@gajae-code/coding-agent 0.11.11 → 0.12.1

package/scripts/run-acp-conformance.ts

@@ -0,0 +1,285 @@
+#!/usr/bin/env bun
+
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+
+export const ACPX_VERSION = "0.13.0";
+export const ACPX_GIT_HEAD = "47dc1c56b20da3c248a4a1b5c5106f52e65e6594";
+/** `conformance/profiles/acp-core-v1.json#required_cases` at the pinned commit. */
+export const ACP_CORE_V1_CASE_IDS = [
+	"acp.v1.initialize.handshake",
+	"acp.v1.session.new.basic",
+	"acp.v1.session.prompt.single_turn",
+	"acp.v1.session.update.termination",
+	"acp.v1.session.cancel.in_flight",
+	"acp.v1.session.cancel.idle",
+	"acp.v1.session.prompt.multi_turn",
+	"acp.v1.errors.invalid_params",
+	"acp.v1.errors.invalid_prompt_session_type",
+	"acp.v1.errors.permission_denied",
+	"acp.v1.errors.permission_denied.write",
+	"acp.v1.errors.unknown_session",
+	"acp.v1.session.prompt.echo_empty",
+	"acp.v1.session.prompt.unrecognized",
+	"acp.v1.errors.invalid_params.cwd_null",
+	"acp.v1.session.prompt.structured_blocks",
+	"acp.v1.permissions.read.approved",
+	"acp.v1.permissions.write.approved",
+	"acp.v1.session.prompt.background_completion",
+	"acp.v1.session.cancel.followup_prompt",
+	"acp.v1.session.prompt.post_success_drain",
+] as const;
+
+export type AcpxMetadata = { version: string; gitHead?: string };
+export type AcpxCheckout = { root: string; head: string };
+export type CaseResult = { id: string; passed: boolean; [key: string]: unknown };
+export type UpstreamReport = {
+	profileId: string;
+	results: CaseResult[];
+	totals?: { cases: number; passed: number; failed: number };
+	[key: string]: unknown;
+};
+export type ConformanceReport = {
+	command: string[];
+	cwd: string;
+	gjc: { commit: string; dirty: boolean };
+	acpx: { version: string; gitHead: string };
+	profile: string;
+	agentCommand: string;
+	matrix: CaseResult[];
+	totals: { cases: number; passed: number; failed: number };
+};
+
+export interface RunAcpConformanceOptions {
+	agentCommand: string;
+	reportPath: string;
+	format?: "json";
+	cwd?: string;
+	profile?: string;
+	fetchMetadata?: () => Promise<AcpxMetadata>;
+	checkout?: () => Promise<AcpxCheckout>;
+	runRunner?: (options: { command: string[]; cwd: string; sessionCwd?: string }) => Promise<void>;
+	readReport?: (reportPath: string) => Promise<unknown>;
+	writeReport?: (reportPath: string, report: ConformanceReport) => Promise<void>;
+}
+
+function assertProvenance(metadata: AcpxMetadata, checkout: AcpxCheckout): void {
+	if (metadata.version !== ACPX_VERSION)
+		throw new Error(`Expected acpx@${ACPX_VERSION}; received ${metadata.version}.`);
+	if (metadata.gitHead !== ACPX_GIT_HEAD)
+		throw new Error(`Expected acpx gitHead ${ACPX_GIT_HEAD}; received ${metadata.gitHead ?? "missing"}.`);
+	if (checkout.head !== ACPX_GIT_HEAD)
+		throw new Error(`Expected source checkout HEAD ${ACPX_GIT_HEAD}; received ${checkout.head}.`);
+}
+
+function validateResults(report: unknown, profile: string): CaseResult[] {
+	if (!report || typeof report !== "object") throw new Error("Conformance runner report is missing or malformed.");
+	const value = report as Partial<UpstreamReport>;
+	if (value.profileId !== profile || !Array.isArray(value.results))
+		throw new Error("Conformance runner report is missing profileId or results.");
+	const expected = new Set<string>(ACP_CORE_V1_CASE_IDS);
+	const seen = new Set<string>();
+	for (const result of value.results) {
+		if (!result || typeof result.id !== "string" || typeof result.passed !== "boolean")
+			throw new Error("Conformance runner report contains a malformed case result.");
+		if (seen.has(result.id)) throw new Error(`Conformance runner report has duplicate case ID: ${result.id}.`);
+		seen.add(result.id);
+		if (!expected.has(result.id)) throw new Error(`Conformance runner report has unexpected case ID: ${result.id}.`);
+		if (!result.passed) throw new Error(`Conformance case failed: ${result.id}.`);
+	}
+	for (const id of ACP_CORE_V1_CASE_IDS)
+		if (!seen.has(id)) throw new Error(`Conformance runner report is missing required case ID: ${id}.`);
+	return value.results;
+}
+
+/**
+ * Runs the pinned upstream conformance suite against a real ACP agent command.
