@getarbiter/cli 0.5.0

package/dist/templates/scripts/check-safety-adopt-ratchet.mjs.ejs

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// T1 (convergence playbook, anti-erosion ratchet): a PROTECTED file that is
+// STILL withheld — user-modified, and NOT re-adopted — is exactly the
+// silent-erosion case this gate exists to catch. Two classes are protected:
+//   safety class  `.claude/hooks/*.mjs`  (e.g. a `stop-dangerous.mjs` fix
+//                 shipped upstream while the target repo's modified copy
+//                 never received it)
+//   gate spine    `scripts/check-all.mjs`, `scripts/lib/*.mjs` (#2109) — the
+//                 gate entrypoint and its libs are the delivery vector for
+//                 every check arbiter ships later, including this ratchet's
+//                 own wiring, so a stale one silently misses new checks
+// The two classes are adopted in OPPOSITE directions (#2119): a safety hook is
+// a whole file arbiter owns and adopts by default (--no-adopt-safety opts out);
+// a gate spine is where the PROJECT wires its own checks, so `arbiter update`
+// withholds it and only --adopt-gate-spine overwrites it. Hence two different
+// prescriptions below — telling a project with a customized spine to run
+// `arbiter update` is either useless (it will not write) or, with the flag,
+// destructive. This gate is the monotonic backstop: a divergence can never
+// hide, it can only be resolved or explicitly accepted with `arbiter:preserve`.
+// Usage: node scripts/check-safety-adopt-ratchet.mjs [--manifest=<path>]
+//
+// CATALOG: aggregates the whole anti-erosion surface — every PROTECTED file (safety
+// CATALOG: hooks and the gate spine) that `arbiter update` had to withhold, in one
+// CATALOG: verdict, with the two opposite adopt prescriptions the classes require.
+// CATALOG: rejected fold-in into check-unwired-guards.mjs because that gate answers
+// CATALOG: "is a delivered guard referenced by the spine"; this one answers "did the
+// CATALOG: spine itself stop receiving deliveries" — the second question is what makes
+// CATALOG: the first one's answer untrustworthy, so folding them hides the ordering.
+// CATALOG: rejected fold-in into check-self-dogfood.mjs because that compares templates
+// CATALOG: to materialized files inside the arbiter repo; this reads the consumer-side
+// CATALOG: manifest that only `arbiter update` writes, and must run in repos that have
+// CATALOG: no templates at all.
+
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, resolve, join } from 'node:path'
+
+// Keep in sync with PRESERVE_MARKER (arbiter src/utils/fs.ts) — substring match,
+// exactly as `writeFile` tests it.
+const PRESERVE_MARKER = 'arbiter:preserve'
+
+/** True when the file on disk carries the preserve marker (the documented exception). */
+function isPreserveMarked(root, key) {
+  try {
+    return readFileSync(join(root, key), 'utf8').includes(PRESERVE_MARKER)
+    // An unreadable or absent file cannot prove it carries the documented exception, so
+    // returning false puts the key in `unresolved` — the branch that exits 1. Rethrowing
+    // would only trade a precise "still withheld" red for an opaque crash on the input.
+    // FAIL-OPEN-INTENT: named fail-open, but the false it returns fails the gate CLOSED.
+  } catch {
+    return false
+  }
+}
+
+function resolveManifestPath(args) {
+  const flag = args.find((a) => a.startsWith('--manifest='))
+  if (flag) return resolve(flag.slice('--manifest='.length))
+  return resolve(process.cwd(), '.arbiter-generated-manifest.json')
+}
+
+try {
+  const manifestPath = resolveManifestPath(process.argv.slice(2))
+
+  if (!existsSync(manifestPath)) {
+    // No manifest yet (pre-first-update project) — nothing to ratchet against.
+    process.stdout.write('[safety-adopt-ratchet] no generated manifest yet — SKIP\n')
+    process.exit(0)
+  }
+
+  let manifest
+  try {
+    manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+  } catch {
+    process.stderr.write(`[safety-adopt-ratchet] Failed to parse ${manifestPath}\n`)
+    process.exit(1)
+  }
+
+  const withheldSafety = Array.isArray(manifest.withheldSafety) ? manifest.withheldSafety : []
+
+  // #2119: accept the documented exception this gate already demands in writing.
