@event4u/agent-config 9.12.0 → 9.13.0

package/src/scripts/code_graph/loader.ts

@@ -2,10 +2,11 @@
  * WASM tree-sitter loader for the code-graph engine.
  *
  * Pinned pair (ABI-verified 2026-07-23): `web-tree-sitter@0.24.7` +
- * `tree-sitter-wasms@0.1.13` → grammar ABI 14. The ABI smoke test
- * (`tests/scripts/code_graph_abi.test.ts`) asserts this pairing loads and
- * parses before merge; a bump to either dependency re-runs it. No network,
- * no node-gyp — grammars load from `node_modules` via the resolved path.
+ * `tree-sitter-wasms@0.1.13` → grammar ABI 14. The ABI smoke test lives in
+ * `tests/scripts/code_graph.test.ts`; it runs in this repo because the pair is
+ * a devDependency. Consumers install neither (see `INSTALL_HINT` below). No
+ * network, no node-gyp — grammars load from `node_modules` via the resolved
+ * path.
  *
  * web-tree-sitter 0.24.x is CJS with a single default export (the Parser
  * class) and the classic `Parser.Language.load()` API; we reach it through
@@ -51,10 +52,32 @@ interface ParserStatic {
     Language: { load(wasmPath: string): Promise<TsLanguage> };
 }
 
+/**
+ * The parser pair is a devDependency, not a runtime one: this repo's tests still
+ * exercise the loader, while a consumer install resolves neither. The engine is
+ * permanently `enabled: false` (measured recall 0.365 vs grep 0.797), so
+ * shipping ~51 MB of WASM to every consumer for a path none of them can reach
+ * was pure install cost. A consumer re-enabling the engine installs the
+ * ABI-locked pair themselves — this message carries the pin, because
+ * `check_dependency_floors` only scans the `dependencies` block.
+ */
+const INSTALL_HINT =
+    'the code-graph engine needs its parser pair, which this package no longer ships to consumers ' +
+    '(the engine is disabled by a recorded null result). Install the ABI-locked pair:\n' +
+    '  npm i web-tree-sitter@0.24.7 tree-sitter-wasms@0.1.13\n' +
+    'Both versions are exact on purpose — the pair is ABI-coupled (grammar ABI 14) ' +
+    'and must move together.';
+
 let _wasmDir: string | null = null;
 function wasmDir(): string {
     if (_wasmDir === null) {
-        _wasmDir = path.join(path.dirname(require.resolve('tree-sitter-wasms/package.json')), 'out');
+        let pkgJson: string;
+        try {
+            pkgJson = require.resolve('tree-sitter-wasms/package.json');
+        } catch {
+            throw new Error(`tree-sitter-wasms is not installed — ${INSTALL_HINT}`);
+        }
+        _wasmDir = path.join(path.dirname(pkgJson), 'out');
     }
     return _wasmDir;
 }
@@ -72,7 +95,13 @@ function _Parser(): ParserStatic {
     // Require exactly once and cache the class reference — repeated
     // createRequire calls under tsx can hand back a module view whose static
     // `Language` is not yet populated, which breaks the second grammar load.
-    if (_mod === null) _mod = require('web-tree-sitter') as ParserStatic;
+    if (_mod === null) {
+        try {
+            _mod = require('web-tree-sitter') as ParserStatic;
+        } catch {
+            throw new Error(`web-tree-sitter is not installed — ${INSTALL_HINT}`);
+        }
+    }
     return _mod;
 }
 

package/src/scripts/compile_router.ts

@@ -73,14 +73,9 @@ const LEGACY_TIER_MAP: Record<string, string> = {
 };
 
 const ALLOWED_TIERS = new Set(['kernel', 'tier-1', 'tier-2']);
-const ALLOWED_TRIGGER_KEYS = new Set([
-    'keyword',
-    'phrase',
-    'intent',
-    'file_pattern',
-    'path_prefix',
-    'command',
-]);
+// `intent` was removed: it never auto-matched at runtime, so declaring one gave
+// the author a false activation path. Compiling one is now a hard error.
+const ALLOWED_TRIGGER_KEYS = new Set(['keyword', 'phrase', 'file_pattern', 'path_prefix', 'command']);
 