+ *
+ * `--cwd` must be a real path, not one reached through a symlink (macOS `/tmp` is a
+ * link to `/private/tmp`): the upstream client enforces its session cwd root against
+ * the resolved path, so a symlinked workspace fails the client-authority cases.
+ */
+export async function runAcpConformance(options: RunAcpConformanceOptions): Promise<ConformanceReport> {
+	const profile = options.profile ?? "acp-core-v1";
+	const requestedCwd = options.cwd ?? process.cwd();
+	const resolvedCwd = await fs.realpath(requestedCwd).catch(() => requestedCwd);
+	if (path.resolve(requestedCwd) !== resolvedCwd)
+		throw new Error(
+			`--cwd must be a real path; ${requestedCwd} resolves to ${resolvedCwd} and the client rejects paths outside its session cwd root.`,
+		);
+	if (profile !== "acp-core-v1") throw new Error(`Unsupported conformance profile: ${profile}.`);
+	// The upstream runner spawns the agent from its own checkout, so any repo-relative
+	// path in the command must be resolved against this repository first.
+	const agentCommand = options.agentCommand
+		.split(" ")
+		.map(token => (token.endsWith(".ts") && !path.isAbsolute(token) ? path.resolve(token) : token))
+		.join(" ");
+	const metadata = await (options.fetchMetadata ?? fetchNpmMetadata)();
+	const checkout = await (options.checkout ?? checkoutAcpxSource)();
+	assertProvenance(metadata, checkout);
+	const upstreamReportPath = path.join(os.tmpdir(), `gjc-acpx-${crypto.randomUUID()}.json`);
+	const command = [
+		"bun",
+		path.join(checkout.root, "conformance", "runner", "run.ts"),
+		"--profile",
+		path.join(checkout.root, "conformance", "profiles", `${profile}.json`),
+		"--cases-dir",
+		path.join(checkout.root, "conformance", "cases"),
+		"--agent-command",
+		agentCommand,
+		"--format",
+		"json",
+		"--report",
+		upstreamReportPath,
+		"--cwd",
+		options.cwd ?? process.cwd(),
+	];
+	// A failing run still writes its report. Preserve that matrix as CI evidence before
+	// surfacing the failure, so the uploaded artifact explains what actually broke.
+	let runnerFailure: unknown;
+	try {
+		await (options.runRunner ?? runRunner)({ command, cwd: checkout.root, sessionCwd: options.cwd ?? process.cwd() });
+	} catch (error) {
+		runnerFailure = error;
+	}
+	const upstream = await (options.readReport ?? readReport)(upstreamReportPath).catch(() => undefined);
+	if (runnerFailure !== undefined) {
+		if (upstream && typeof upstream === "object") {
+			const failed = upstream as Partial<UpstreamReport>;
+			await (options.writeReport ?? writeReport)(options.reportPath, {
+				command,
+				cwd: options.cwd ?? process.cwd(),
+				gjc: gjcIdentity(),
+				acpx: { version: metadata.version, gitHead: metadata.gitHead as string },
+				profile,
+				agentCommand,
+				matrix: Array.isArray(failed.results) ? failed.results : [],
+				totals: failed.totals ?? { cases: 0, passed: 0, failed: 0 },
+			});
+		}
+		throw runnerFailure;
+	}
+	const matrix = validateResults(upstream, profile);
+	const report: ConformanceReport = {
+		command,
+		cwd: options.cwd ?? process.cwd(),
+		gjc: gjcIdentity(),
+		acpx: { version: metadata.version, gitHead: metadata.gitHead! },
+		profile,
+		agentCommand,
+		matrix,
+		totals: { cases: matrix.length, passed: matrix.length, failed: 0 },
+	};
