@opengsd/gsd-core 1.2.0 → 1.3.0

package/get-shit-done/workflows/_runtime-launcher.snippet.sh

@@ -1 +0,0 @@
-_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/get-shit-done/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi

package/scripts/lint-no-source-grep-extras.cjs

@@ -1,81 +0,0 @@
-'use strict';
-
-/**
- * Extended detector for the no-source-grep rule (#2982).
- *
- * The base lint (scripts/lint-no-source-grep.cjs) only catches the
- * direct-chain form: readFileSync(...).includes(...). The much more common
- * var-binding form escapes it:
- *
- *   const src = fs.readFileSync(p, 'utf8');
- *   // ... 50 lines later ...
- *   assert.ok(src.includes('foo'));   // ← still source-grep, lint missed it
- *
- * This module exposes pure detectors that scan source text and return
- * structured violation records. The CLI wrapper (in the base lint) calls
- * these for each test file.
- *
- * Tests assert on the typed VIOLATION enum codes, not on prose messages.
- */
-
-const VIOLATION = Object.freeze({
-  VAR_FROM_READFILE_USED_IN_TEXT_MATCH: 'var_from_readfile_used_in_text_match',
-  WRAPPED_ASSERT_OK_MATCH: 'wrapped_assert_ok_match',
-});
-
-const TEXT_MATCH_METHODS = ['includes', 'startsWith', 'endsWith', 'match', 'search'];
-
-/**
- * Single-pass scanner. Tracks variables bound from a readFileSync call,
- * then flags any subsequent <var>.<method>( use where method is one of
- * TEXT_MATCH_METHODS.
- */
-function detectVarBindingViolations(src) {
-  // Pass 1: collect variables bound from readFileSync.
-  // Matches:   const|let|var <name> = [fs.]readFileSync(
-  const bindRe = /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:[A-Za-z_$][\w$.]*\.)?readFileSync\s*\(/g;
-  const boundVars = new Set();
-  let m;
-  while ((m = bindRe.exec(src)) !== null) {
-    boundVars.add(m[1]);
-  }
-  if (boundVars.size === 0) return [];
-
-  // Pass 2: find <var>.<method>( on any bound var.
-  const findings = [];
-  // Build a regex alternation from the bound var names.
-  const alt = [...boundVars].map((v) => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
-  const useRe = new RegExp(
-    `\\b(${alt})\\s*\\.\\s*(${TEXT_MATCH_METHODS.join('|')})\\s*\\(`,
-    'g',
-  );
-  while ((m = useRe.exec(src)) !== null) {
-    findings.push({
-      kind: VIOLATION.VAR_FROM_READFILE_USED_IN_TEXT_MATCH,
-      variable: m[1],
-      method: m[2],
-    });
-  }
-  return findings;
-}
-
-/**
- * Detects assert.ok(<expr>.match(/.../)) and assert.ok(<expr>.match(<expr>))
- * which is the same anti-pattern as assert.match but escapes the simpler
- * regex used by the base lint.
- */
-function detectWrappedAssertOkMatch(src) {
-  const re = /assert\.ok\s*\(\s*[A-Za-z_$][\w$.]*\.match\s*\(/g;
-  const findings = [];
-  let m;
-  while ((m = re.exec(src)) !== null) {
-    findings.push({ kind: VIOLATION.WRAPPED_ASSERT_OK_MATCH });
-  }
-  return findings;
-}
-
-function detectAll(src) {
-  return [...detectVarBindingViolations(src), ...detectWrappedAssertOkMatch(src)];
-}
-
-module.exports = { detectVarBindingViolations, detectWrappedAssertOkMatch, detectAll, VIOLATION };

package/scripts/lint-no-source-grep.cjs

@@ -1,174 +0,0 @@
-#!/usr/bin/env node
-/**
- * lint-no-source-grep.cjs
- *
- * Enforces the "no source-grep tests" rule:
- *   Tests must NOT read source-code .cjs files with readFileSync to assert string
- *   presence. That pattern (source-grep theater) proves a literal exists in source,
- *   not that the runtime behavior is correct.