+  // A preserve-marked file is a deliberate, grep-able, in-file declaration that
+  // the divergence is permanent — never silent: it is printed either way.
+  const root = dirname(manifestPath)
+  const accepted = []
+  const unresolved = []
+  for (const key of withheldSafety) {
+    ;(isPreserveMarked(root, key) ? accepted : unresolved).push(key)
+  }
+
+  if (accepted.length > 0) {
+    process.stdout.write(
+      `[safety-adopt-ratchet] ${accepted.length} protected file(s) accepted as documented ` +
+        `exceptions (${PRESERVE_MARKER}): ${accepted.join(', ')}\n`,
+    )
+  }
+
+  if (unresolved.length === 0) {
+    process.stdout.write('[safety-adopt-ratchet] no withheld protected files — OK\n')
+    process.exit(0)
+  }
+
+  process.stderr.write(
+    `[safety-adopt-ratchet] ${unresolved.length} protected file(s) are withheld ` +
+      `(user-modified, template fix did NOT land):\n`,
+  )
+  for (const key of unresolved) {
+    process.stderr.write(`  - ${key}\n`)
+  }
+
+  // Two classes, two prescriptions. Only hooks are safe to re-adopt blindly.
+  const hooks = unresolved.filter((k) => k.startsWith('.claude/hooks/'))
+  const spine = unresolved.filter((k) => !k.startsWith('.claude/hooks/'))
+
+  if (hooks.length > 0) {
+    process.stderr.write(
+      `  Erosion detected in a safety hook (arbiter owns the whole file): run\n` +
+        `  \`arbiter update\` (the safety class adopts by default) to re-adopt it, or\n` +
+        `  \`arbiter update --adopt-plan\` to preview the diff first.\n`,
+    )
+  }
+  if (spine.length > 0) {
+    process.stderr.write(
+      `  A customized gate spine is withheld — deliberately, since #2119: that file is where\n` +
+        `  THIS project wires its own checks, so \`arbiter update\` will not overwrite it. This\n` +
+        `  red is the register of the debt, i.e. the checks arbiter now ships that your gate\n` +
+        `  does not run yet. To clear it:\n` +
+        `    1. \`arbiter diff\` — see what the current template would add;\n` +
+        `    2. wire those checks into your own scripts/check-all.mjs by hand (it is your file);\n` +
+        `    3. if the divergence is permanent, mark the file \`${PRESERVE_MARKER}\` — the\n` +
+        `       documented exception this gate accepts;\n` +
+        `    4. LAST RESORT, DESTRUCTIVE: \`arbiter update --adopt-gate-spine\` replaces your\n` +
+        `       gate entrypoint with the template render, deleting the checks you wired into\n` +
+        `       it. Preview it with \`--adopt-plan\` before you run it.\n`,
+    )
+  }
+  process.exit(1)
+} catch (err) {
+  process.stderr.write(
+    `[safety-adopt-ratchet] Unexpected error: ${err instanceof Error ? err.message : String(err)}\n`,
+  )
+  process.exit(1)
+}

package/dist/templates/scripts/check-secret-presence.mjs.ejs

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// scripts/check-secret-presence.mjs — generated by arbiter (anti-fake-green, INV-89).
+//
+// Fail-loud secret-presence guard. A CI step that depends on a secret which is EMPTY must FAIL
+// loudly — never silently skip and report green. The classic fake-green:
+//   [ -z "$SECRET" ] && { echo "no secret — skip"; exit 0; }   # green, work never done
+// This guard scans .github/workflows run-steps for that silent-skip-on-empty-secret idiom: an
+// emptiness test on a secret-backed env/assignment var that reaches `exit 0` WITHOUT an explicit
+// `vars.SKIP_<NAME>` opt-out. The ONLY sanctioned skip is an explicit SKIP_<NAME>=true; otherwise
+// the empty-secret branch must `exit 1` loud:
+//   test -n "$SECRET" || { [ "${SKIP_X}" = "true" ] && exit 0 || { echo "::error::..."; exit 1; }; }
+// secrets.GITHUB_TOKEN (always auto-provided) and informational workflows
+// (heartbeat/nightly/weekly/monthly/notify) are exempt. NO-DATA (no secret steps) is a PASS.