+	await (options.writeReport ?? writeReport)(options.reportPath, report);
+	return report;
+}
+
+function gjcIdentity(): { commit: string; dirty: boolean } {
+	try {
+		const commit = Bun.spawnSync(["git", "rev-parse", "HEAD"]).stdout.toString().trim();
+		const dirty = Bun.spawnSync(["git", "status", "--porcelain"]).stdout.toString().trim().length > 0;
+		return { commit, dirty };
+	} catch {
+		return { commit: "unknown", dirty: true };
+	}
+}
+
+async function fetchNpmMetadata(): Promise<AcpxMetadata> {
+	const response = await fetch(`https://registry.npmjs.org/acpx/${ACPX_VERSION}`);
+	if (!response.ok)
+		throw new Error(`Unable to resolve acpx@${ACPX_VERSION}: ${response.status} ${response.statusText}.`);
+	return (await response.json()) as AcpxMetadata;
+}
+
+async function commandOutput(command: string[], cwd?: string, env?: Record<string, string>): Promise<string> {
+	const child = Bun.spawn(command, {
+		cwd,
+		stdout: "pipe",
+		stderr: "pipe",
+		...(env ? { env: { ...process.env, ...env } } : {}),
+	});
+	const [code, stdout, stderr] = await Promise.all([
+		child.exited,
+		new Response(child.stdout).text(),
+		new Response(child.stderr).text(),
+	]);
+	if (code !== 0)
+		throw new Error(`${command.join(" ")} failed (exit ${code}).\nstdout:\n${stdout}\nstderr:\n${stderr}`);
+	return stdout.trim();
+}
+
+async function checkoutAcpxSource(): Promise<AcpxCheckout> {
+	const root = path.join(os.homedir(), ".cache", "gjc", "acpx", ACPX_GIT_HEAD);
+	try {
+		await fs.access(path.join(root, ".git"));
+	} catch {
+		await fs.mkdir(path.dirname(root), { recursive: true });
+		await commandOutput(["git", "clone", "https://github.com/openclaw/acpx.git", root]);
+	}
+	await commandOutput(["git", "fetch", "--depth", "1", "origin", ACPX_GIT_HEAD], root);
+	await commandOutput(["git", "checkout", "--detach", ACPX_GIT_HEAD], root);
+	// A reused cache must match the pin exactly; local edits would invalidate the
+	// provenance the report claims.
+	await commandOutput(["git", "reset", "--hard", ACPX_GIT_HEAD], root);
+	await commandOutput(["git", "clean", "-fdx", "--exclude=node_modules"], root);
+	const status = await commandOutput(["git", "status", "--porcelain"], root);
+	if (status.length > 0) throw new Error(`acpx source checkout is not clean at ${ACPX_GIT_HEAD}.`);
+	return { root, head: await commandOutput(["git", "rev-parse", "HEAD"], root) };
+}
+
+async function runRunner(options: { command: string[]; cwd: string; sessionCwd?: string }): Promise<void> {
+	// The fixture seeds the corpus scratch workspace; the runner only creates it.
+	await commandOutput(
+		options.command,
+		options.cwd,
+		options.sessionCwd ? { GJC_ACP_CONFORMANCE_CWD: options.sessionCwd } : undefined,
+	);
+}
+async function readReport(reportPath: string): Promise<unknown> {
+	return await Bun.file(reportPath).json();
+}
+async function writeReport(reportPath: string, report: ConformanceReport): Promise<void> {
+	await fs.mkdir(path.dirname(reportPath), { recursive: true });
+	await Bun.write(reportPath, `${JSON.stringify(report, null, 2)}\n`);
+}
+
+function parseCli(argv: string[]): RunAcpConformanceOptions {
+	const values: Partial<RunAcpConformanceOptions> = { format: "json", profile: "acp-core-v1" };
+	for (let index = 0; index < argv.length; index++) {
