@cosmicdrift/kumiko-guards 0.388.0 → 0.389.0

package/README.md

@@ -77,8 +77,9 @@ workspace it runs a tracked `scripts/check-wt.sh` if present, otherwise the
 worktree's own `package.json` scripts `typecheck`, `lint`, `test`, and
 `test:dom` (whichever are declared), directly in the worktree — the parent's
 `bun check` would otherwise check the main checkout instead. There is no
-bypass switch. A `check-wt.sh` that wraps this hook sets `KUMIKO_CHECK_WT=1`
-so the hook does not call it again.
+bypass switch. A `check-wt.sh` that wraps this hook (via `exec` or as a child
+process) is recognised by process ancestry, so the hook does not call it
+again; an exported variable cannot skip it.
 
 Extension point: a tracked, executable `scripts/pre-push-extra.sh` runs
 before the main check in every branch (worktree, parent-scoped, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-guards",
-  "version": "0.388.0",
+  "version": "0.389.0",
   "description": "AST-based security guards for Kumiko repos: direct-fs/fetch, tenant escalation, admin-API, escape hatches and related checks, run over a shared ts-morph project.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -51,7 +51,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
-    "@cosmicdrift/kumiko-framework": "0.388.0"
+    "@cosmicdrift/kumiko-framework": "0.389.0"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-framework": {
@@ -59,6 +59,6 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-framework": "0.388.0"
+    "@cosmicdrift/kumiko-framework": "0.389.0"
   }
 }

package/src/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Guard against hand-made event and membership SQL in tests",
+    "detail": "Flags INSERT INTO / UPDATE kumiko_events and CREATE TABLE read_tenant_memberships in test files. Seed through append() or runSeedWritesAt() and unsafeCreateEntityTable with seedRow instead. Perf bulk seeds and the ordering tests that hold a transaction open are allowlisted."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "pre-push re-entry detection no longer an env switch",
+    "detail": "Before delegating to a tracked scripts/check-wt.sh the hook records its own PID in KUMIKO_CHECK_WT_OWNER and treats a run as re-entry only when that PID is an ancestor of the current process, whether check-wt.sh execs or spawns the hook. KUMIKO_CHECK_WT=1 is ignored, so it cannot skip check-wt.sh; wrappers that still set it need no change."
+  },
   {
     "version": "0.388.0",
     "type": "improvement",

package/src/guard-no-date-api.ts

@@ -101,13 +101,13 @@ const ALLOWLIST = [
   // Number.isNaN(d.getTime()) as a validity check.
   /packages\/framework\/src\/pipeline\/entity-cache\.ts$/,
   // Event-store insertSubsequentEvent: raw SQL row.created_at can be Date|string
-  // (postgres-js driver-config dependent), normalised to Temporal.Instant via
+  // (driver-config dependent), normalised to Temporal.Instant via
   // .getTime() bridge.
   /packages\/framework\/src\/event-store\/event-store\.ts$/,
   // HTTP Last-Modified/ETag header: Bun/Node Response API expects a native
   // Date object from fs.Stats.mtimeMs — wire boundary, not a Temporal format.
   /packages\/server-runtime\/src\/run-prod-app-static-files\.ts$/,
-  // postgres-js timestamptz columns arrive as native Date (driver wire format,
+  // timestamptz columns arrive as native Date (driver wire format,
   // same reason as packages/framework/src/db/ above).
   /packages\/publish\/src\/rollback\.ts$/,
 ];

package/src/guard-no-direct-fs.ts

@@ -115,6 +115,12 @@ const ALLOWLIST: readonly AllowEntry[] = [
     repo: "kumiko-framework",
     pattern: /^packages\/server-runtime\/src\/run-prod-app-static-files\.ts$/,
   },
+  // Package lookup for the build and the dev server: existence check for
+  // node_modules/<pkg>/package.json above a directory, no request input as a path.
+  {
+    repo: "kumiko-framework",
+    pattern: /^packages\/server-runtime\/src\/resolve-installed-package\.ts$/,
+  },
 