 function _parse_frontmatter(text: string): JsonObject {
     if (!text.startsWith('---\n')) {

package/src/scripts/condense.ts

@@ -1176,7 +1176,7 @@ function _yaml_scalar(value: string): string {
  * Derive host-native activation globs from a rule's `triggers:` frontmatter
  * (road-to-request-scoped-rule-load Phase 2). `file_pattern` triggers map
  * verbatim; `path_prefix` triggers map to `<prefix>**`. Keyword / phrase /
- * intent / command triggers produce no glob — those rules stay
+ * command triggers produce no glob — those rules stay
  * description-activated (Cursor Agent-Requested / Windsurf model_decision).
  */
 export function derive_trigger_globs(meta: Record<string, unknown>): string[] {
@@ -1224,7 +1224,7 @@ export function _emit_windsurf_rule(source: string, target: string): void {
     const description = _strip(String(meta['description'] ?? '').replace(/\n/g, ' '));
     const always_apply = Boolean(meta['alwaysApply'] || meta['type'] === 'always');
     // Path-shaped triggers activate host-natively via Windsurf's `glob`
-    // trigger; keyword/intent-only rules keep `model_decision`.
+    // trigger; keyword/phrase-only rules keep `model_decision`.
     const globs = always_apply ? [] : derive_trigger_globs(meta);
     const trigger = always_apply ? 'always_on' : globs.length > 0 ? 'glob' : 'model_decision';
     const lines = [

package/src/scripts/explain_run.ts

@@ -130,7 +130,6 @@ function parseSince(since: string | null): number | null {
 export interface TriggerSpec {
     keyword?: string;
     phrase?: string;
-    intent?: string;
     file_pattern?: string;
     path_prefix?: string;
     command?: string;

package/src/scripts/generate_pack_manifests.ts

@@ -17,7 +17,7 @@
  * regenerated on every `task sync` and must never be hand-edited.
  *
  * For each pack home we emit:
- *   - `<home>/pack.yaml` — id, label, owner, requires, version, artefact_count, …
+ *   - `<home>/pack.yaml` — id, label, owner, requires, artefact_count, …
  *   - `<home>/README.md` — pack description + per-artefact description table
  *
  * CLI:
@@ -40,7 +40,6 @@ const PACKAGES = path.join(ROOT, 'packages');
 const SRC_DOMAINS = path.join(ROOT, 'src', 'domains');
 const SRC_PACKS = path.join(ROOT, 'src', 'packs');
 const PACKS_VOCAB = path.join(ROOT, 'src', 'config', 'discovery', 'packs.yml');
-const PACKAGE_JSON = path.join(ROOT, 'package.json');
 const GENERATED_HEADER =
     '# Generated by scripts/generate_pack_manifests.ts — DO NOT EDIT BY HAND\n';
 
@@ -138,14 +137,6 @@ function _vocab_lookup(packsVocab: Dict[]): Record<string, Dict> {
     return out;
 }
 