- *
- * ALLOWED:
- *   - require('../get-shit-done/bin/lib/foo.cjs')  -- runs the module, not text inspection
- *   - readFileSync on .md / .json / .txt files     -- product-content or config output
- *   - Files annotated: // allow-test-rule: <reason>
- *
- * DISALLOWED (without allow-test-rule):
- *   - readFileSync where the path argument ends in a .cjs filename literal
- *   - A path constant (e.g. CONFIG_PATH) assigned to a .cjs lib file, used in readFileSync
- *
- * Exit 0 = clean. Exit 1 = violations found (with diagnostics).
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-
-const TESTS_DIR = path.join(__dirname, '..', 'tests');
-const ALLOW_ANNOTATION = /\/\/\s*allow-test-rule:\s*\S/;
-
-// Matches constant definitions that hold a .cjs path in a SOURCE directory.
-// Requires a source-dir indicator ('bin', 'lib', 'get-shit-done') to avoid
-// flagging temp files like path.join(tmpDir, 'example.cjs').
-//   const CONFIG_PATH = path.join(__dirname, '..', 'get-shit-done', 'bin', 'lib', 'config-schema.cjs');
-const CJS_PATH_CONST_RE = /(?:const|let|var)\s+(\w+)\s*=\s*path\.join\s*\([^)]*(?:'bin'|"bin"|'lib'|"lib"|'get-shit-done'|"get-shit-done")[^)]*['"][^'"]*\.cjs['"]/gm;
-
-// Matches readFileSync with a named variable as first arg
-const READ_WITH_CONST_RE = /readFileSync\s*\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*,/gm;
-
-// Matches readFileSync with an inline path.join(.cjs) as first arg
-const READ_WITH_INLINE_CJS_RE = /readFileSync\s*\([^,)]*path\.join\s*\([^)]*(?:'bin'|"bin"|'lib'|"lib"|'get-shit-done'|"get-shit-done")[^)]*['"][^'"]*\.cjs['"]/;
-
-/**
- * #2962-class violations: raw text matching against process output or file
- * content. The rule from CONTRIBUTING.md "Prohibited: Raw Text Matching on
- * Test Outputs": tests assert on typed structured fields, never on rendered
- * text. Patterns below are the obvious anti-patterns; subtler hidden forms
- * (e.g. wrapping the same logic in a parser function) are still forbidden
- * by the prose rule but cannot be detected lexically without an AST.
- */
-const RAW_MATCH_PATTERNS = [
-  {
-    re: /assert\.(?:match|doesNotMatch)\s*\(\s*[A-Za-z_$][A-Za-z0-9_$]*\.(?:stdout|stderr)\b/,
-    label: 'assert.match/doesNotMatch on .stdout/.stderr (emit --json from the SUT and assert on typed fields)',
-  },
-  {
-    re: /\.(?:stdout|stderr)\.(?:includes|startsWith|endsWith)\s*\(/,
-    label: '.stdout/.stderr substring match (emit --json and assert on typed fields)',
-  },
-  {
-    re: /readFileSync\s*\([^)]*\)\s*\.(?:includes|startsWith|endsWith)\s*\(/,
-    label: 'readFileSync(...).<includes|startsWith|endsWith> (expose an IR from production code; assert on its fields)',
-  },
-];
-
-function setFromMatches(content, re) {
-  const found = new Set();
-  let m;
-  const cloned = new RegExp(re.source, re.flags);
-  while ((m = cloned.exec(content)) !== null) found.add(m[1]);
-  return found;
-}
-
-function check(filepath) {
-  const content = fs.readFileSync(filepath, 'utf-8');
-  const rel = path.relative(path.join(__dirname, '..'), filepath);
-
-  if (ALLOW_ANNOTATION.test(content)) return null;
-
-  const violations = [];
-
-  // Pattern A: readFileSync(path.join(..., 'foo.cjs'), ...)
-  if (READ_WITH_INLINE_CJS_RE.test(content)) {
-    violations.push({
-      reason: 'readFileSync with inline .cjs path literal',
-      fix: 'Replace with runGsdTools() behavioral test, or add // allow-test-rule: <reason>',
-    });
-  }
-
-  // Pattern B: const FOO_PATH = path.join(..., 'foo.cjs')  +  readFileSync(FOO_PATH, ...)
