@opengsd/gsd-core 1.7.0 → 1.9.0

package/scripts/lint-compiled-artifact-sync.cjs

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+/**
+ * lint-compiled-artifact-sync — fail when a *tracked* compiled artifact under
+ * gsd-core/bin/lib/ has drifted from its src/*.cts source.
+ *
+ * ADR-457 compiles src/*.cts to gsd-core/bin/lib/*.cjs at build time and expects
+ * those artifacts to be gitignored. Most are (see .gitignore). A handful are
+ * still tracked because the migration that moved the module into src/ did not
+ * also add the emitted .cjs to .gitignore. While a compiled artifact remains
+ * tracked, the committed bytes are what ships to anyone who reads the repo
+ * without building — so they must match the source.
+ *
+ * #2653: gsd-core/bin/lib/api-coverage.cjs sat four days behind its .cts after
+ * PR #2551 changed the source without regenerating the artifact, shipping a
+ * module that silently lacked the entire #2366 fix while CI stayed green.
+ *
+ * This check is deliberately regime-agnostic: it asserts a property of whatever
+ * is tracked right now. If the remaining artifacts are later untracked and
+ * gitignored (the ADR-457 end state), the tracked set becomes empty and this
+ * script passes trivially — no edit required.
+ *
+ * Usage: node scripts/lint-compiled-artifact-sync.cjs [--check]
+ * Exit 0 when every tracked artifact matches a fresh compile; 1 otherwise.
+ */
+
+'use strict';
+
+const { execFileSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const LIB_DIR = path.join('gsd-core', 'bin', 'lib');
+const SRC_DIR = 'src';
+
+/** Frozen reason codes so tests assert on structure, not prose. */
+const REASON = Object.freeze({
+  OK: 'ok_artifacts_in_sync',
+  DRIFTED: 'fail_artifact_drifted',
+  BUILD_FAILED: 'fail_build_failed',
+  MISSING_EMIT: 'fail_missing_emit',
+});
+
+function git(args) {
+  return execFileSync('git', args, { cwd: REPO_ROOT, encoding: 'utf8' });
+}
+
+/**
+ * Tracked .cjs files under gsd-core/bin/lib/ that have a matching src/*.cts.
+ * Uses `git ls-files` so the set is derived from what git actually tracks
+ * rather than a hand-maintained list that could itself drift.
+ */
+function trackedCompiledArtifacts() {
+  const tracked = git(['ls-files', LIB_DIR]).split('\n').filter((l) => l.endsWith('.cjs'));
+  const out = [];
+  for (const rel of tracked) {
+    const stem = path.basename(rel, '.cjs');
+    const subdir = path.dirname(path.relative(LIB_DIR, rel));
+    const srcRel = path.join(SRC_DIR, subdir === '.' ? '' : subdir, `${stem}.cts`);
+    if (fs.existsSync(path.join(REPO_ROOT, srcRel))) out.push({ artifact: rel, source: srcRel });
+  }
+  return out.sort((a, b) => (a.artifact < b.artifact ? -1 : a.artifact > b.artifact ? 1 : 0));
+}
+
+/** Compile the whole project to a throwaway outDir so the work tree is untouched. */
+function compileToTemp() {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-artifact-sync-'));
+  try {
+    execFileSync(
+      process.execPath,
+      [
+        path.join(REPO_ROOT, 'node_modules', 'typescript', 'bin', 'tsc'),
+        '-p', path.join(REPO_ROOT, 'tsconfig.build.json'),
+        '--outDir', tmp,
+        // A throwaway outDir must not reuse the in-tree incremental state, or
+        // tsc skips emit for files it believes are already current.
+        '--incremental', 'false',
+        '--tsBuildInfoFile', 'null',
+      ],
+      { cwd: REPO_ROOT, encoding: 'utf8', stdio: 'pipe' },
+    );
+    return { ok: true, dir: tmp };
+  } catch (err) {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    const detail = [err.stdout, err.stderr].filter(Boolean).join('\n').trim();
+    return { ok: false, detail };
+  }
+}
+
+function main() {
+  const pairs = trackedCompiledArtifacts();
+  if (pairs.length === 0) {
+    console.log('ok compiled-artifact-sync: no tracked compiled artifacts (ADR-457 end state)');
+    return 0;
+  }
+
+  const build = compileToTemp();
+  if (!build.ok) {
+    console.error(`FAIL compiled-artifact-sync: ${REASON.BUILD_FAILED}`);
+    console.error(build.detail);
+    return 1;
+  }
+
+  const drifted = [];
+  const missing = [];
+  try {
+    for (const { artifact, source } of pairs) {
+      const fresh = path.join(build.dir, path.relative(LIB_DIR, artifact));
+      if (!fs.existsSync(fresh)) { missing.push({ artifact, source }); continue; }
+      const a = fs.readFileSync(path.join(REPO_ROOT, artifact));
+      const b = fs.readFileSync(fresh);
+      if (!a.equals(b)) drifted.push({ artifact, source, committed: a.length, expected: b.length });
+    }
+  } finally {
+    fs.rmSync(build.dir, { recursive: true, force: true });
+  }
+
+  if (missing.length > 0) {
+    console.error(`FAIL compiled-artifact-sync: ${REASON.MISSING_EMIT}`);
+    for (const m of missing) console.error(`  ${m.artifact} — no emit produced from ${m.source}`);
+    return 1;
+  }
+
+  if (drifted.length > 0) {
+    console.error(`FAIL compiled-artifact-sync: ${REASON.DRIFTED}`);
+    for (const d of drifted) {
+      console.error(`  ${d.artifact} (${d.committed} bytes) != compile of ${d.source} (${d.expected} bytes)`);
+    }
+    console.error('');
+    console.error('The committed artifact is what ships to anyone reading the repo without');
+    console.error('building, so it must match its source. Fix with:');
+    console.error('  npm run build:lib && git add ' + drifted.map((d) => d.artifact).join(' '));
+    console.error('');
+    console.error('Alternatively, per ADR-457 these artifacts are meant to be gitignored —');
+    console.error('untracking them (git rm --cached + .gitignore) also resolves this.');
+    return 1;
+  }
+
+  console.log(`ok compiled-artifact-sync: ${pairs.length} tracked artifact(s) match their source`);
+  return 0;
+}
+
+if (require.main === module) process.exitCode = main();
+
+module.exports = { REASON, trackedCompiledArtifacts };

