parent = parent.getParent();
+  if (parent?.isKind(SyntaxKind.SatisfiesExpression)) return true;
+  return parent?.isKind(SyntaxKind.VariableDeclaration) === true && !!parent.getTypeNode();
+}
+
+function collectTypedTableValueNames(sf: SourceFile): Set<string> {
+  const names = new Set<string>();
+  for (const literal of sf.getDescendantsOfKind(SyntaxKind.ObjectLiteralExpression)) {
+    if (!isTypedTableLiteral(literal)) continue;
+    for (const property of literal.getProperties()) {
+      if (property.isKind(SyntaxKind.ShorthandPropertyAssignment)) names.add(property.getName());
+      if (!property.isKind(SyntaxKind.PropertyAssignment)) continue;
+      const value = property.getInitializer();
+      if (value?.isKind(SyntaxKind.Identifier)) names.add(value.getText());
+    }
+  }
+  return names;
+}
+
+function isInlineTypedTableValue(node: FnNode): boolean {
+  const property = node.getParent();
+  const literal = property?.isKind(SyntaxKind.PropertyAssignment)
+    ? property.getParent()
+    : undefined;
+  return literal !== undefined && isTypedTableLiteral(literal);
+}
+
 // ── Scan ──────────────────────────────────────────────────────────────────
 
 export function collectFindings(sf: SourceFile): Finding[] {
   const file = path.relative(ROOT, sf.getFilePath());
   const findings: Finding[] = [];
+  const typedTableValueNames = collectTypedTableValueNames(sf);
 
   const check = (node: FnNode) => {
     const fnName = getFnName(node);
     // skip: anonymous functions cannot be reported by name
     if (!fnName) return;
+    // skip: a typed table slot, see isTypedTableLiteral
+    if (typedTableValueNames.has(fnName) || isInlineTypedTableValue(node)) return;
 
     const callee = getSingleDirectCallee(node);
     // skip: not a single-callee wrapper

package/src/pre-push.sh

@@ -18,8 +18,8 @@
 #      sub-repo's own package.json `test` script — refuses the push if that
 #      script is missing.
 #
-# Before the checks below, the hook runs a gitleaks scan of origin/main..HEAD
-# when the binary is installed.
+# Before the checks below, the hook runs a gitleaks scan of origin/main..<pushed sha>
+# for every pushed ref when the binary is installed.
 #
 # Extension point: a tracked, executable scripts/pre-push-extra.sh runs
 # before the main check in every branch above, with KUMIKO_PUSH_REPO_ROOT
@@ -123,11 +123,27 @@ if ! command -v gitleaks >/dev/null 2>&1; then
 elif ! git -C "$REPO_ROOT" rev-parse --verify --quiet origin/main >/dev/null 2>&1; then
   echo "[pre-push] origin/main not found — secret scan skipped" >&2
 else
-  echo "[pre-push] gitleaks git origin/main..HEAD"
-  if ! (cd "$REPO_ROOT" && gitleaks git --no-banner --redact --log-opts="origin/main..HEAD" .); then
-    echo "[pre-push] gitleaks found secrets — refusing push" >&2
-    exit 1
+  # git passes "<local ref> <local sha> <remote ref> <remote sha>" per pushed ref on stdin;
+  # scan those tips (not HEAD), skip deletes. Without stdin (direct call) fall back to HEAD.
+  SCAN_TIPS=""
+  PUSH_LINES=0
+  if [ ! -t 0 ]; then
+    while read -r _local_ref LOCAL_SHA _remote_ref _remote_sha; do
+      [ -n "$LOCAL_SHA" ] || continue
+      PUSH_LINES=$((PUSH_LINES + 1))
+      case "$LOCAL_SHA" in *[!0]*) SCAN_TIPS="$SCAN_TIPS $LOCAL_SHA" ;; esac
+    done
+  fi
+  if [ "$PUSH_LINES" -eq 0 ]; then
+    SCAN_TIPS=" HEAD"
   fi
+  for SCAN_TIP in $SCAN_TIPS; do
+    echo "[pre-push] gitleaks git origin/main..$SCAN_TIP"
+    if ! (cd "$REPO_ROOT" && gitleaks git --no-banner --redact --log-opts="origin/main..$SCAN_TIP" .); then
+      echo "[pre-push] gitleaks found secrets — refusing push" >&2
+      exit 1
+    fi
+  done
 fi
 