-  const cjsConsts = setFromMatches(content, CJS_PATH_CONST_RE);
-  if (cjsConsts.size > 0) {
-    const readConsts = setFromMatches(content, READ_WITH_CONST_RE);
-    const overlap = [...cjsConsts].filter(c => readConsts.has(c));
-    if (overlap.length > 0) {
-      violations.push({
-        reason: `source .cjs path constant(s) used in readFileSync: ${overlap.join(', ')}`,
-        fix: 'Replace with runGsdTools() behavioral test, or add // allow-test-rule: <reason>',
-      });
-    }
-  }
-
-  // Patterns C..E: raw text matching against process output or file content.
-  // See CONTRIBUTING.md "Prohibited: Raw Text Matching on Test Outputs".
-  for (const { re, label } of RAW_MATCH_PATTERNS) {
-    if (re.test(content)) {
-      violations.push({
-        reason: label,
-        fix: 'Expose typed IR from production code; assert on structured fields. Or add // allow-test-rule: <reason>',
-      });
-    }
-  }
-
-  // Patterns F..G (#2982): var-binding readFileSync().<text-method>() and
-  // assert.ok(<expr>.match(...)). These escape the simpler patterns above
-  // because the bind and the use are on different lines or wrapped.
-  const extras = require('./lint-no-source-grep-extras.cjs');
-  const varBindFindings = extras.detectVarBindingViolations(content);
-  if (varBindFindings.length > 0) {
-    const samples = varBindFindings.slice(0, 3)
-      .map((f) => `${f.variable}.${f.method}()`)
-      .join(', ');
-    violations.push({
-      reason: `readFileSync-bound variable used in text-match method: ${samples}${varBindFindings.length > 3 ? `, …+${varBindFindings.length - 3} more` : ''}`,
-      fix: 'Expose typed IR; assert on structured fields. Or // allow-test-rule: <reason>',
-    });
-  }
-  const wrappedFindings = extras.detectWrappedAssertOkMatch(content);
-  if (wrappedFindings.length > 0) {
-    violations.push({
-      reason: `assert.ok(<expr>.match(...)) — escapes assert.match rule (${wrappedFindings.length} occurrence${wrappedFindings.length > 1 ? 's' : ''})`,
-      fix: 'Use assert.equal on a typed field, not regex match on text. Or // allow-test-rule: <reason>',
-    });
-  }
-
-  if (violations.length === 0) return null;
-  return { file: rel, violations };
-}
-
-function findTestFiles(dir) {
-  const results = [];
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...findTestFiles(full));
-    } else if (entry.name.endsWith('.test.cjs')) {
-      results.push(full);
-    }
-  }
-  return results;
-}
-
-const testFiles = findTestFiles(TESTS_DIR);
-
-const violations = testFiles.map(check).filter(Boolean);
-
-if (violations.length === 0) {
-  console.log(`ok lint-no-source-grep: ${testFiles.length} test files checked, 0 violations`);
-  process.exit(0);
-}
-
-const totalIssues = violations.reduce((n, v) => n + v.violations.length, 0);
-process.stderr.write(`\nERROR lint-no-source-grep: ${totalIssues} violation(s) across ${violations.length} file(s)\n\n`);
-for (const f of violations) {
-  process.stderr.write(`  ${f.file}\n`);
-  for (const v of f.violations) {
-    process.stderr.write(`    Problem : ${v.reason}\n`);
-    process.stderr.write(`    Fix     : ${v.fix}\n`);
-  }
-  process.stderr.write('\n');
-}
-process.stderr.write('See CONTRIBUTING.md "Prohibited: Source-Grep Tests" and\n');
-process.stderr.write('"Prohibited: Raw Text Matching on Test Outputs" for guidance.\n');
-process.stderr.write('Structural tests that legitimately read source files: add // allow-test-rule: <reason>\n\n');
-process.exit(1);

package/scripts/lint-shared-module-handsync.cjs

@@ -1,388 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * Shared Module hand-sync drift lint — Phase 6 of #3524 (#3575).