-function _package_version(): string {
-    if (!_exists(PACKAGE_JSON)) {
-        return '0.0.0';
-    }
-    const pkg = JSON.parse(fs.readFileSync(PACKAGE_JSON, 'utf-8')) as Dict;
-    return _pyTruthy(pkg.version) ? String(pkg.version) : '0.0.0';
-}
-
 function _artefact_record(p: string, logicalRel: string, fm: Dict): Artefact {
     const name = _pyTruthy(fm.name)
         ? String(fm.name)
@@ -256,12 +247,7 @@ function _category_from_logical(logicalRel: string): string {
  * Build the pack.yaml meta dict. Mirrors `_build_pack_yaml`. Insertion
  * order here is irrelevant — `_py_safe_dump` sorts keys (sort_keys=True).
  */
-function _build_pack_yaml(
-    pid: string,
-    vocab: Record<string, Dict>,
-    artefacts: Artefact[],
-    version: string,
-): Dict {
+function _build_pack_yaml(pid: string, vocab: Record<string, Dict>, artefacts: Artefact[]): Dict {
     const meta = vocab[pid] ?? {};
     const label = _pyTruthy(meta.label)
         ? String(meta.label)
@@ -289,7 +275,6 @@ function _build_pack_yaml(
         trust_level_default: _pyTruthy(meta.trust_level_default)
             ? (meta.trust_level_default as unknown)
             : 'core',
-        version,
         artefact_count: artefacts.length,
     };
     if (_isPlainObject(meta.onboarding)) {
@@ -330,7 +315,6 @@ function _render_readme(packMeta: Dict, artefacts: Artefact[]): string {
     const requires = (packMeta.requires as unknown[]) ?? [];
     lines.push(
         `- **id**: \`${String(packMeta.id)}\``,
-        `- **version**: \`${String(packMeta.version)}\``,
         `- **owner**: ${owner.map(String).join(', ') || '—'}`,
         `- **requires**: ${requires.map(String).join(', ') || '—'}`,
         `- **artefacts**: ${String(packMeta.artefact_count)}`,
@@ -369,7 +353,6 @@ function _write_if_changed(p: string, content: string, check: boolean): boolean
 export function main(argv: string[] = process.argv.slice(2)): number {
     const check = argv.includes('--check');
     const vocab = _vocab_lookup((_load_yaml(PACKS_VOCAB) as Dict[]) ?? []);
-    const version = _package_version();
     const homes = _pack_homes();
     if (homes.length === 0) {
         process.stderr.write(
@@ -380,7 +363,7 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     let drift = 0;
     for (const [pid, homeDir, mode] of homes) {
         const artefacts = _collect_artefacts(pid, homeDir, mode);
-        const meta = _build_pack_yaml(pid, vocab, artefacts, version);
+        const meta = _build_pack_yaml(pid, vocab, artefacts);
         const yamlBody = GENERATED_HEADER + _py_safe_dump(meta);
         const readmeBody = _render_readme(meta, artefacts);
         const label = _relativeToPosix(homeDir, ROOT);

package/src/scripts/hooks/block_kernel_rule_writes.ts

@@ -40,6 +40,7 @@ import * as path from 'node:path';
 
 import { is_kernel_rule } from '../_lib/kernel_rules.js';
 import { EDIT_TOOLS } from '../minimal_safe_diff_hook.js';
+import { COMMAND_TOOLS } from '../verify_before_complete_hook.js';
 import { readHookStdin } from './hook_stdin.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -122,25 +123,159 @@ export function targets_kernel_rule(filePath: string): string | null {
     return basename.replace(/\.md$/, '');
 }
 