+//
+// Usage: node scripts/check-secret-presence.mjs [--dir <path>] [--help]
+// Exit codes (INV-53): 0=PASS, 1=FAIL (unguarded secret-skip), 2=ERROR (self).
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { join, resolve, basename } from 'node:path'
+
+const args = process.argv.slice(2)
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write(
+    [
+      'Usage: node scripts/check-secret-presence.mjs [--dir <path>]',
+      '',
+      'Fails when a workflow run-step tests a secret-backed variable for emptiness and then',
+      '`exit 0` (silent skip) without an explicit `vars.SKIP_<NAME>` opt-out — a fake-green where',
+      'a missing secret turns a gate green with the real work never done. GITHUB_TOKEN and',
+      'informational workflows (heartbeat/nightly/weekly/monthly/notify) are exempt.',
+      'NO-DATA (no workflows or no secret-dependent steps) is a PASS.',
+      '',
+    ].join('\n') + '\n',
+  )
+  process.exit(0)
+}
+
+const dirArg = args.indexOf('--dir')
+const ROOT = dirArg >= 0 && args[dirArg + 1] ? resolve(args[dirArg + 1]) : process.cwd()
+
+const INFORMATIONAL_PATTERNS = ['heartbeat', 'nightly', 'weekly', 'monthly', 'notify']
+const ALWAYS_PRESENT_SECRET = 'GITHUB_TOKEN'
+
+function collectYamlFiles(dir) {
+  if (!existsSync(dir)) return []
+  const out = []
+  let entries
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return out
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue
+    const full = join(dir, entry.name)
+    if (entry.isDirectory()) out.push(...collectYamlFiles(full))
+    else if (entry.isFile() && (entry.name.endsWith('.yml') || entry.name.endsWith('.yaml')))
+      out.push(full)
+  }
+  return out
+}
+
+function extractSteps(content) {
+  const lines = content.split('\n')
+  const steps = []
+  let cur = null
+  let inSteps = false
+  let stepsIndent = null
+  let stepDashIndent = null
+  const flush = () => {
+    if (cur) steps.push(cur.join('\n'))
+    cur = null
+  }
+  for (const line of lines) {
+    if (line.trim() === '') {
+      if (cur) cur.push(line)
+      continue
+    }
+    const indent = line.length - line.trimStart().length
+    const stepsKey = /^(\s*)steps:\s*$/.exec(line)
+    if (stepsKey) {
+      flush()
+      inSteps = true
+      stepsIndent = stepsKey[1].length
+      stepDashIndent = null
+      continue
+    }
+    if (!inSteps) continue
+    if (indent <= stepsIndent && /^\s*[\w-]+:(\s|$)/.test(line)) {
+      flush()
+      inSteps = false
+      continue
+    }
+    const dash = /^(\s*)-\s/.exec(line)
+    if (dash && (stepDashIndent === null || dash[1].length === stepDashIndent)) {
+      stepDashIndent = dash[1].length
+      flush()
+      cur = [line]
+      continue
+    }
+    if (cur) cur.push(line)
+  }
+  flush()
+  return steps
+}
+
+function analyzeStep(rawStepText) {
+  // Strip comments first so a commented-out opt-out (`# SKIP_FAKE=true`) cannot satisfy the guard
+  // and a commented `exit 0` is not treated as a real skip.
+  const stepText = rawStepText
+    .split('\n')
+    .map((l) => l.replace(/(^|\s)#.*$/, '$1'))
+    .join('\n')
+  const secretVars = new Set()
+  const reBind = /([A-Za-z_][A-Za-z0-9_]*)\s*[:=]\s*"?\$\{\{\s*secrets\.([A-Za-z0-9_]+)\s*\}\}/g
+  let m
+  while ((m = reBind.exec(stepText))) {
+    if (m[2] === ALWAYS_PRESENT_SECRET) continue
+    secretVars.add(m[1])
+  }
+  const directSecretEmpty = /-[zn]\s+"?\$\{\{\s*secrets\.([A-Za-z0-9_]+)/.exec(stepText)
+  const direct = directSecretEmpty && directSecretEmpty[1] !== ALWAYS_PRESENT_SECRET
+  if (secretVars.size === 0 && !direct) return null
+  if (!/\bexit\s+0\b/.test(stepText)) return null
+  let emptyOnSecret = Boolean(direct)
+  for (const v of secretVars) {
+    if (new RegExp(`-[zn]\\s+"?\\$\\{?${v}\\b`).test(stepText)) {
+      emptyOnSecret = true
+      break
+    }
+  }
+  if (!emptyOnSecret) return null
+  // Sanctioned opt-out: a REAL `SKIP_<NAME> = true` shell comparison in the (comment-stripped) run.