+		const flag = argv[index];
+		if (flag === "--format") {
+			if (argv[++index] !== "json") throw new Error("--format must be json.");
+			continue;
+		}
+		if (flag === "--agent-command") {
+			values.agentCommand = argv[++index];
+			continue;
+		}
+		if (flag === "--report") {
+			values.reportPath = argv[++index];
+			continue;
+		}
+		if (flag === "--cwd") {
+			values.cwd = argv[++index];
+			continue;
+		}
+		if (flag === "--profile") {
+			values.profile = argv[++index];
+			continue;
+		}
+		throw new Error(`Unknown argument: ${flag}.`);
+	}
+	if (!values.agentCommand || !values.reportPath)
+		throw new Error(
+			"Usage: conformance:run --agent-command <command> --format json --report <path> [--cwd <path>] [--profile acp-core-v1]",
+		);
+	return values as RunAcpConformanceOptions;
+}
+
+if (import.meta.main) {
+	runAcpConformance(parseCli(process.argv.slice(2))).catch(error => {
+		process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+		process.exitCode = 1;
+	});
+}

package/scripts/verify-gjc-sdk-canonicalization.ts

@@ -1421,13 +1421,107 @@ function braceBlockRange(contents: string, openingBrace: number): ShellRange | u
 	return undefined;
 }
 
-function exactTeamRuntimeSendKeysRanges(contents: string): ShellRange[] {
-	const guardMatches = [...contents.matchAll(/if\s*\(\s*useSendKeysFallback\s*\)\s*\{/g)];
+function scopeMatches<T extends RegExpMatchArray>(matches: T[], range: ShellRange): T[] {
+	return matches.filter(match => {
+		const index = match.index ?? -1;
+		return index >= range.start && index < range.end;
+	});
+}
+
+function findFunctionRange(contents: string, headerPattern: RegExp): ShellRange | undefined {
+	const header = headerPattern.exec(contents);
+	if (!header) return undefined;
+	const openingBrace = (header.index ?? 0) + header[0].lastIndexOf("{");
+	return braceBlockRange(contents, openingBrace);
+}
+
+/**
+ * `relaunchWorkerPaneForMemoryGuard` intentionally re-runs the same sanctioned
+ * tmux send-keys fallback shape as `startTmuxSession` (see
+ * `exactTeamRuntimeSendKeysRanges` below) but through `input.config` /
+ * `newPaneId` instead of `config` / `paneId`, since it dispatches a single
+ * successor pane rather than looping over `config.workers`. Exact-match its
+ * shape the same way so a second legitimate call site does not get treated as
+ * an unsanctioned duplicate.
+ */
+function exactMemoryGuardSendKeysRanges(contents: string): ShellRange[] {
+	const fnRange = findFunctionRange(
+		contents,
+		/async\s+function\s+relaunchWorkerPaneForMemoryGuard\s*\([\s\S]{0,600}?\)\s*:\s*Promise<string>\s*\{/,
+	);
+	if (!fnRange) return [];
+	const body = contents.slice(fnRange.start, fnRange.end);
+	const guardMatches = [...body.matchAll(/if\s*\(\s*useSendKeysFallback\s*\)\s*\{/g)];
 	const payloadMatches = [
-		...contents.matchAll(
-			/Bun\.spawnSync\(\s*\[\s*config\.tmux_command\s*,\s*["']send-keys["']\s*,\s*["']-l["']\s*,\s*["']-t["']\s*,\s*paneId\s*,\s*workerCommand\s*\]\s*,\s*\{[\s\S]{0,200}?stdout\s*:\s*["']ignore["'][\s\S]{0,200}?stderr\s*:\s*["']ignore["'][\s\S]{0,100}?\}\s*\)\s*;/g,
+		...body.matchAll(
+			/Bun\.spawnSync\(\s*\[\s*input\.config\.tmux_command\s*,\s*["']send-keys["']\s*,\s*["']-l["']\s*,\s*["']-t["']\s*,\s*newPaneId\s*,\s*workerCommand\s*\]\s*,\s*\{[\s\S]{0,200}?stdout\s*:\s*["']ignore["'][\s\S]{0,200}?stderr\s*:\s*["']ignore["'][\s\S]{0,100}?\}\s*\)\s*;/g,