-/** Return (blocked, reason) for one PreToolUse envelope. Pure — no I/O beyond the arg. */
+/** In-place mutators that name their target as a plain argument. */
+const _MUTATOR_VERBS: ReadonlySet<string> = new Set([
+    'sed',
+    'tee',
+    'truncate',
+    'rm',
+    'shred',
+]);
+/** Verbs whose LAST positional argument is the destination. */
+const _DEST_LAST_VERBS: ReadonlySet<string> = new Set(['mv', 'cp', 'install', 'rsync']);
+
+/**
+ * Shell tokens that, in a command naming a kernel rule path, mean the path is
+ * being WRITTEN rather than read. Reads (`cat`, `grep`, `head`, `diff`,
+ * `git show`) carry none of these and stay allowed — a kernel rule is
+ * immutable, not secret.
+ */
+function _bash_targets_kernel_rule(command: string): string | null {
+    // Cheap reject first: no kernel-rule path in the string at all.
+    const tokens = command.split(/\s+/).filter((t) => t.length > 0);
+    const stripped = tokens.map((t) => t.replace(/^['"]|['"]$/g, ''));
+    const ruleOf = (t: string): string | null => targets_kernel_rule(t);
+    if (!stripped.some((t) => ruleOf(t) !== null)) {
+        return null;
+    }
+
+    // 1. Redirection into the path: `> p`, `>> p`, `>p`, `>>p`.
+    for (let i = 0; i < stripped.length; i += 1) {
+        const tok = stripped[i] as string;
+        const inline = /^>{1,2}(.+)$/.exec(tok);
+        if (inline) {
+            const r = ruleOf(inline[1] as string);
+            if (r !== null) {
+                return r;
+            }
+        }
+        if (tok === '>' || tok === '>>') {
+            const next = stripped[i + 1];
+            if (typeof next === 'string') {
+                const r = ruleOf(next);
+                if (r !== null) {
+                    return r;
+                }
+            }
+        }
+    }
+
+    // 2. A mutator verb anywhere in the pipeline, with the path as an argument.
+    //    `sed` only counts in its in-place form — `sed 's/x/y/' file` prints.
+    const verbs = new Set<string>();
+    let prevWasSeparator = true;
+    for (const tok of stripped) {
+        if (['&&', '||', ';', '|'].includes(tok)) {
+            prevWasSeparator = true;
+            continue;
+        }
+        if (prevWasSeparator && !tok.startsWith('-')) {
+            verbs.add(path.basename(tok));
+            prevWasSeparator = false;
+        }
+    }
+    const sedInPlace = verbs.has('sed') && stripped.some((t) => /^-i/.test(t));
+    for (const verb of verbs) {
+        if (verb === 'sed' && !sedInPlace) {
+            continue;
+        }
+        if (_MUTATOR_VERBS.has(verb)) {
+            const hit = stripped.map(ruleOf).find((r) => r !== null);
+            if (hit !== undefined && hit !== null) {
+                return hit;
+            }
+        }
+        if (_DEST_LAST_VERBS.has(verb)) {
+            const last = stripped[stripped.length - 1] as string;
+            const r = ruleOf(last);
+            if (r !== null) {
+                return r;
+            }
+        }
+    }
+    return null;
+}
+
+/**
+ * Return (blocked, reason) for one PreToolUse envelope. Pure — no I/O beyond
+ * the arg.
+ *
+ * Two surfaces, one effect. The Write/Edit branch is the original Layer-1
+ * guard. The Bash branch was added by road-to-governance-invariants Phase 1
+ * after the S0.2 spike measured the gap: this gate keyed on the TOOL NAME, so
+ * `Bash sed -i … src/rules/commit-policy.md` reached the immutable-rule
+ * outcome the Write branch refuses, and a two-step
+ * `Write docs/staging/<kernel>.md` → `Bash mv … src/rules/<kernel>.md`
+ * sequence did the same with every step individually allowed.
+ *
+ * The Bash branch is deliberately narrow (2026-08-02 council cut, option ii):
+ * only redirection into the path, an in-place `sed`, a `tee`/`truncate`/`rm`
+ * naming it, or a `mv`/`cp` whose DESTINATION it is. Reads stay allowed — a
+ * kernel rule is immutable, not secret — and no attempt is made to understand
+ * arbitrary shell. Recognising every conceivable write verb would make this a
+ * shell sandbox, which is the failure mode the council named.
+ */
 export function check_envelope(envelope: JsonObject): [boolean, string] {
     const { tool, paths } = _extract(envelope);
-    if (!tool || !EDIT_TOOLS.has(tool)) {
+    if (!tool) {
         return [false, ''];
     }
-    for (const p of paths) {
-        const ruleName = targets_kernel_rule(p);
-        if (ruleName !== null) {
-            return [
-                true,
-                `kernel rule ${ruleName} is immutable — tighten-only via the override ` +
-                    'exception registry; see docs/contracts/kernel-membership.md',
-            ];
+    const deny = (ruleName: string): [boolean, string] => [
+        true,
+        `kernel rule ${ruleName} is immutable — tighten-only via the override ` +
+            'exception registry; see docs/contracts/kernel-membership.md',
+    ];
+    if (EDIT_TOOLS.has(tool)) {
+        for (const p of paths) {
+            const ruleName = targets_kernel_rule(p);
+            if (ruleName !== null) {
+                return deny(ruleName);
+            }
+        }
+        return [false, ''];
+    }
+    if (COMMAND_TOOLS.has(tool)) {
+        const cmd = _extract_command(envelope);
+        if (cmd !== null) {
+            const ruleName = _bash_targets_kernel_rule(cmd);
+            if (ruleName !== null) {
+                return deny(ruleName);
+            }
         }
     }
     return [false, ''];
 }
 