package/scripts/lint-emitted-drift-ack.cjs

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * lint-emitted-drift-ack — refuse to merge a broken emitted-drift acknowledgment (#2789).
+ *
+ * The ack document is read from TWO sides: the working tree (`readAckFile`) and the BASE
+ * REF (`readAckFileAtRef`), because an entry already present at the base is spent and may
+ * no longer clear a delta. The base-side read fails LOUDLY on a document it cannot parse
+ * — it has to, since silently inheriting nothing would leave every entry able to consume
+ * a delta, which is the pre-#2789 gate.
+ *
+ * That makes a corrupt document ON THE BASE BRANCH unusually expensive: it reds every PR
+ * that carries an ack until someone repairs it. The real-tree test avoids an outright
+ * deadlock (a tree with no ack never consults the base, so the repair PR still lands),
+ * but the cheaper answer is to never let a broken document reach the base at all. This
+ * runs in `lint:ci`, so a PR carrying one cannot go green and cannot merge.
+ *
+ * This validator is DELIBERATELY STANDALONE. `scripts/` ships in the npm package and
+ * `tests/` does not (package.json `files`), so requiring the gate's own `parseAck` from
+ * here would be a MODULE_NOT_FOUND in the published package. The duplication is bounded
+ * by a parity test — `tests/emitted-attribution.test.cjs` runs both surfaces over one
+ * corpus and fails if they ever disagree about what is schema-valid.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const ACK_VERSION = 1;
+const ACK_REPO_PATH = 'tests/emitted-drift-ack.json';
+const REPO_ROOT = path.join(__dirname, '..');
+
+const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/**
+ * Validate an ack document's raw text.
+ *
+ * `schemaErrors` are the ones that must agree with the gate's `parseAck` — the shape
+ * contract. `policyErrors` are lint-only rules that `parseAck` deliberately does NOT
+ * enforce, because they are about what may be COMMITTED rather than what may be parsed:
+ * a present-but-entryless document parses fine and signals nothing, so it must be deleted
+ * rather than left behind.
+ *
+ * @param {string|null} raw  file contents, or null when the file is absent
+ * @returns {{ schemaErrors: string[], policyErrors: string[], ok: boolean }}
+ */
+function validateAckText(raw) {
+  const schemaErrors = [];
+  const policyErrors = [];
+  const done = () => ({ schemaErrors, policyErrors, ok: schemaErrors.length === 0 && policyErrors.length === 0 });
+
+  if (raw === null) return done(); // absent is the healthy steady state
+
+  if (raw.trim() === '') {
+    schemaErrors.push(`${ACK_REPO_PATH} is present but empty`);
+    return done();
+  }
+
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch (err) {
+    schemaErrors.push(`${ACK_REPO_PATH} is not valid JSON: ${err.message}`);
+    return done();
+  }
+
+  // A document that is literally `null` is POLICY, not schema. The gate's `parseAck` uses
+  // `null` as its "absent == no acks" sentinel, so it reads such a file as legal and
+  // harmless — and the parity test holds us to that. It is still not something to commit:
+  // it declares nothing, so the remedy is the same as an entryless document.
+  if (doc === null) {
+    policyErrors.push(
+      `${ACK_REPO_PATH} contains "null" and declares no acknowledgments. Delete the file — `
+      + 'the healthy steady state is no file at all.',
+    );
+    return done();
+  }
+
+  if (!isPlainObject(doc)) {
+    schemaErrors.push(
+      `${ACK_REPO_PATH}: must be a JSON object, got ${Array.isArray(doc) ? 'array' : typeof doc}`,
+    );
+    return done();
+  }
+
+  if (doc.version !== undefined && doc.version !== ACK_VERSION) {
+    schemaErrors.push(
+      `${ACK_REPO_PATH}: unsupported version ${JSON.stringify(doc.version)} (expected ${ACK_VERSION})`,
+    );
+  }
+
+  const paths = doc.paths;
+  if (paths !== undefined && !isPlainObject(paths)) {
+    schemaErrors.push(`${ACK_REPO_PATH}: "paths" must be an object of <emitted path> -> { reason }`);
+    return done();
+  }
+
+  const entries = paths === undefined ? [] : Object.entries(paths);
+  for (const [rel, value] of entries) {
+    const reason = isPlainObject(value) ? value.reason : value;
+    if (typeof reason !== 'string' || reason.trim() === '') {
+      schemaErrors.push(`${ACK_REPO_PATH}: ack for "${rel}" has no non-empty "reason"`);
+    }
+  }
+
+  // Lint-only. An entryless document parses cleanly and acknowledges nothing, so it is
+  // pure confusion on the base branch — and it is exactly what a contributor leaves
+  // behind after removing the last entry by hand.
+  if (entries.length === 0) {
+    policyErrors.push(
+      `${ACK_REPO_PATH} is present but declares no acknowledgments. Delete the file — an `
+      + 'empty one signals nothing, and the healthy steady state is no file at all.',
+    );
+  }
+
+  return done();
+}
+
+function readIfPresent(file) {
+  return fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
+}
+
+function main() {
+  const file = path.join(REPO_ROOT, ...ACK_REPO_PATH.split('/'));
+  const result = validateAckText(readIfPresent(file));
+  const all = [...result.schemaErrors, ...result.policyErrors];
+
+  if (all.length) {
+    console.error(`lint-emitted-drift-ack: ${all.length} problem(s) in ${ACK_REPO_PATH}\n`);
+    for (const e of all) console.error(`  - ${e}`);
+    console.error(
+      '\nThis blocks the merge on purpose. The base-side reader fails loudly on a document '
+      + 'it cannot parse, so a broken one on the base branch reds every PR that carries an '
+      + 'acknowledgment. Fix or delete the file here, where it is cheap.',
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(
+    fs.existsSync(file)
+      ? `ok lint-emitted-drift-ack: ${ACK_REPO_PATH} is well-formed`
+      : `ok lint-emitted-drift-ack: ${ACK_REPO_PATH} absent (the healthy steady state)`,
+  );
+}
+
+if (require.main === module) main();
+
+module.exports = { validateAckText, ACK_VERSION, ACK_REPO_PATH };