   // create-kumiko-app: Scaffolding-CLI.
   { repo: "kumiko-framework", pattern: /^packages\/create-kumiko-app\/src\/manifest\.ts$/ },

package/src/guard-restricted-symbols.ts

@@ -52,6 +52,8 @@ const ALLOWLIST = [
   /^packages\/framework\/src\/event-store\/index\.ts$/,
   /^packages\/framework\/src\/event-store\/tenant-db-append\.ts$/,
   /^packages\/bundled-features\/src\/cap-counter\/cap-reservation\.ts$/,
+  // Catch-up of a missing terminal extract event in the caller tenant's own stream; JobContext has no appendEvent.
+  /^packages\/bundled-features\/src\/document-ingest-foundation\/append-missing-extract-event\.ts$/,
   /^packages\/bundled-features\/src\/user-data-rights-defaults\/hooks\/delivery-attempt\.userdata-hook\.ts$/,
   /^packages\/framework\/src\/db\/tenant-db\.ts$/,
   /^packages\/framework\/src\/db\/index\.ts$/,

package/src/guard-test-es-fixtures.ts

@@ -0,0 +1,83 @@
+#!/usr/bin/env bun
+/**
+ * Guard: tests seed event-sourced state through the event store, not through
+ * hand-written SQL. Flags, in test files, string/template literals with
+ *   (a) INSERT INTO / UPDATE against kumiko_events (use append / runSeedWritesAt)
+ *   (b) CREATE TABLE ... read_tenant_memberships (use unsafeCreateEntityTable with
+ *       tenantMembershipEntity and seedRow, so the schema cannot drift from the entity)
+ *
+ * Usage:
+ *   bun packages/guards/src/guard-test-es-fixtures.ts
+ */
+import type { SourceFile } from "ts-morph";
+import { SyntaxKind } from "ts-morph";
+import {
+  type AstGuard,
+  type GuardViolation,
+  relFromRepoRoot,
+  runStandalone,
+  type ScanSpec,
+} from "./_lib/guard-kit";
+import { type RepoRoot, resolveRepoRoots } from "./_lib/roots";
+
+const SCAN: ScanSpec = { scope: "tests", extensions: ["ts"] };
+
+// Bulk seeding of thousands of events through append() would take minutes; these
+// perf tests measure the read path on a finished stream, not the seed phase.
+// The concurrent-commit ordering tests hold a transaction open and need explicit event
+// ids/versions, which append() does not expose.
+// The guards' own tests carry the forbidden SQL as fixture strings.
+const ALLOWLIST: readonly RegExp[] = [
+  /^packages\/framework\/src\/event-store\/__tests__\/perf\.integration\.test\.ts$/,
+  /^packages\/framework\/src\/pipeline\/__tests__\/perf-rebuild\.integration\.test\.ts$/,
+  /^packages\/framework\/src\/pipeline\/__tests__\/event-dispatcher-commit-order\.integration\.test\.ts$/,
+  /^packages\/framework\/src\/pipeline\/__tests__\/event-dispatcher-start-from\.integration\.test\.ts$/,
+  /^packages\/framework\/src\/pipeline\/__tests__\/msp-rebuild\.integration\.test\.ts$/,
+  /^packages\/framework\/src\/pipeline\/__tests__\/projection-rebuild\.integration\.test\.ts$/,
+  /^packages\/guards\/src\/__tests__\//,
+];
+
+const EVENT_WRITE_RE = /\b(INSERT\s+INTO|UPDATE)\s+["`]?kumiko_events\b/i;
+const MEMBERSHIP_DDL_RE = /\bCREATE\s+TABLE\b[^;]*?\bread_tenant_memberships\b/i;
+
+const LITERAL_KINDS = [
+  SyntaxKind.StringLiteral,
+  SyntaxKind.NoSubstitutionTemplateLiteral,
+  SyntaxKind.TemplateExpression,
+];
+
+function violationMessage(text: string): string | undefined {
+  const write = EVENT_WRITE_RE.exec(text);
+  if (write)
+    return `raw ${write[0].replace(/\s+/g, " ")} in a test: seed via append() or runSeedWritesAt()`;
+  if (MEMBERSHIP_DDL_RE.test(text)) {
+    return "hand-written read_tenant_memberships DDL in a test: use unsafeCreateEntityTable(db, tenantMembershipEntity)";
+  }
+  return undefined;
+}
+
+function collect(sourceFile: SourceFile, roots: readonly RepoRoot[]): GuardViolation[] {
+  const file = relFromRepoRoot(sourceFile.getFilePath(), roots);
+  if (ALLOWLIST.some((re) => re.test(file))) return [];
+  const violations: GuardViolation[] = [];
+  for (const kind of LITERAL_KINDS) {
+    for (const node of sourceFile.getDescendantsOfKind(kind)) {
+      const message = violationMessage(node.getText());
+      if (message) violations.push({ file, line: node.getStartLineNumber(), message });
+    }
+  }
+  return violations;
+}
+
+export const guard: AstGuard = {
+  name: "Test-ES-Fixtures Guard",
+  scan: SCAN,
+  hint:
+    "Seed events with append() (runSeedWritesAt for backdating) and membership rows with " +
+    "seedRow on a table made by unsafeCreateEntityTable; bulk perf seeds belong in the guard allowlist with a Why.",
+  run(files, roots: readonly RepoRoot[] = resolveRepoRoots()) {
+    return { violations: files.flatMap((sf) => collect(sf, roots)) };
+  },
+};
+
+if (import.meta.main) runStandalone(guard);

