@event4u/agent-config 16.0.0 → 16.2.0

package/src/scripts/lint_deny_text.ts

@@ -0,0 +1,419 @@
+#!/usr/bin/env tsx
+/**
+ * A deny never names its own kill switch.
+ *
+ * road-to-a-kernel-that-guards-its-plumbing 1.3.
+ *
+ * A blocking concern refuses a tool call and then prints a message to the one
+ * party that wanted the call to succeed. If that message names the environment
+ * variable, the `export` line or the settings key that turns the guard off, the
+ * refusal is a speed bump with instructions attached. The reader most motivated
+ * to follow them is the agent that was just refused.
+ *
+ * The rule is therefore about the OUTPUT, not about the mechanism: a kill
+ * switch may exist, may be documented in the concern's header, may be listed in
+ * the manifest and in the contract. It may not appear in the text the refusal
+ * prints. Two of the nine blocking concerns carry a kill switch today and both
+ * name it only in a comment — this gate is what keeps that true, rather than
+ * true-so-far.
+ *
+ * WHAT IS SCANNED, stated precisely because the boundary is the whole design.
+ *
+ * The corpus is the `severity: blocking` concerns in `hook_manifest.yaml`, read
+ * from the manifest rather than listed here, so a guard added there joins the
+ * corpus without an edit. Within each, the unit is a MESSAGE-SHAPED string
+ * literal — comments stripped first, then any literal containing whitespace.
+ *
+ * The prose test is the discriminator, and it is what makes the settings-key
+ * rule usable at all: `'hooks.enabled'` as a lookup key is how a concern reads
+ * its own configuration and is not a message, while
+ * `'set hooks.enabled: false to skip'` is. A rule that fired on the bare key
+ * would fire on every concern that reads a setting, which is the false-positive
+ * shape that gets a young gate disabled.
+ *
+ * WHAT IT DOES NOT SEE, so nobody reads more into a green than is there:
+ * a message assembled at runtime from non-literal parts, a message in a module
+ * the concern imports, and a kill switch named in a way none of the three
+ * patterns matches. This is a pattern gate over source text, not a proof about
+ * emitted bytes.
+ *
+ * Exit codes: 0 clean · 1 a deny names a bypass · 2 the corpus could not be read.
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import * as yaml from 'js-yaml';
+
+import { GateLedger } from './_lib/gate_ledger.js';
+import { runGateCli, runSelfTest } from './_lib/gate_self_test.js';
+import { assertScanned, reportScanned } from './_lib/scan_scope.js';
+
+const _HERE = fileURLToPath(import.meta.url);
+const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
+
+export const GATE = 'lint_deny_text';
+
+const MANIFEST_REL = 'src/scripts/hook_manifest.yaml';
+
+/**
+ * Top-level settings keys, so `hooks.enabled` reads as a settings path and
+ * `payload.tool_input` does not.
+ *
+ * A fixed list rather than a parse of the template: the template is a large
+ * file with placeholder substitutions, and the gate needs the discriminator to
+ * be stable and reviewable in a diff. Adding a top-level settings section is
+ * the moment to add it here; a missing entry costs a miss, never a false
+ * refusal.
+ */
+export const SETTINGS_ROOTS: readonly string[] = [
+    'ai_team',
+    'augment',
+    'chat_history',
+    'code_style',
+    'commands',
+    'consistency',
+    'continuity',
+    'cost',
+    'decision_engine',
+    'delivery',
+    'design',
+    'emergency',
+    'execution',
+    'github',
+    'hooks',
+    'knowledge',
+    'memory',
+    'model',
+    'onboarding',
+    'personal',
+    'pipelines',
+    'planning',
+    'profile',
+    'project',
+    'projection',
+    'quality',
+    'reasoning',
+    'roadmap',
+    'screenshots',
+    'subagents',
+    'telegraph',
+    'tokens',
+    'update_check',
+    'verbosity',
+];
+
+export interface DenyFinding {
+    readonly concern: string;
+    readonly file: string;
+    readonly kind: 'env-assignment' | 'export-line' | 'settings-key';
+    readonly text: string;
+}
+
+/**
+ * Characters after which a `/` begins a REGEX literal rather than a division.
+ *
+ * Regex handling is not a nicety here, it is the difference between a working
+ * gate and a nonsense one — measured on the first run against the real tree.