+  // A `vars.SKIP_<NAME>` env binding alone is NOT enough — the run must actually test it.
+  const hasOptOut = /SKIP_[A-Za-z0-9_]+["}]*\s*(?:==?|!=)\s*["']?true/.test(stepText)
+  if (hasOptOut) return null
+  return secretVars.size > 0 ? [...secretVars].join(', ') : `secrets.${directSecretEmpty[1]}`
+}
+
+function findViolations(filePath) {
+  const name = basename(filePath)
+  if (INFORMATIONAL_PATTERNS.some((p) => name.includes(p))) return []
+  let content
+  try {
+    content = readFileSync(filePath, 'utf-8')
+  } catch {
+    return []
+  }
+  const findings = []
+  for (const step of extractSteps(content)) {
+    const vars = analyzeStep(step)
+    if (vars) {
+      const stepName = /name:\s*(.+)/.exec(step)
+      const label = stepName ? stepName[1].trim() : '(unnamed step)'
+      findings.push(
+        `${filePath}: step "${label}" skips on empty secret (${vars}) without vars.SKIP_ opt-out`,
+      )
+    }
+  }
+  return findings
+}
+
+function main() {
+  const findings = []
+  for (const file of collectYamlFiles(join(ROOT, '.github', 'workflows'))) {
+    for (const v of findViolations(file)) findings.push(v)
+  }
+  if (findings.length > 0) {
+    process.stderr.write(
+      'check-secret-presence: FAIL — secret-dependent step silently skips on an empty secret:\n',
+    )
+    for (const f of findings) process.stderr.write(`    ${f}\n`)
+    process.stderr.write(
+      '  Fix: gate the skip behind an explicit `vars.SKIP_<NAME>=true`, otherwise fail loud:\n' +
+        '    test -n "$SECRET" || { [ "${SKIP_X}" = "true" ] && exit 0 \\\n' +
+        '      || { echo "::error::SECRET is empty and SKIP_X is not true"; exit 1; }; }\n',
+    )
+    return 1
+  }
+  process.stdout.write(
+    'check-secret-presence: no unguarded secret-skip steps — PASS (NO-DATA when no secret steps)\n',
+  )
+  return 0
+}
+
+try {
+  process.exit(main())
+} catch (e) {
+  process.stderr.write(`check-secret-presence: ERROR — ${e?.message ?? e}\n`)
+  process.exit(2)
+}

package/dist/templates/scripts/check-secret-scan.mjs.ejs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// <%= projectName %> — secret pattern drift checker (INV-89)
+// Validates that common secret patterns are not present in tracked source files.
+// Complements gitleaks; provides fast local check without external tool dependency.
+// Exits 0 when no secrets found; exits 1 when potential secrets detected.
+// Part of the anti-drift validator family (W6).
+import { readFileSync } from 'node:fs';
+import { join, resolve, extname, basename } from 'node:path';
+import { walkRepo } from './lib/glob-walk.mjs';
+
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write([
+    'Usage: node scripts/check-secret-scan.mjs [options]',
+    '',
+    'Validates that common secret patterns are not present in tracked source files.',
+    'Exits 0 when no secrets found; exits 1 when potential secrets detected.',
+    '',
+    'Options:',
+    '  --dir <path>    Root directory to scan (default: cwd)',
+    '  --help, -h      Show this help and exit',
+    '',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const dirArg = args.indexOf('--dir');
+const CWD = dirArg >= 0 && args[dirArg + 1] ? resolve(args[dirArg + 1]) : process.cwd();
+
+const SECRET_PATTERNS = [
+  { name: 'AWS Access Key', re: /AKIA[0-9A-Z]{16}/ },
+  { name: 'AWS Secret Key', re: /(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)\s*[:=]\s*["']?[A-Za-z0-9/+]{40}["']?/ },
+  { name: 'GitHub Token (classic)', re: /ghp_[A-Za-z0-9]{36}/ },
+  { name: 'GitHub Token (fine-grained)', re: /github_pat_[A-Za-z0-9_]{82}/ },
+];
+
+// Binary / lockfile extensions to skip. Everything else is treated as text and scanned —
+// a SKIP-list, not a source-language ALLOW-list (#1667). An allow-list of JS/TS extensions
+// silently scanned ZERO files on Go / Python / Rust / Java / Kotlin projects, so a hardcoded
+// credential in the project's actual source language passed this gate clean. The SKIP-list is
+// language-agnostic by default and mirrors the sibling pii-scan.mjs file filter.