package/src/pre-push.sh

@@ -151,13 +151,25 @@ fi
 # canonical sibling path instead of this worktree — checking the wrong
 # code. Run the worktree-local check only when scripts/check-wt.sh is
 # tracked and executable (untracked/symlink stubs must not hijack push).
-# A check-wt.sh that wraps this hook sets KUMIKO_CHECK_WT=1 so it is not re-entered.
-if [ "${KUMIKO_CHECK_WT:-0}" != "1" ] \
+# Re-entry from the wrapping check-wt.sh is detected by process ancestry: the
+# hook records its own PID in KUMIKO_CHECK_WT_OWNER before delegating, so a
+# freely exported variable cannot skip the tracked check-wt.sh.
+is_reentry_from_check_wt() {
+  reentry_pid=$$
+  case "${KUMIKO_CHECK_WT_OWNER:-}" in '' | *[!0-9]*) return 1 ;; esac
+  while [ -n "$reentry_pid" ] && [ "$reentry_pid" -gt 1 ]; do
+    [ "$reentry_pid" = "$KUMIKO_CHECK_WT_OWNER" ] && return 0
+    reentry_pid=$(ps -o ppid= -p "$reentry_pid" 2>/dev/null | tr -d ' ')
+  done
+  return 1
+}
+
+if ! is_reentry_from_check_wt \
    && [ "$(git rev-parse --path-format=absolute --git-dir)" != "$GIT_COMMON_DIR" ] \
    && git -C "$REPO_ROOT" ls-files --error-unmatch scripts/check-wt.sh >/dev/null 2>&1 \
    && [ -x "$REPO_ROOT/scripts/check-wt.sh" ]; then
   echo "[pre-push] worktree detected — worktree check (see scripts/check-wt.sh)…"
-  cd "$REPO_ROOT" && exec "$REPO_ROOT/scripts/check-wt.sh"
+  cd "$REPO_ROOT" && KUMIKO_CHECK_WT_OWNER=$$ exec "$REPO_ROOT/scripts/check-wt.sh"
 fi
 
 # Runs a guard bin from the worktree's or the parent's node_modules/.bin

package/src/run-guards.ts

@@ -47,6 +47,7 @@ import { guard as restrictedSymbols } from "./guard-restricted-symbols";
 import { guard as screenConventions } from "./guard-screen-conventions";
 import { guard as silentSkip } from "./guard-silent-skip";
 import { guard as tenantEscalation } from "./guard-tenant-escalation";
+import { guard as testEsFixtures } from "./guard-test-es-fixtures";
 import { guard as testTemplateDrift } from "./guard-test-template-drift";
 import { guard as testTimeouts } from "./guard-test-timeouts";
 import { guard as unsafeJsonParse } from "./guard-unsafe-json-parse";
@@ -81,6 +82,7 @@ export const GUARDS = [
   appFeatureStructure,
   libTestCoverage,
   testTimeouts,
+  testEsFixtures,
   testTemplateDrift,
   fileSize,
   commentIssueRefOnly,