+ * `turn_end_gate_hook.ts` carries `/\bI (wi)ll\b/i`; without this the
+ * apostrophe inside a pattern like `/\bI'll\b/` opens a phantom string literal
+ * that swallows the next few hundred characters of real code and comments, and
+ * the gate then reports `export function …` as deny text. Three such
+ * false positives, all in one file, all from one unhandled token class.
+ */
+const REGEX_PRECEDERS = new Set('(,=:[!&|?{};+-*%~^<>'.split(''));
+
+/** Strip `//` and block comments, preserving string literals and regexes. */
+export function stripComments(src: string): string {
+    let out = '';
+    let i = 0;
+    let quote: string | null = null;
+    let lastSignificant = '';
+    while (i < src.length) {
+        const c = src[i] as string;
+        const next = src[i + 1];
+        if (quote !== null) {
+            out += c;
+            if (c === '\\') {
+                out += src[i + 1] ?? '';
+                i += 2;
+                continue;
+            }
+            if (c === quote) {
+                quote = null;
+            }
+            i += 1;
+            continue;
+        }
+        if (c === "'" || c === '"' || c === '`') {
+            quote = c;
+            out += c;
+            i += 1;
+            lastSignificant = c;
+            continue;
+        }
+        if (c === '/' && next === '/') {
+            while (i < src.length && src[i] !== '\n') i += 1;
+            continue;
+        }
+        if (c === '/' && next === '*') {
+            i += 2;
+            while (i < src.length && !(src[i] === '*' && src[i + 1] === '/')) i += 1;
+            i += 2;
+            continue;
+        }
+        if (c === '/' && (lastSignificant === '' || REGEX_PRECEDERS.has(lastSignificant))) {
+            // Regex literal — consumed whole, emitted as a placeholder so the
+            // scanner below never sees its contents as a message.
+            i += 1;
+            let inClass = false;
+            while (i < src.length) {
+                const r = src[i] as string;
+                if (r === '\\') {
+                    i += 2;
+                    continue;
+                }
+                if (r === '[') inClass = true;
+                else if (r === ']') inClass = false;
+                else if (r === '/' && !inClass) break;
+                else if (r === '\n') break;
+                i += 1;
+            }
+            i += 1;
+            out += '0';
+            lastSignificant = '0';
+            continue;
+        }
+        out += c;
+        i += 1;
+        if (!/\s/.test(c)) {
+            lastSignificant = c;
+        }
+    }
+    return out;
+}
+
+/** Message-shaped string literals — comments already stripped. */
+export function messageLiterals(src: string): string[] {
+    const out: string[] = [];
+    const re = /'((?:[^'\\]|\\.)*)'|"((?:[^"\\]|\\.)*)"|`((?:[^`\\]|\\.)*)`/g;
+    for (const m of src.matchAll(re)) {
+        const body = m[1] ?? m[2] ?? m[3] ?? '';
+        if (/\s/.test(body)) {
+            out.push(body);
+        }
+    }
+    return out;
+}
+
+const ENV_ASSIGNMENT_RE = /AGENT_CONFIG_[A-Z0-9_]+\s*=/;
+const EXPORT_RE = /(^|[\s`'"(])export\s/;
+
+function settingsKeyIn(text: string): boolean {
+    for (const root of SETTINGS_ROOTS) {
+        const re = new RegExp(`(^|[^A-Za-z0-9_.])${root}\\.[a-z][a-z0-9_]*`);
+        if (re.test(text)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/** Findings for one concern's source text. */
+export function scanSource(concern: string, file: string, src: string): DenyFinding[] {
+    const out: DenyFinding[] = [];
+    for (const text of messageLiterals(stripComments(src))) {
+        if (ENV_ASSIGNMENT_RE.test(text)) {
+            out.push({ concern, file, kind: 'env-assignment', text });
+            continue;
+        }
+        if (EXPORT_RE.test(text)) {
+            out.push({ concern, file, kind: 'export-line', text });
+            continue;
+        }
+        if (settingsKeyIn(text)) {
+            out.push({ concern, file, kind: 'settings-key', text });
+        }
+    }
+    return out;
+}
+
+/** `severity: blocking` concerns, as `[name, script]`, read from the manifest. */
+export function blockingConcerns(manifestText: string): Array<[string, string]> {
+    const doc = yaml.load(manifestText) as { concerns?: Record<string, Record<string, unknown>> };