 # infra#559/#569: from a worktree, `--git-common-dir` resolves to the main
@@ -135,13 +151,25 @@ fi
 # canonical sibling path instead of this worktree — checking the wrong
 # code. Run the worktree-local check only when scripts/check-wt.sh is
 # tracked and executable (untracked/symlink stubs must not hijack push).
-# A check-wt.sh that wraps this hook sets KUMIKO_CHECK_WT=1 so it is not re-entered.
-if [ "${KUMIKO_CHECK_WT:-0}" != "1" ] \
+# Re-entry from the wrapping check-wt.sh is detected by process ancestry: the
+# hook records its own PID in KUMIKO_CHECK_WT_OWNER before delegating, so a
+# freely exported variable cannot skip the tracked check-wt.sh.
+is_reentry_from_check_wt() {
+  reentry_pid=$$
+  case "${KUMIKO_CHECK_WT_OWNER:-}" in '' | *[!0-9]*) return 1 ;; esac
+  while [ -n "$reentry_pid" ] && [ "$reentry_pid" -gt 1 ]; do
+    [ "$reentry_pid" = "$KUMIKO_CHECK_WT_OWNER" ] && return 0
+    reentry_pid=$(ps -o ppid= -p "$reentry_pid" 2>/dev/null | tr -d ' ')
+  done
+  return 1
+}
+
+if ! is_reentry_from_check_wt \
    && [ "$(git rev-parse --path-format=absolute --git-dir)" != "$GIT_COMMON_DIR" ] \
    && git -C "$REPO_ROOT" ls-files --error-unmatch scripts/check-wt.sh >/dev/null 2>&1 \
    && [ -x "$REPO_ROOT/scripts/check-wt.sh" ]; then
   echo "[pre-push] worktree detected — worktree check (see scripts/check-wt.sh)…"
-  cd "$REPO_ROOT" && exec "$REPO_ROOT/scripts/check-wt.sh"
+  cd "$REPO_ROOT" && KUMIKO_CHECK_WT_OWNER=$$ exec "$REPO_ROOT/scripts/check-wt.sh"
 fi
 
 # Runs a guard bin from the worktree's or the parent's node_modules/.bin

package/src/repo-manifest/app-ports/static-app-config.ts

@@ -39,20 +39,24 @@ function propertyName(node: Node): string | undefined {
 }
 
 function objectProperty(object: ObjectLiteralExpression, name: string): Node | undefined {
+  let found: Node | undefined;
+  let opaqueAfterFound = false;
   for (const property of object.getProperties()) {
-    if (
-      property.isKind(SyntaxKind.SpreadAssignment) ||
-      property.isKind(SyntaxKind.ShorthandPropertyAssignment)
-    ) {
-      throw new StaticConfigError(
-        `${name}: spread and shorthand properties cannot be read statically`,
-      );
-    }
-    if (propertyName(property) === name && property.isKind(SyntaxKind.PropertyAssignment)) {
-      return property.getInitializerOrThrow();
+    if (property.isKind(SyntaxKind.SpreadAssignment)) {
+      opaqueAfterFound = true;
+    } else if (property.isKind(SyntaxKind.ShorthandPropertyAssignment)) {
+      if (property.getName() === name) opaqueAfterFound = true;
+    } else if (propertyName(property) === name && property.isKind(SyntaxKind.PropertyAssignment)) {
+      found = property.getInitializerOrThrow();
+      opaqueAfterFound = false;
     }
   }
-  return undefined;
+  if (opaqueAfterFound) {
+    throw new StaticConfigError(
+      `${name}: spread and shorthand properties cannot be read statically`,
+    );
+  }
+  return found;
 }
 