+		),
+	];
+	const enterMatches = [
+		...body.matchAll(
+			/Bun\.spawnSync\(\s*\[\s*input\.config\.tmux_command\s*,\s*["']send-keys["']\s*,\s*["']-t["']\s*,\s*newPaneId\s*,\s*["']Enter["']\s*\]\s*,\s*\{[\s\S]{0,200}?stdout\s*:\s*["']ignore["'][\s\S]{0,200}?stderr\s*:\s*["']ignore["'][\s\S]{0,100}?\}\s*\)\s*;/g,
 		),
 	];
+	const useFallbackMatches = [
+		...body.matchAll(
+			/const\s+useSendKeysFallback\s*=\s*shouldDispatchWorkerWithSendKeys\(input\.config\.tmux_command\s*,\s*input\.platform\)\s*;/g,
+		),
+	];
+	const splitWorkerCommandMatches = [
+		...body.matchAll(/\.\.\.\(useSendKeysFallback\s*\?\s*\[\]\s*:\s*\[workerCommand\]\)\s*,/g),
+	];
+	if (
+		guardMatches.length !== 1 ||
+		payloadMatches.length !== 1 ||
+		enterMatches.length !== 1 ||
+		useFallbackMatches.length !== 1 ||
+		splitWorkerCommandMatches.length !== 1
+	)
+		return [];
+	const guardStart = guardMatches[0].index ?? 0;
+	const payloadStart = payloadMatches[0].index ?? 0;
+	const enterStart = enterMatches[0].index ?? 0;
+	if (
+		(useFallbackMatches[0].index ?? 0) >= (splitWorkerCommandMatches[0].index ?? 0) ||
+		(splitWorkerCommandMatches[0].index ?? 0) >= guardStart ||
+		payloadStart >= enterStart
+	)
+		return [];
+	const guard = guardMatches[0];
+	const openingBrace = (guard.index ?? 0) + guard[0].lastIndexOf("{");
+	const range = braceBlockRange(body, openingBrace);
+	if (
+		!range ||
+		payloadStart < range.start ||
+		payloadStart >= range.end ||
+		enterStart < range.start ||
+		enterStart >= range.end
+	)
+		return [];
+	return [
+		{ start: fnRange.start + payloadStart, end: fnRange.start + payloadStart + payloadMatches[0][0].length },
+		{ start: fnRange.start + enterStart, end: fnRange.start + enterStart + enterMatches[0][0].length },
+	];
+}
+function exactTeamRuntimeSendKeysRanges(contents: string): ShellRange[] {
+	// Scope the loop-dispatch counts to `startTmuxSession` so the second
+	// sanctioned call site (`relaunchWorkerPaneForMemoryGuard`, matched by
+	// `exactMemoryGuardSendKeysRanges`) does not read as a duplicate. Fixtures
+	// that carry the canonical shape without the enclosing function keep the
+	// original whole-file scope, so exact-match strictness is unchanged.
+	const mainFnRange = findFunctionRange(
+		contents,
+		/async\s+function\s+startTmuxSession\s*\([\s\S]{0,600}?\)\s*:\s*Promise<GjcTeamWorker\[\]>\s*\{/,
+	) ?? { start: 0, end: contents.length };
+	const guardMatches = scopeMatches([...contents.matchAll(/if\s*\(\s*useSendKeysFallback\s*\)\s*\{/g)], mainFnRange);
+	const payloadMatches = scopeMatches(
+		[
+			...contents.matchAll(
+				/Bun\.spawnSync\(\s*\[\s*config\.tmux_command\s*,\s*["']send-keys["']\s*,\s*["']-l["']\s*,\s*["']-t["']\s*,\s*paneId\s*,\s*workerCommand\s*\]\s*,\s*\{[\s\S]{0,200}?stdout\s*:\s*["']ignore["'][\s\S]{0,200}?stderr\s*:\s*["']ignore["'][\s\S]{0,100}?\}\s*\)\s*;/g,
+			),
+		],
+		mainFnRange,
+	);
 	const continuationPromptMatches = [
 		...contents.matchAll(
 			/(?:const\s+GJC_TEAM_CONTINUATION_PROMPT\s*=\s*["']Continue only your current claimed GJC team task\. Re-read current GJC team state; do not replay prior output; report status\.["']\s*;|import\s*\{[\s\S]{0,1000}?\bGJC_TEAM_CONTINUATION_PROMPT\b[\s\S]{0,1000}?\}\s*from\s*["']\.\/team-workers["']\s*;)/g,