- *
- * Scans get-shit-done/bin/lib/ for .cjs files and checks whether a matching
- * TypeScript file exists in sdk/src/<name>.ts, sdk/src/query/<name>.ts, or
- * sdk/src/<name>/index.ts (excluding *.generated.ts and *.test.ts).
- *
- * Allowlist entries are keyed by the (cjs, ts) PAIR. An entry with cjs
- * `bin/lib/foo.cjs` and ts `sdk/src/foo.ts` only allow-throughs that exact
- * pair — a sibling at `sdk/src/query/foo.ts` is still flagged.
- *
- * Cross-name pairs are also supported when declared in the allowlist
- * (for example `verify.cjs` <-> `validate.ts`), so cooperating siblings are
- * observable even when basenames differ.
- *
- * If a pair is found:
- *   - cooperatingSiblings (matching cjs + ts): accepted silently (exit 0).
- *   - migrateMeBacklog (matching cjs + ts): emits a WARNING only when
- *     --warn-all is set; otherwise the pair passes silently. Backlog
- *     pairs never fail CI.
- *   - Unlisted pairs (cjs or ts not on either list): ERROR — exit 1.
- *
- * Usage:
- *   node scripts/lint-shared-module-handsync.cjs
- *   node scripts/lint-shared-module-handsync.cjs --root /path/to/repo
- *   node scripts/lint-shared-module-handsync.cjs --warn-all
- *   node scripts/lint-shared-module-handsync.cjs --cjs-dir custom/bin/lib --sdk-src custom/sdk/src
- */
-
-const fs = require('fs');
-const path = require('path');
-
-// ---------------------------------------------------------------------------
-// Argument parsing
-// ---------------------------------------------------------------------------
-const args = process.argv.slice(2);
-let ROOT = path.resolve(__dirname, '..');
-let CJS_DIR = null;          // resolved below
-let SDK_SRC = null;          // resolved below
-let SDK_SRC_EXPLICIT = false;
-let ALLOWLIST_OVERRIDE = null; // resolved below
-let WARN_ALL = false;
-let JSON_OUTPUT = false;
-
-for (let i = 0; i < args.length; i++) {
-  if (args[i] === '--root' && args[i + 1]) {
-    ROOT = path.resolve(args[++i]);
-  } else if (args[i] === '--cjs-dir' && args[i + 1]) {
-    CJS_DIR = path.resolve(args[++i]);
-  } else if (args[i] === '--sdk-src' && args[i + 1]) {
-    SDK_SRC = path.resolve(args[++i]);
-    SDK_SRC_EXPLICIT = true;
-  } else if (args[i] === '--allowlist' && args[i + 1]) {
-    ALLOWLIST_OVERRIDE = path.resolve(args[++i]);
-  } else if (args[i] === '--warn-all') {
-    WARN_ALL = true;
-  } else if (args[i] === '--json') {
-    JSON_OUTPUT = true;
-  }
-}
-
-if (!CJS_DIR) CJS_DIR = path.join(ROOT, 'get-shit-done', 'bin', 'lib');
-if (!SDK_SRC) SDK_SRC = path.join(ROOT, 'sdk', 'src');
-
-// ---------------------------------------------------------------------------
-// Load allowlist
-// When --root is given (e.g. in tests), prefer <ROOT>/scripts/allowlist.json
-// so fixture trees can supply their own allowlist. Fall back to the copy
-// co-located with this script (default production path).
-// ---------------------------------------------------------------------------
-const ALLOWLIST_PATH = ALLOWLIST_OVERRIDE
-  ? ALLOWLIST_OVERRIDE
-  : fs.existsSync(path.join(ROOT, 'scripts', 'shared-module-handsync-allowlist.json'))
-    ? path.join(ROOT, 'scripts', 'shared-module-handsync-allowlist.json')
-    : path.join(__dirname, 'shared-module-handsync-allowlist.json');
-let allowlist;
-try {
-  allowlist = JSON.parse(fs.readFileSync(ALLOWLIST_PATH, 'utf8'));
-} catch (err) {
-  process.stderr.write(
-    `lint-shared-module-handsync: failed to read allowlist at ${ALLOWLIST_PATH}: ${err.message}\n`
-  );
-  process.exit(1);
-}
-
-/**
- * Pair identity = `${cjs}::${ts}`. Keying on the pair (not just cjs)
- * prevents an allowlisted entry from silently passing an unintended
- * sibling at a different ts path with the same basename.