+    const concerns = doc?.concerns ?? {};
+    const out: Array<[string, string]> = [];
+    for (const [name, body] of Object.entries(concerns)) {
+        if (String(body['severity'] ?? '') !== 'blocking') continue;
+        const script = body['script'];
+        if (typeof script === 'string') out.push([name, script]);
+    }
+    return out.sort((a, b) => a[0].localeCompare(b[0]));
+}
+
+export function scan(root: string): { findings: DenyFinding[]; scanned: number } {
+    const manifest = path.join(root, MANIFEST_REL);
+    if (!fs.existsSync(manifest)) {
+        return { findings: [], scanned: 0 };
+    }
+    const findings: DenyFinding[] = [];
+    let scanned = 0;
+    for (const [name, script] of blockingConcerns(fs.readFileSync(manifest, 'utf8'))) {
+        const abs = path.join(root, script);
+        if (!fs.existsSync(abs)) continue;
+        scanned += 1;
+        findings.push(...scanSource(name, script, fs.readFileSync(abs, 'utf8')));
+    }
+    return { findings, scanned };
+}
+
+const REASON: Readonly<Record<DenyFinding['kind'], string>> = {
+    'env-assignment': 'names an environment kill switch, with its value',
+    'export-line': 'carries an `export` line the reader can paste',
+    'settings-key': 'names a settings key path',
+};
+
+export function main(argv: readonly string[]): number {
+    if (argv.includes('--self-test')) return selfTest();
+    const rootIdx = argv.indexOf('--root');
+    const root = rootIdx === -1 ? ROOT : (argv[rootIdx + 1] ?? ROOT);
+
+    const { findings, scanned } = scan(root);
+
+    const ledger = new GateLedger(GATE);
+    ledger.plan(findings.map((f) => `${f.concern}:${f.kind}:${f.text.slice(0, 40)}`));
+    for (const f of findings) {
+        ledger.fail(`${f.concern}:${f.kind}:${f.text.slice(0, 40)}`, REASON[f.kind]);
+    }
+
+    // A gate that read nothing has not passed. BEFORE the verdict: a manifest
+    // that moved, or a `severity:` key that was renamed, would otherwise
+    // certify an empty corpus clean.
+    assertScanned({
+        gate: GATE,
+        scanned,
+        units: 'blocking concern(s)',
+        roots: [MANIFEST_REL],
+    });
+    reportScanned({
+        gate: GATE,
+        scanned,
+        units: 'blocking concern(s)',
+        roots: [MANIFEST_REL],
+    });
+    ledger.report();
+
+    if (findings.length > 0) {
+        for (const f of findings) {
+            process.stdout.write(
+                `❌  ${GATE}: ${f.file} (${f.concern}) ${REASON[f.kind]}:\n      ${f.text.slice(0, 200)}\n`,
+            );
+        }
+        process.stdout.write(
+            '\nA blocking concern may HAVE a kill switch. Its refusal message may not name it.\n' +
+                "Move the sentence to the concern's header comment, the manifest entry, or\n" +
+                'docs/contracts/hook-architecture-v1.md — all three are read by people deciding\n' +
+                'whether the guard should exist, and none is read by the agent it just refused.\n',
+        );
+        return 1;
+    }
+
+    process.stdout.write(
+        `✅  ${GATE}: no blocking concern names its own bypass ` +
+            `(${String(scanned)} concern(s) scanned).\n`,
+    );
+    return 0;
+}
+
+function selfTest(): number {
+    const plant = (name: string, body: string): string => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), `deny-text-${name}-`));
+        fs.mkdirSync(path.join(dir, 'src', 'scripts', 'hooks'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'src', 'scripts', 'hook_manifest.yaml'),
+            [
+                'schema_version: 1',
+                'concerns:',
+                '  probe-guard:',
+                '    script: src/scripts/hooks/probe_guard.ts',
+                '    severity: blocking',
+                '  probe-advisory:',
+                '    script: src/scripts/hooks/probe_advisory.ts',
+                '    severity: advisory',
+                '',
+            ].join('\n'),
+            'utf-8',
+        );
+        fs.writeFileSync(path.join(dir, 'src', 'scripts', 'hooks', 'probe_guard.ts'), body, 'utf-8');
+        fs.writeFileSync(
+            path.join(dir, 'src', 'scripts', 'hooks', 'probe_advisory.ts'),
+            "process.stderr.write('set AGENT_CONFIG_X=1 to skip this advice');\n",
+            'utf-8',
+        );
+        return dir;
+    };