+/** Best-effort read of a shell command off a PreToolUse envelope. */
+function _extract_command(envelope: JsonObject): string | null {
+    const payload = _isObject(envelope['payload']) ? envelope['payload'] : envelope;
+    const ti = _isObject(payload['tool_input'])
+        ? payload['tool_input']
+        : _isObject(envelope['tool_input'])
+          ? envelope['tool_input']
+          : null;
+    for (const src of [ti, payload]) {
+        if (src === null) {
+            continue;
+        }
+        const v = src['command'];
+        if (typeof v === 'string' && v) {
+            return v;
+        }
+    }
+    return null;
+}
+
 function _asObject(v: JsonValue | undefined): JsonObject | null {
     return _isObject(v) ? v : null;
 }

package/src/scripts/hooks/block_no_verify.ts

@@ -33,6 +33,34 @@ const _SHELL_SEPARATORS: ReadonlySet<string> = new Set(['&&', '||', ';', '|']);
 const _NO_VERIFY_FLAGS: ReadonlySet<string> = new Set(['--no-verify']);
 const _NO_VERIFY_SHORT: ReadonlySet<string> = new Set(['-n']);
 const _HOOKS_PATH_RE = /^core\.hooksPath\s*=/i;
+/** Bare key form, as `git config core.hooksPath <value>` spells it. */
+const _HOOKS_PATH_KEY_RE = /^core\.hooksPath$/i;
+/**
+ * `git config` flags that make the invocation a READ or a RESTORE rather than
+ * a write. `--unset` removes the override — the opposite of disabling hooks —
+ * so it stays allowed, or the gate would block its own remediation.
+ */
+/** Global `git` options that consume the following token as their value. */
+const _GIT_GLOBAL_OPTS_WITH_VALUE: ReadonlySet<string> = new Set([
+    '-C',
+    '-c',
+    '--config',
+    '--git-dir',
+    '--work-tree',
+    '--namespace',
+    '--exec-path',
+    '--super-prefix',
+]);
+const _CONFIG_READ_OR_RESTORE: ReadonlySet<string> = new Set([
+    '--get',
+    '--get-all',
+    '--get-regexp',
+    '--get-urlmatch',
+    '--list',
+    '-l',
+    '--unset',
+    '--unset-all',
+]);
 
 type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
 type JsonObject = { [k: string]: JsonValue };
@@ -178,7 +206,80 @@ function _git_base(tokens: string[]): string[] | null {
     return null;
 }
 
+/**
+ * `git config … core.hooksPath <value>` — the subcommand form of the hooksPath
+ * override, distinct from the `-c` / `--config` global-option form handled in
+ * `_is_blocked`.
+ *
+ * Closed by road-to-governance-invariants Phase 1 after the S0.2 spike measured
+ * it: `git-history-discipline` already claimed `core.hooksPath` overrides were
+ * "deterministically blocked", and only the inline `-c` form was. That made
+ * `git config core.hooksPath /dev/null` → `git commit` a two-step sequence
+ * whose every step this gate allowed and whose composition is exactly the
+ * outcome the gate exists to prevent.
+ *
+ * Deliberately narrow, per the 2026-08-02 council cut (option ii — widen only
+ * the exact shapes with no plausible legitimate use):
+ *   - a READ (`--get`, `--list`, or the key with no value) is allowed;
+ *   - `--unset` is allowed — it restores hooks, it does not disable them;
+ *   - non-git ways of disabling a hook (`mv`/`chmod`/`rm` on `.git/hooks/*`)
+ *     are NOT matched here. Recognising them would turn this guard into a
+ *     shell sandbox and those verbs have ordinary legitimate uses. That gap
+ *     is published rather than papered over — see the S0.2 spike.
+ */
+function _is_config_hookspath_write(git_tokens: string[]): [boolean, string] {
+    const rest = git_tokens.slice(1);
+    // The subcommand is the first token that is neither a global option nor
+    // the VALUE of one — `git -C /repo config …` must still resolve to
+    // `config`, not to `/repo`.
+    let subIdx = -1;
+    for (let k = 0; k < rest.length; k += 1) {
+        const tok = rest[k] as string;
+        if (!tok.startsWith('-')) {
+            subIdx = k;
+            break;
+        }
+        if (_GIT_GLOBAL_OPTS_WITH_VALUE.has(tok)) {
+            k += 1; // consume its value
+        }
+    }
+    if (subIdx === -1 || rest[subIdx] !== 'config') {
+        return [false, ''];
+    }
+    const args = rest.slice(subIdx + 1);
+    if (args.some((t) => _CONFIG_READ_OR_RESTORE.has(t))) {
+        return [false, ''];
+    }
+    for (let k = 0; k < args.length; k += 1) {
+        const tok = args[k] as string;
+        // `core.hooksPath=<value>` — one token, always a write.
+        if (_HOOKS_PATH_RE.test(tok)) {
+            return [
+                true,
+                `'git config ${tok}' disables git hooks via hooksPath (git-history-discipline)`,
+            ];
+        }
+        if (!_HOOKS_PATH_KEY_RE.test(tok)) {
+            continue;
+        }
+        // Bare key: a write only when a value follows.
+        const next = args.slice(k + 1).find((t) => !t.startsWith('-'));
+        if (next !== undefined) {
+            return [
+                true,
+                `'git config ${tok} ${next}' disables git hooks via hooksPath (git-history-discipline)`,
+            ];
+        }
+        return [false, ''];
+    }
+    return [false, ''];
+}
+
 function _is_blocked(git_tokens: string[]): [boolean, string] {
+    const [cfgBlocked, cfgReason] = _is_config_hookspath_write(git_tokens);
+    if (cfgBlocked) {
+        return [cfgBlocked, cfgReason];
+    }
     let i = 1; // skip 'git'
     while (i < git_tokens.length) {
         const tok = git_tokens[i] as string;