 function numericLiteral(node: Node | undefined, path: string): number {

package/src/run-guards.ts

@@ -47,6 +47,7 @@ import { guard as restrictedSymbols } from "./guard-restricted-symbols";
 import { guard as screenConventions } from "./guard-screen-conventions";
 import { guard as silentSkip } from "./guard-silent-skip";
 import { guard as tenantEscalation } from "./guard-tenant-escalation";
+import { guard as testEsFixtures } from "./guard-test-es-fixtures";
 import { guard as testTemplateDrift } from "./guard-test-template-drift";
 import { guard as testTimeouts } from "./guard-test-timeouts";
 import { guard as unsafeJsonParse } from "./guard-unsafe-json-parse";
@@ -81,6 +82,7 @@ export const GUARDS = [
   appFeatureStructure,
   libTestCoverage,
   testTimeouts,
+  testEsFixtures,
   testTemplateDrift,
   fileSize,
   commentIssueRefOnly,
@@ -97,6 +99,8 @@ const GUARD_NAME_PREFIX = "--guard=";
 
 export type RunGuardsCliDeps = {
   readonly writeBaselineRoots?: readonly RepoRoot[];
+  readonly acquireSlot?: () => () => void;
+  readonly buildProject?: typeof buildSharedProject;
 };
 
 // Shared by the direct `bun run-guards.ts` invocation below and by the
@@ -115,7 +119,7 @@ export function runGuardsCli(argv: readonly string[], deps: RunGuardsCliDeps = {
     return 1;
   }
   if (flags.includes("--explain")) {
-    for (const line of explainGuards(GUARDS, buildSharedProject(GUARDS))) {
+    for (const line of explainGuards(GUARDS, (deps.buildProject ?? buildSharedProject)(GUARDS))) {
       console.log(line);
     }
     return 0;
@@ -155,12 +159,15 @@ export function runGuardsCli(argv: readonly string[], deps: RunGuardsCliDeps = {
     );
     return 0;
   }
-  const strictSecurityBaseline = flags.includes("--strict-security-baseline");
+  return runAllGuards(flags.includes("--strict-security-baseline"), deps);
+}
+
+function runAllGuards(strictSecurityBaseline: boolean, deps: RunGuardsCliDeps): number {
   const guards = strictSecurityBaseline ? GUARDS.filter(isSecurityGuard) : GUARDS;
   // Taken before the ts-morph project is built: that is where the memory goes.
-  const releaseSlot = acquireGuardRunSlot();
+  const releaseSlot = (deps.acquireSlot ?? acquireGuardRunSlot)();
   try {
-    const project = buildSharedProject(guards);
+    const project = (deps.buildProject ?? buildSharedProject)(guards);
     printGuardKitBanner(guards.length, project);
     return reportResults(runGuards(guards, project, { strictSecurityBaseline }));
   } finally {

package/src/runtime-isolation-classify.ts

@@ -49,7 +49,6 @@ const PATH_RULES: readonly (readonly [RegExp, Runtime])[] = [
   // sample and import kumiko-testing/e2e; without this rule they read as
   // runtime code importing the test tier. Deliberately not any nested e2e/.
   [/^(?:e2e|packages\/[^/]+\/e2e|samples\/(?:.+\/)?e2e)\//, "test"],
-  [/(?:^|\/)dev\//, "dev"],
   [/(?:^|\/)scripts\//, "tooling"],
   [/(?:^|\/)bin\//, "tooling"],
   [/\/drizzle\/[^/]+\.ts$/, "tooling"],
@@ -75,6 +74,8 @@ const PATH_RULES: readonly (readonly [RegExp, Runtime])[] = [
   // some other package.
   [/(?:^|\/)web\//, "client"],
   [/\/web\.tsx?$/, "client"],
+  // After the web/ carve-out: client code under web/dev/ must stay client.
+  [/(?:^|\/)dev\//, "dev"],
   [/^packages\/framework\/src\/(?:time|utils|engine\/types|errors)\//, "client"],
 
   // More single-file carve-outs, same "package marker is coarser than the