+    const emit = (msg: string): string => `process.stderr.write(${JSON.stringify(msg)});\n`;
+    const run = (root: string): number =>
+        runGateCli(ROOT, path.join('src', 'scripts', 'lint_deny_text.ts'), ['--root', root], ROOT);
+
+    return runSelfTest({
+        gate: GATE,
+        minCases: 7,
+        minRejectCases: 3,
+        cases: [
+            {
+                name: 'an empty corpus is refused, not certified green',
+                expect: 'reject',
+                run: () => run(fs.mkdtempSync(path.join(os.tmpdir(), 'deny-text-empty-'))),
+            },
+            {
+                name: 'a deny naming an env kill switch with its value fails',
+                expect: 'reject',
+                run: () => run(plant('env', emit('BLOCKED — set AGENT_CONFIG_X=1 to skip'))),
+            },
+            {
+                name: 'a deny carrying an export line fails',
+                expect: 'reject',
+                run: () => run(plant('export', emit('BLOCKED — run export AC_OFF=1 first'))),
+            },
+            {
+                name: 'a deny naming a settings key path fails',
+                expect: 'reject',
+                run: () => run(plant('settings', emit('BLOCKED — flip hooks.enabled to false'))),
+            },
+            {
+                name: 'a deny that names no bypass passes',
+                expect: 'accept',
+                run: () => run(plant('clean', emit('BLOCKED — rebuild it from its source'))),
+            },
+            {
+                name: 'the kill switch named in a COMMENT passes — the rule is about output',
+                expect: 'accept',
+                run: () =>
+                    run(
+                        plant(
+                            'comment',
+                            '// Kill switch: AGENT_CONFIG_X=1.\n/* or AGENT_CONFIG_Y=1 */\n' +
+                                emit('BLOCKED — rebuild it from its source'),
+                        ),
+                    ),
+            },
+            {
+                name: 'a bare settings key used as a lookup passes — it is not a message',
+                expect: 'accept',
+                run: () => run(plant('lookup', "const k = 'hooks.enabled';\nvoid k;\n")),
+            },
+            {
+                name: 'an ADVISORY concern naming its switch passes — only denials are scanned',
+                expect: 'accept',
+                run: () => run(plant('advisory-only', emit('BLOCKED — rebuild it'))),
+            },
+        ],
+    });
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/lint_exit_codes.ts

@@ -0,0 +1,262 @@
+#!/usr/bin/env tsx
+/**
+ * A hook's exit code comes from the table, never from a numeral.
+ *
+ * road-to-a-kernel-that-guards-its-plumbing 4.1, the enforcing half.
+ * `hooks/exit_codes.ts` is the table; this is what keeps it the only one.
+ *
+ * WHAT THE NUMERALS COST. Thirty-three files under `src/scripts/hooks/` each
+ * declared their own `EXIT_ALLOW = 0` / `EXIT_BLOCK = 1` / `EXIT_WARN = 2`, two
+ * of them under a third name. The danger is not a typo: 1 and 2 mean the
+ * OPPOSITE things on Claude Code from what they mean in this tree's internal
+ * language, which is why `host_semantics.ts` exists to lower one onto the
+ * other. A bare `process.exit(1)` in a concern is a claim about which of the
+ * two dialects the writer had in mind, and the source does not record which.
+ *
+ * WHAT IT SCANS. `.ts` under `src/scripts/hooks/`, refusing a call whose
+ * argument is a bare numeric literal. An identifier is accepted whatever it is
+ * called — this gate does not verify that the identifier came from the table,
+ * because a gate that resolved imports would be a type-checker, and the thing
+ * it would catch (a local `const EXIT_BLOCK = 1` shadowing the import) is
+ * already visible in review as a duplicate declaration. Stated rather than left
+ * for a reader to assume the green covers it.
+ *
+ * WHY THE DISPATCHERS ARE OUT OF SCOPE. The `*-dispatcher.sh` trampolines carry
+ * `process.exit(0)` inside a `node -e` one-liner that reads a workspace root
+ * off stdin. They are shell, they cannot import, and their exit code is the
+ * one-liner's, never a verdict. The table's own header says so; this gate scans
+ * `.ts` only, which is the same boundary stated once more where it is enforced.