package/src/scripts/lint_agent_security.ts

@@ -23,10 +23,10 @@
  * Usage:
  *   ./scripts-run src/scripts/lint_agent_security [--sarif artifacts/agent-security.sarif]
  */
-import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { runCountedProbe } from "./_lib/counted_probe.js";
 
 const _HERE = path.dirname(fileURLToPath(import.meta.url));
 
@@ -54,9 +54,10 @@ function _run(script: string): [number, Finding[]] {
   // (capture_output=True, text=True equivalent). Mirrors the retired Python implementation's
   // `subprocess.run([sys.executable, HERE/<child>.py, "--json"])`, now that the
   // children are TypeScript and the `.py` originals are deleted.
-  const proc = spawnSync(tsxBin, [path.join(_HERE, script), "--json"], {
-    encoding: "utf-8",
-  });
+  // Bounded read: a truncated `--json` payload would fail to parse and be
+  // swallowed as zero findings — a security aggregate reporting clean because
+  // it lost the answer. `runCountedProbe` throws on overflow instead.
+  const proc = runCountedProbe(tsxBin, [path.join(_HERE, script), "--json"]);
   let findings: Finding[];
   try {
     const parsed: unknown = JSON.parse((proc.stdout ?? "") || "[]");

package/src/scripts/lint_framework_leakage_allowlist.json

@@ -93,8 +93,8 @@
     {
       "file": "src/skills/supply-chain-intake/SKILL.md",
       "lines": [
-        70,
-        72
+        80,
+        82
       ],
       "reason": "Per-ecosystem check commands in fenced blocks; the pip/composer siblings sit farther apart than the ±10-line window — genuine multi-ecosystem documentation."
     },

package/src/scripts/lint_regression.ts

@@ -64,6 +64,65 @@ const STATUS_ORDER: Record<string, number> = { pass: 0, pass_with_warnings: 1, f
  * baseline worktree-add failure (→ exit 2 in main). */
 class CalledProcessError extends Error {}
 