@@ -1438,24 +1532,31 @@ function exactTeamRuntimeSendKeysRanges(contents: string): ShellRange[] {
 			/const\s+args\s*=\s*Object\.freeze\(\s*\[\s*["']send-keys["']\s*,\s*["']-l["']\s*,\s*["']-t["']\s*,\s*worker\.pane_id\s*,\s*GJC_TEAM_CONTINUATION_PROMPT\s*,\s*["'];["']\s*,\s*["']send-keys["']\s*,\s*["']-t["']\s*,\s*worker\.pane_id\s*,\s*["']Enter["']\s*,?\s*\]\s*\)\s*;\s*const\s+dispatch\s*=\s*gjcTeamRuntimeTestSeams\?\.continuationTmuxDispatch\s*\?\s*gjcTeamRuntimeTestSeams\.continuationTmuxDispatch\(config\.tmux_command\s*,\s*args\)\s*:\s*Bun\.spawnSync\(\[config\.tmux_command\s*,\s*\.\.\.args\]\s*,\s*\{\s*stdout\s*:\s*["']ignore["']\s*,\s*stderr\s*:\s*["']ignore["']\s*,\s*timeout\s*:\s*GJC_TEAM_CONTINUATION_DISPATCH_TIMEOUT_MS\s*,?\s*\}\s*\)\s*;/g,
 		),
 	];
-	const enterMatches = [
-		...contents.matchAll(
-			/const\s+sendKeys\s*=\s*Bun\.spawnSync\(\s*\[\s*config\.tmux_command\s*,\s*["']send-keys["']\s*,\s*["']-t["']\s*,\s*paneId\s*,\s*["']Enter["']\s*\]\s*,\s*\{[\s\S]{0,200}?stdout\s*:\s*["']ignore["'][\s\S]{0,200}?stderr\s*:\s*["']ignore["'][\s\S]{0,100}?\}\s*\)\s*;/g,
-		),
-	];
+	const enterMatches = scopeMatches(
+		[
+			...contents.matchAll(
+				/const\s+sendKeys\s*=\s*Bun\.spawnSync\(\s*\[\s*config\.tmux_command\s*,\s*["']send-keys["']\s*,\s*["']-t["']\s*,\s*paneId\s*,\s*["']Enter["']\s*\]\s*,\s*\{[\s\S]{0,200}?stdout\s*:\s*["']ignore["'][\s\S]{0,200}?stderr\s*:\s*["']ignore["'][\s\S]{0,100}?\}\s*\)\s*;/g,
+			),
+		],
+		mainFnRange,
+	);
 	const fallbackPredicateMatches = [
 		...contents.matchAll(
 			/function\s+shouldDispatchWorkerWithSendKeys\([^)]*\)\s*:\s*boolean\s*\{\s*return\s+platform\s*===\s*["']win32["']\s*\|\|\s*path\.basename\(tmuxCommand\)\.toLowerCase\(\)\s*===\s*["']psmux["']\s*;\s*\}/g,
 		),
 	];
-	const useFallbackMatches = [
-		...contents.matchAll(
-			/const\s+useSendKeysFallback\s*=\s*shouldDispatchWorkerWithSendKeys\(config\.tmux_command\)\s*;/g,
-		),
-	];
-	const splitWorkerCommandMatches = [
-		...contents.matchAll(/\.\.\.\(useSendKeysFallback\s*\?\s*\[\]\s*:\s*\[workerCommand\]\)\s*,/g),
-	];
+	const useFallbackMatches = scopeMatches(
+		[
+			...contents.matchAll(
+				/const\s+useSendKeysFallback\s*=\s*shouldDispatchWorkerWithSendKeys\(config\.tmux_command\)\s*;/g,
+			),
+		],
+		mainFnRange,
+	);
+	const splitWorkerCommandMatches = scopeMatches(
+		[...contents.matchAll(/\.\.\.\(useSendKeysFallback\s*\?\s*\[\]\s*:\s*\[workerCommand\]\)\s*,/g)],
+		mainFnRange,
+	);
 	if (
 		guardMatches.length !== 1 ||
 		payloadMatches.length !== 1 ||
@@ -1543,7 +1644,10 @@ function isTypeOnlyTmuxPrimitiveOccurrence(contents: string, occurrence: TmuxPri
 
 function tmuxMachineBusViolations(file: string, contents: string): string[] {
 	if (isGeneratedDocumentationIndex(file)) return [];
-	const allowedTeamFallbackRanges = file === teamRuntimeTmuxPath ? exactTeamRuntimeSendKeysRanges(contents) : [];
+	const allowedTeamFallbackRanges =
+		file === teamRuntimeTmuxPath
+			? [...exactTeamRuntimeSendKeysRanges(contents), ...exactMemoryGuardSendKeysRanges(contents)]
+			: [];
 	const violations: string[] = [];
 	for (const occurrence of tmuxPrimitiveOccurrences(contents)) {
 		const isExactTeamFallback =