+ *
+ * THE TABLE FILE ITSELF is excluded, and that is the one exclusion: it is where
+ * the numerals are DEFINED, so a gate that refused them there would forbid the
+ * fix it exists to require.
+ *
+ * Exit codes: 0 clean · 1 a bare numeral reached `process.exit` · 2 the corpus
+ * could not be read.
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import { GateLedger } from './_lib/gate_ledger.js';
+import { runGateCli, runSelfTest } from './_lib/gate_self_test.js';
+import { reportScanned } from './_lib/scan_scope.js';
+
+const _HERE = fileURLToPath(import.meta.url);
+const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
+
+export const GATE = 'lint_exit_codes';
+
+const HOOKS_REL = path.join('src', 'scripts', 'hooks');
+
+/** The file that DEFINES the numerals. Excluding it is not a carve-out. */
+const TABLE_BASENAME = 'exit_codes.ts';
+
+/**
+ * The fixture import line, ASSEMBLED rather than written out.
+ *
+ * `prepack-check.mjs` scans source text for relative imports and cannot tell a
+ * string literal from a real one, so a fixture containing the words
+ * `from './exit_codes.js'` reads as this file importing a sibling that does not
+ * exist beside it — the table lives under `hooks/`. It reported exactly that
+ * before this was assembled. Splitting the specifier is the smallest change
+ * that keeps the fixture honest about what a passing hook file looks like
+ * without asserting an import this file does not make.
+ */
+const FIXTURE_IMPORT = (name: string): string => `import { ${name} } from '.` + `/${TABLE_BASENAME.replace('.ts', '.js')}';\n`;
+
+/**
+ * `process.exit(<digits>)`, with optional whitespace.
+ *
+ * Deliberately anchored on `process.exit` rather than on any `exit(`: a
+ * concern's own helper named `exit` is not the process boundary, and widening
+ * the pattern to catch it would red on ordinary code.
+ */
+const BARE_EXIT = /process\s*\.\s*exit\s*\(\s*(-?\d+)\s*\)/g;
+
+export interface ExitFinding {
+    readonly file: string;
+    readonly line: number;
+    readonly code: string;
+}
+
+/** Findings in one file's text. Pure, so a test reads the decision. */
+export function findBareExits(rel: string, text: string): ExitFinding[] {
+    const out: ExitFinding[] = [];
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] as string;
+        // A commented example is prose about the rule, not an exit.
+        if (/^\s*(\*|\/\/)/.test(line)) continue;
+        BARE_EXIT.lastIndex = 0;
+        let m: RegExpExecArray | null;
+        while ((m = BARE_EXIT.exec(line)) !== null) {
+            out.push({ file: rel, line: i + 1, code: m[1] as string });
+        }
+    }
+    return out;
+}
+
+function hookFiles(root: string): string[] {
+    const dir = path.join(root, HOOKS_REL);
+    let entries: string[];
+    try {
+        entries = fs.readdirSync(dir);
+    } catch {
+        return [];
+    }
+    return entries
+        .filter((f) => f.endsWith('.ts') && f !== TABLE_BASENAME)
+        .map((f) => path.join(HOOKS_REL, f))
+        .sort();
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    if (argv.includes('--self-test')) return selfTest();
+    const i = argv.indexOf('--root');
+    if (i !== -1 && (argv[i + 1] === undefined || argv[i + 1]?.startsWith('-') === true)) {
+        process.stderr.write(`${GATE}: \`--root\` needs a directory.\n`);
+        return 2;
+    }
+    const root = i === -1 ? ROOT : (argv[i + 1] as string);
+
+    const files = hookFiles(root);
+    const findings: ExitFinding[] = [];
+    // A file the gate cannot READ is not a file it cleared. The first version
+    // of this loop skipped it and then counted it complete, which is a false
+    // green with a number behind it — the exact shape `assertScanned` exists to
+    // refuse one level up, reintroduced inside the loop. Reported by an
+    // independent review before this landed.
+    const unreadable: string[] = [];
+    for (const rel of files) {
+        let text: string;
+        try {
+            text = fs.readFileSync(path.join(root, rel), 'utf-8');
+        } catch {
+            unreadable.push(rel);
+            continue;
+        }
+        findings.push(...findBareExits(rel, text));
+    }
+    if (unreadable.length > 0) {
+        for (const rel of unreadable) {
+            process.stderr.write(`❌  ${GATE}: cannot read ${rel} — the corpus is incomplete.\n`);
+        }
+        return 2;
+    }
+
+    // Before the verdict: a corpus of zero is a gate that read nothing, and a
+    // green over it says the tree is clean when nobody looked.