+/** The baseline ran but produced nothing usable (→ exit 2 in main).
+ *
+ * Distinct from the two DOCUMENTED empty-baseline degradations (no linter file
+ * in the ref; a pre-migration `.py` baseline with no python3). Those are
+ * deliberate. This one is a broken run, and returning an empty baseline for it
+ * silently reclassifies every existing finding as a "new file" — the gate then
+ * fires on an unmodified tree and can never report a real regression, because a
+ * regression needs the file present in both maps. */
+class BaselineCollectionError extends Error {}
+
+/** Give the detached baseline worktree a resolvable module context.
+ *
+ * `git worktree add` checks out tracked files only, so the temp tree has no
+ * `node_modules` and the linter dies on its first bare import. Symlinking the
+ * repo's own install is enough — the baseline runs the ref's linter source
+ * against the ref's artefacts; only the dependency resolution is borrowed. */
+function _link_node_modules(tmpdir: string, repo_root: string): void {
+    const target = path.join(repo_root, 'node_modules');
+    const link = path.join(tmpdir, 'node_modules');
+    if (fs.existsSync(link) || !fs.existsSync(target)) {
+        return;
+    }
+    try {
+        fs.symlinkSync(target, link, 'dir');
+    } catch {
+        // Non-fatal here: a failed link surfaces as a failed baseline run
+        // below, which raises with the real cause rather than degrading.
+    }
+}
+
+/** Re-root the baseline's file keys onto the repo-relative paths the working-tree
+ * run emits.
+ *
+ * The baseline runs with `--repo-root <tmpdir>` and reports absolute paths under
+ * that temp worktree; the working-tree run reports paths relative to the repo.
+ * Left as-is the two maps share no key, so every comparison is vacuous — the
+ * disjoint guard would reject the run outright once the baseline is non-empty. */
+function _relativise(data: LinterJson, tmpdir: string): LinterJson {
+    const roots = new Set<string>([tmpdir]);
+    try {
+        roots.add(fs.realpathSync(tmpdir));
+    } catch {
+        /* the temp dir is about to be removed; the literal prefix still applies */
+    }
+    const strip = (f: string): string => {
+        for (const r of roots) {
+            const prefix = r.endsWith(path.sep) ? r : r + path.sep;
+            if (f.startsWith(prefix)) {
+                return f.slice(prefix.length);
+            }
+        }
+        return f;
+    };
+    return {
+        ...data,
+        results: (data.results ?? []).map((e) => ({ ...e, file: strip(e.file) })),
+    };
+}
+
 /** Run the linter and return parsed JSON. If ref is null, run on working tree.
  *
  * Mirrors `run_linter_json`: for a ref, add a detached temp worktree, run the
@@ -91,6 +150,7 @@ function run_linter_json(ref: string | null, repo_root: string): LinterJson {
             );
         }
         try {
+            _link_node_modules(tmpdir, repo_root);
             // The baseline ref may be pre-migration (`.py`, run via python3) or
             // post-migration (`.ts`, run via tsx). Probe both extensions in both
             // locations and spawn by extension. A historical `.py` ref genuinely
@@ -139,7 +199,17 @@ function run_linter_json(ref: string | null, repo_root: string): LinterJson {
                       encoding: 'utf8',
                   });
             const out = result.stdout ?? '';
-            return out.trim() ? (JSON.parse(out) as LinterJson) : { results: [], summary: {} };
+            if (!out.trim()) {
+                const why =
+                    result.status === 0
+                        ? 'it exited 0 but printed nothing'
+                        : `it exited ${result.status ?? 'null'}`;
+                throw new BaselineCollectionError(
+                    `the baseline linter for '${ref}' produced no output — ${why}.\n` +
+                        `stderr: ${(result.stderr ?? '').trim().split('\n').slice(-6).join('\n')}`,
+                );
+            }
+            return _relativise(JSON.parse(out) as LinterJson, tmpdir);
         } finally {
             spawnSync('git', ['-C', repo_root, 'worktree', 'remove', '--force', tmpdir], {
                 encoding: 'utf8',
@@ -433,6 +503,10 @@ function main(): number {
             );
             return 2;
         }
+        if (e instanceof BaselineCollectionError) {
+            process.stderr.write(`Error: ${e.message}\n`);
+            return 2;
+        }
         throw e;
     }
 
@@ -454,6 +528,22 @@ function main(): number {
         return 2;
     }
 
+    // The same guard's blind spot: an EMPTY baseline against a populated
+    // current tree is not comparable either, and it is the worse failure —
+    // every existing finding is then reported as a "new file", so the gate
+    // fires on an unmodified tree and no real regression can ever surface.
+    // The documented empty-baseline degradations (no linter in the ref; a
+    // pre-migration `.py` baseline with no python3) print their own warning
+    // above and land here on purpose.
+    if (!baseKeys.length && currKeys.length) {
+        process.stderr.write(
+            `Error: the baseline '${args.baseline}' produced no lint results while the ` +
+                `current tree produced ${currKeys.length} — runs are not comparable; ` +
+                'refusing to report. Every finding would be misreported as new.\n',
+        );
+        return 2;
+    }
+
     const delta = compare(baseline_map, current_map);
 
     if (args.format === 'json') {
@@ -528,4 +618,5 @@ export {
     format_text,
     format_markdown,
     main,
+    _relativise,
 };