- *
- * @type {Set<string>} pair identities in cooperatingSiblings
- */
-const cooperatingPairs = new Set(
-  (allowlist.cooperatingSiblings || []).map((e) => `${e.cjs}::${e.ts}`)
-);
-
-/** @type {Map<string, object>} pair identity -> entry for migrateMeBacklog */
-const migrateMap = new Map(
-  (allowlist.migrateMeBacklog || []).map((e) => [`${e.cjs}::${e.ts}`, e])
-);
-
-/** @type {Map<string, Set<string>>} cjs rel path -> explicit declared ts rel paths */
-const explicitTsByCjs = new Map();
-for (const entry of [
-  ...(allowlist.cooperatingSiblings || []),
-  ...(allowlist.migrateMeBacklog || []),
-]) {
-  if (!entry || typeof entry.cjs !== 'string' || typeof entry.ts !== 'string') continue;
-  if (!explicitTsByCjs.has(entry.cjs)) explicitTsByCjs.set(entry.cjs, new Set());
-  explicitTsByCjs.get(entry.cjs).add(entry.ts);
-}
-
-// ---------------------------------------------------------------------------
-// Build SDK name index: name -> array of absolute TS paths
-// (excludes *.generated.ts and *.test.ts)
-// ---------------------------------------------------------------------------
-function buildSdkIndex(sdkSrc) {
-  const index = new Map(); // name -> [absPath, ...]
-
-  function addEntry(name, absPath) {
-    if (!index.has(name)) index.set(name, []);
-    index.get(name).push(absPath);
-  }
-
-  function walk(dir) {
-    let entries;
-    try {
-      entries = fs.readdirSync(dir, { withFileTypes: true });
-    } catch (_) {
-      return;
-    }
-    for (const ent of entries) {
-      const abs = path.join(dir, ent.name);
-      if (ent.isDirectory()) {
-        walk(abs);
-      } else if (ent.isFile() && ent.name.endsWith('.ts') &&
-                 !ent.name.endsWith('.generated.ts') &&
-                 !ent.name.endsWith('.test.ts')) {
-        const rel = path.relative(sdkSrc, abs);
-        const parts = rel.split(path.sep);
-
-        // sdk/src/<name>.ts  (direct child, not in a subdir)
-        if (parts.length === 1) {
-          const name = parts[0].slice(0, -3); // strip .ts
-          addEntry(name, abs);
-        }
-        // sdk/src/<name>/index.ts  (one subdir deep, file is index.ts)
-        else if (parts.length === 2 && parts[1] === 'index.ts') {
-          const name = parts[0];
-          addEntry(name, abs);
-        }
-        // sdk/src/query/<name>.ts  (exactly: query/<something>.ts)
-        else if (parts.length === 2 && parts[0] === 'query' && parts[1] !== 'index.ts') {
-          const name = parts[1].slice(0, -3); // strip .ts
-          addEntry(name, abs);
-        }
-      }
-    }
-  }
-
-  walk(sdkSrc);
-  return index;
-}
-
-// ---------------------------------------------------------------------------
-// Scan CJS files (direct children only; exclude *.generated.cjs)
-// ---------------------------------------------------------------------------
-function scanCjsFiles(cjsDir) {
-  let entries;
-  try {
-    entries = fs.readdirSync(cjsDir, { withFileTypes: true });
-  } catch (err) {
-    process.stderr.write(
-      `lint-shared-module-handsync: cannot read CJS dir ${cjsDir}: ${err.message}\n`
-    );
-    process.exit(1);
-  }
-  return entries
-    .filter(
-      (e) =>
-        e.isFile() &&