+    try {
+        reportScanned({ gate: GATE, scanned: files.length, units: 'hook file(s)', roots: [HOOKS_REL] });
+    } catch (exc) {
+        process.stderr.write(`❌  ${String((exc as Error).message)}\n`);
+        return 2;
+    }
+
+    const ledger = new GateLedger(GATE);
+    ledger.plan(files);
+    const failed = new Set(findings.map((f) => f.file));
+    for (const f of findings) {
+        ledger.fail(f.file, `bare exit numeral ${f.code} at line ${String(f.line)}`);
+    }
+    for (const rel of files) if (!failed.has(rel)) ledger.complete(rel);
+    ledger.report();
+
+    if (findings.length > 0) {
+        for (const f of findings) {
+            process.stdout.write(
+                `❌  ${GATE}: ${f.file}:${String(f.line)} exits with the bare numeral ` +
+                    `\`${f.code}\`. Import the name from \`hooks/exit_codes.ts\` — the numbers ` +
+                    'mean opposite things in this tree and on the host, and a numeral records ' +
+                    'neither.\n',
+            );
+        }
+        return 1;
+    }
+    process.stdout.write(
+        `✅  ${GATE}: ${String(files.length)} hook file(s), no bare exit numeral.\n`,
+    );
+    return 0;
+}
+
+function selfTest(): number {
+    const plant = (name: string, body: string): string => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), `exit-codes-${name}-`));
+        fs.mkdirSync(path.join(dir, HOOKS_REL), { recursive: true });
+        fs.writeFileSync(path.join(dir, HOOKS_REL, 'probe_hook.ts'), body, 'utf-8');
+        // The table itself, so the exclusion is exercised rather than assumed.
+        fs.writeFileSync(
+            path.join(dir, HOOKS_REL, TABLE_BASENAME),
+            'export const EXIT_ALLOW = 0;\nprocess.exit(0);\n',
+            'utf-8',
+        );
+        return dir;
+    };
+    const run = (root: string): number =>
+        runGateCli(ROOT, path.join('src', 'scripts', 'lint_exit_codes.ts'), ['--root', root], ROOT);
+
+    return runSelfTest({
+        gate: GATE,
+        minCases: 6,
+        minRejectCases: 4,
+        cases: [
+            {
+                name: 'an empty corpus is refused, not certified green',
+                expect: 'reject',
+                run: () => run(fs.mkdtempSync(path.join(os.tmpdir(), 'exit-codes-empty-'))),
+            },
+            {
+                name: 'a bare deny numeral fails',
+                expect: 'reject',
+                run: () => run(plant('block', 'process.exit(1);\n')),
+            },
+            {
+                name: 'a bare allow numeral fails too — 0 is the one people think is harmless',
+                expect: 'reject',
+                run: () => run(plant('allow', 'process.exit(0);\n')),
+            },
+            {
+                name: 'whitespace inside the call does not hide it',
+                expect: 'reject',
+                run: () => run(plant('spaced', 'process . exit ( 2 );\n')),
+            },
+            {
+                name: 'an imported name passes',
+                expect: 'accept',
+                run: () =>
+                    run(
+                        plant(
+                            'named',
+                            `${FIXTURE_IMPORT('EXIT_ALLOW')}process.exit(EXIT_ALLOW);\n`,
+                        ),
+                    ),
+            },
+            {
+                // The table defines the numerals; refusing them there would
+                // forbid the fix this gate exists to require. Exercised, not
+                // assumed — the plant writes a bare exit into it every time.
+                name: 'the table file is excluded even though it carries a numeral',
+                expect: 'accept',
+                run: () =>
+                    run(
+                        plant(
+                            'table',
+                            `${FIXTURE_IMPORT('EXIT_WARN')}process.exit(EXIT_WARN);\n`,
+                        ),
+                    ),
+            },
+        ],
+    });
+}
+
+function _isCliEntry(): boolean {
+    const entry = process.argv[1];
+    return entry !== undefined && import.meta.url === pathToFileURL(entry).href;
+}
+
+if (_isCliEntry()) {
+    process.exit(main());
+}