+const SKIP_EXTENSIONS = new Set([
+  '.lock', '.lockb', '.png', '.jpg', '.jpeg', '.gif', '.svg',
+  '.wasm', '.bin', '.pdf', '.ico', '.zip', '.tar', '.gz',
+]);
+const IGNORED_FILES = new Set(['.gitleaksignore', 'pii-allowlist.json']);
+
+// Tree-walk + vendor-dir pruning is delegated to the shared hardened helper
+// (scripts/lib/glob-walk.mjs, emitted alongside this gate): one canonical
+// SKIP_DIRS set plus the lstat / skip-symlink cycle guard. walkRepo yields
+// repo-relative POSIX paths under CWD; rejoin to CWD and drop only binary/lockfile
+// extensions and the ignored control files — every other text file is scanned.
+const files = walkRepo(CWD)
+  .map((rel) => join(CWD, rel))
+  .filter((full) => !IGNORED_FILES.has(basename(full)) && !SKIP_EXTENSIONS.has(extname(full).toLowerCase()));
+let violations = 0;
+
+for (const file of files) {
+  let content;
+  try {
+    content = readFileSync(file, 'utf-8');
+  } catch {
+    continue;
+  }
+  // Skip test files and fixtures (may contain dummy secrets for testing)
+  if (file.includes('__tests__/') || file.includes('/fixtures/') || file.includes('/test-data/')) continue;
+  for (const { name, re } of SECRET_PATTERNS) {
+    const match = re.exec(content);
+    if (match) {
+      process.stderr.write(`[FAIL] potential ${name} found in ${file}: "${match[0].slice(0, 40)}..."\n`);
+      violations++;
+      break;
+    }
+  }
+}
+
+if (violations > 0) {
+  process.stderr.write(`check-secret-scan: FAIL — ${violations} file(s) with potential secrets found (INV-89)\n`);
+  process.exit(1);
+}
+process.stdout.write(`check-secret-scan: OK — no secret patterns found in ${files.length} scanned file(s) (INV-89)\n`);
+process.exit(0);

package/dist/templates/scripts/check-skip-critical-e2e.mjs.ejs

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// scripts/check-skip-critical-e2e.mjs — generated by arbiter (anti-fake-green, #1497).
+//
+// Skipped-critical-e2e guard. A critical-path end-to-end test that is skipped is a fake-green: the
+// highest-value reality-contact signal goes green without ever running. This guard scans
+// playwright/cypress/wdio e2e spec dirs for skipped specs (test.skip/it.skip/xtest/.fixme), and
+// treats a skip on a spec tagged @critical-path as the worst case. If NO e2e config is present the
+// verdict is NA (exit 0) — there is nothing to skip, so never a manufactured fail.
+//
+// Exit codes (INV-53): 0=PASS / NA (no e2e config), 1=FAIL (skipped e2e spec), 2=ERROR.
+// Usage: node scripts/check-skip-critical-e2e.mjs [--dir <path>] [--help]
+import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+
+const args = process.argv.slice(2)
+if (args.includes('--help') || args.includes('-h')) {
+  process.stdout.write(
+    'Usage: node scripts/check-skip-critical-e2e.mjs [--dir <path>]\n' +
+      '  Fails when a critical-path e2e spec is skipped. If no e2e config exists → NA (exit 0).\n' +
+      '  Add `// skip-critical-e2e-exempt: <reason>` on the skip line or the line above to audit-\n' +
+      '  exempt a legitimate skip.\n',
+  )
+  process.exit(0)
+}
+const dirArgIdx = args.indexOf('--dir')
+const ROOT = dirArgIdx >= 0 && args[dirArgIdx + 1] ? resolve(args[dirArgIdx + 1]) : process.cwd()
+
+// #1840 F4 tranche-3: '.venv'/'venv'/'__pycache__' — a Python dependency's
+// bundled test suite inside site-packages must never be scanned as project
+// code (mirrors lib/glob-walk.mjs's SKIP_DIRS).