-        e.name.endsWith('.cjs') &&
-        !e.name.endsWith('.generated.cjs')
-    )
-    .map((e) => ({
-      name: e.name.slice(0, -4), // strip .cjs
-      absPath: path.join(cjsDir, e.name),
-    }));
-}
-
-// ---------------------------------------------------------------------------
-// Main
-// ---------------------------------------------------------------------------
-function emitJson(payload) {
-  process.stdout.write(JSON.stringify(payload) + '\n');
-}
-
-function main() {
-  // Check that the directories exist
-  if (!fs.existsSync(CJS_DIR)) {
-    if (JSON_OUTPUT) {
-      emitJson({ ok: false, reason: 'cjs_dir_missing', path: CJS_DIR });
-    } else {
-      process.stderr.write(
-        `lint-shared-module-handsync: CJS dir not found: ${CJS_DIR}\n` +
-          `  Pass --root <repo-root> or --cjs-dir <path> to override.\n`
-      );
-    }
-    process.exit(1);
-  }
-  if (!fs.existsSync(SDK_SRC)) {
-    // SDK tree was retired in ADR-0174 Phase 5.2. In default repo mode this
-    // lint becomes a no-op success; explicit --sdk-src remains fail-loud.
-    if (SDK_SRC_EXPLICIT) {
-      if (JSON_OUTPUT) {
-        emitJson({ ok: false, reason: 'sdk_src_missing', path: SDK_SRC });
-      } else {
-        process.stderr.write(
-          `lint-shared-module-handsync: SDK src dir not found: ${SDK_SRC}\n` +
-            `  Pass --root <repo-root> or --sdk-src <path> to override.\n`
-        );
-      }
-      process.exit(1);
-    }
-
-    if (JSON_OUTPUT) {
-      emitJson({
-        ok: true,
-        reason: 'sdk_retired',
-        cooperatingCount: 0,
-        backlogCount: 0,
-        warnings: [],
-      });
-    } else {
-      process.stdout.write(
-        'ok lint-shared-module-handsync: SDK source tree retired; no hand-sync pairs to lint.\n'
-      );
-    }
-    process.exit(0);
-  }
-
-  const sdkIndex = buildSdkIndex(SDK_SRC);
-  const cjsFiles = scanCjsFiles(CJS_DIR);
-
-  const errors = [];
-  const warnings = [];
-
-  function candidateTsPathsFor(relCjs, name) {
-    const byName = sdkIndex.has(name)
-      ? sdkIndex
-          .get(name)
-          .map((p) => path.relative(ROOT, p).replace(/\\/g, '/'))
-      : [];
-
-    const declared = explicitTsByCjs.has(relCjs)
-      ? Array.from(explicitTsByCjs.get(relCjs))
-      : [];
-
-    const declaredExisting = declared.filter((relTs) => {
-      const abs = path.join(ROOT, relTs);
-      return (
-        relTs.endsWith('.ts') &&
-        !relTs.endsWith('.generated.ts') &&
-        !relTs.endsWith('.test.ts') &&
-        fs.existsSync(abs) &&
-        fs.statSync(abs).isFile()
-      );
-    });
-
-    return Array.from(new Set([...byName, ...declaredExisting]));
-  }
-
-  for (const { name, absPath } of cjsFiles) {
-    // Compute relative CJS path and all declared/discovered TS candidates.
-    const relCjs = path.relative(ROOT, absPath).replace(/\\/g, '/');
-    const tsPaths = candidateTsPathsFor(relCjs, name);
-    if (tsPaths.length === 0) continue;
-
-    // Pair-aware matching, per ts sibling. Each ts candidate is classified
-    // independently against the allowlist so a partially-allowlisted set of
-    // siblings still surfaces the unauthorized ones. See #3632.