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  'coverage',
+  '.coverage',
+  '.venv',
+  'venv',
+  '__pycache__',
+])
+
+// e2e config signals — if none exists, there is no e2e surface to skip (verdict NA).
+const E2E_CONFIG_FILES = [
+  'playwright.config.ts',
+  'playwright.config.js',
+  'playwright.config.mjs',
+  'cypress.config.ts',
+  'cypress.config.js',
+  'cypress.config.mjs',
+  'wdio.conf.ts',
+  'wdio.conf.js',
+]
+
+// Directory names that conventionally hold e2e specs.
+const E2E_DIR_NAMES = new Set(['e2e', 'playwright', 'cypress', 'integration-e2e'])
+
+const SPEC_RE = /\.(?:spec|test|e2e)\.(?:ts|tsx|js|jsx|mjs)$/
+
+// Skip markers anchored to statement start (a string mention is not a skip).
+const SKIP_RE = /^(?:await\s+)?(?:test|it|describe)\.(?:skip|fixme)\s*\(|^x(?:test|it|describe)\s*\(/
+const CRITICAL_RE = /@critical-path\b/
+const EXEMPT_RE = /skip-critical-e2e-exempt:\s*\S/
+
+function hasE2eConfig() {
+  return E2E_CONFIG_FILES.some((f) => existsSync(join(ROOT, f)))
+}
+
+/** Collect spec files that live under an e2e-named directory. */
+function collectE2eSpecs(dir, acc, inE2eTree) {
+  let entries
+  try {
+    entries = readdirSync(dir)
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry)) continue
+    const full = join(dir, entry)
+    let st
+    try {
+      st = statSync(full)
+    } catch {
+      continue
+    }
+    if (st.isDirectory()) {
+      collectE2eSpecs(full, acc, inE2eTree || E2E_DIR_NAMES.has(entry))
+    } else if (inE2eTree && SPEC_RE.test(entry)) {
+      acc.push(full)
+    }
+  }
+}
+
+function main() {
+  if (!hasE2eConfig()) {
+    process.stdout.write('check-skip-critical-e2e: NA — no e2e config (playwright/cypress/wdio)\n')
+    return 0
+  }
+
+  const specs = []
+  collectE2eSpecs(ROOT, specs, false)
+
+  const violations = []
+  for (const file of specs) {
+    let content
+    try {
+      content = readFileSync(file, 'utf-8')
+    } catch {
+      continue
+    }
+    const lines = content.split('\n')
+    // A spec file is "critical-path" if any line carries the tag (annotation or title token).
+    const fileCritical = lines.some((l) => CRITICAL_RE.test(l))
+    for (let i = 0; i < lines.length; i++) {
+      const trimmed = lines[i].trim()
+      const prev = i > 0 ? lines[i - 1] : ''
+      if (EXEMPT_RE.test(lines[i]) || EXEMPT_RE.test(prev)) continue
+      if (SKIP_RE.test(trimmed)) {
+        const crit = fileCritical || CRITICAL_RE.test(trimmed) || CRITICAL_RE.test(prev)
+        violations.push(`  ${file}:${i + 1}${crit ? ' [@critical-path]' : ''}: ${trimmed}`)
+      }
+    }
+  }
+
+  if (violations.length > 0) {
+    process.stderr.write(
+      `check-skip-critical-e2e: ${violations.length} skipped e2e spec(s) — a skipped e2e is a fake-green:\n`,
+    )
+    for (const v of violations) process.stderr.write(v + '\n')
+    return 1
+  }
+  process.stdout.write(`check-skip-critical-e2e: OK — ${specs.length} e2e spec(s), none skipped\n`)
+  return 0
+}
+
+try {
+  process.exit(main())
+} catch (e) {
+  process.stderr.write(`check-skip-critical-e2e: ERROR — ${e?.message ?? e}\n`)
+  process.exit(2)
+}