-    const unauthorizedTs = [];
-    const backlogTsForCjs = [];
-    for (const relTs of tsPaths) {
-      const pairKey = `${relCjs}::${relTs}`;
-      if (cooperatingPairs.has(pairKey)) continue;
-      if (migrateMap.has(pairKey)) {
-        backlogTsForCjs.push(relTs);
-        continue;
-      }
-      unauthorizedTs.push(relTs);
-    }
-
-    if (unauthorizedTs.length > 0) {
-      errors.push({ relCjs, tsPaths: unauthorizedTs });
-    }
-    if (backlogTsForCjs.length > 0) {
-      const entry = migrateMap.get(`${relCjs}::${backlogTsForCjs[0]}`);
-      warnings.push({ relCjs, tsPaths: backlogTsForCjs, entry });
-    }
-  }
-
-  // Count cjs files whose pair identity (cjs+ts) is on cooperatingSiblings.
-  // A file with multiple ts candidates is counted once if any pair matches.
-  const cooperatingCount = cjsFiles.filter((f) => {
-    const relCjs = path.relative(ROOT, f.absPath).replace(/\\/g, '/');
-    return candidateTsPathsFor(relCjs, f.name).some((relTs) =>
-      cooperatingPairs.has(`${relCjs}::${relTs}`)
-    );
-  }).length;
-
-  // -------------------------------------------------------------------------
-  // Report errors (exit 1)
-  // -------------------------------------------------------------------------
-  if (errors.length > 0) {
-    if (JSON_OUTPUT) {
-      emitJson({
-        ok: false,
-        reason: 'unauthorized_pairs',
-        errors,
-        warnings,
-        cooperatingCount,
-      });
-    } else {
-      process.stderr.write(
-        `\nERROR lint-shared-module-handsync: ${errors.length} unauthorized hand-sync pair(s) found.\n\n`
-      );
-      for (const { relCjs, tsPaths } of errors) {
-        process.stderr.write(`  CJS: ${relCjs}\n`);
-        for (const ts of tsPaths) {
-          process.stderr.write(`   TS: ${ts}\n`);
-        }
-        process.stderr.write('\n');
-      }
-      process.stderr.write(
-        'To resolve, choose one of:\n' +
-          '  1. Migrate to a Shared Module (preferred): create sdk/src/<name>/index.ts as the\n' +
-          '     source-of-truth, write a generator script (sdk/scripts/gen-<name>.mjs), add a\n' +
-          '     freshness check, and update CI. See docs/agents/cjs-sdk-seam.md for the pattern.\n' +
-          '  2. Add an explicit allowlist entry to scripts/shared-module-handsync-allowlist.json\n' +
-          '     with a justification explaining why this pair is a legitimate cooperating sibling\n' +
-          '     rather than a drift anti-pattern. Requires maintainer review via CODEOWNERS.\n\n'
-      );
-    }
-    process.exit(1);
-  }
-
-  // -------------------------------------------------------------------------
-  // Report warnings (no exit code change)
-  // -------------------------------------------------------------------------
-  if (warnings.length > 0 && WARN_ALL && !JSON_OUTPUT) {
-    process.stderr.write(
-      `\nWARNING lint-shared-module-handsync: ${warnings.length} known drift anti-pattern pair(s) in migrateMeBacklog.\n` +
-        `These are tracked for future Shared Module migration but do not block CI.\n\n`
-    );
-    for (const { relCjs, tsPaths, entry } of warnings) {
-      process.stderr.write(`  CJS: ${relCjs}\n`);
-      for (const ts of tsPaths) {
-        process.stderr.write(`   TS: ${ts}\n`);
-      }
-      process.stderr.write(`  Tracked: ${entry.trackedIn}\n`);
-      process.stderr.write(`  Hint: ${entry.justification}\n\n`);
-    }
-  }
-
-  // -------------------------------------------------------------------------
-  // Success
-  // -------------------------------------------------------------------------
-  if (JSON_OUTPUT) {
-    emitJson({
-      ok: true,
-      cooperatingCount,
-      backlogCount: warnings.length,
-      warnings,
-    });
-  } else {
-    process.stdout.write(
-      `ok lint-shared-module-handsync: no unauthorized hand-sync pairs found` +
-        ` (${cooperatingCount} cooperating sibling(s), ${warnings.length} backlog pair(s))\n`
-    );
-  }
-  process.exit(0);
-}
-
-main();