package/scripts/lint-fix-has-regression-test.cjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * lint-fix-has-regression-test.cjs — gate: every fix(#NNNN) commit must
+ * include at least one behavioral test file (tests/*.test.cjs) that is NOT
+ * an auto-generated fixture/baseline.
+ *
+ * ## Why
+ *
+ * CONTRIBUTING.md:47: "Fix it. Write a test that would have caught the bug."
+ * CLAUDE.md: "Regression Protocol: Write the regression test first."
+ *
+ * Three merged PRs shipped without regression tests because the golden-fixture
+ * regeneration (20+ files under tests/) camouflaged the absence of real
+ * *.test.cjs changes. This gate makes the rule machine-enforced.
+ *
+ * ## What this enforces
+ *
+ * For every commit in `git log origin/next..HEAD` whose subject matches
+ * /^fix\(#\d+\)/ or /^feat\(#\d+\)/, the cumulative diff must include at
+ * least one file under tests/ matching /\.test\.cjs$/ that is NOT:
+ *   - under tests/fixtures/
+ *   - under tests/install-tree/
+ *   - a *-baseline.json file
+ *
+ * If the filtered list is empty, the gate fails with a message naming the
+ * fix commits and directing the author to add a regression test.
+ *
+ * ## Overrides
+ *
+ * Set GSD_SKIP_REGRESSION_TEST_GATE=1 for legitimate exceptions (e.g. a
+ * pure-config or pure-refactor PR where no behavioral test is possible).
+ * This env var is auditable in CI logs.
+ */
+
+const { execSync } = require('child_process');
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const FIX_OR_FEAT_RE = /^(?:fix|feat)\(#(\d+)\)/;
+
+const EXCLUDE_PATTERNS = [
+  /tests[\\/]fixtures[\\/]/,
+  /tests[\\/]install-tree[\\/]/,
+  /-baseline\.json$/,
+];
+
+function isRealTestFile(filePath) {
+  if (!filePath.includes('tests/')) return false;
+  if (!/\.test\.cjs$/.test(filePath)) return false;
+  return !EXCLUDE_PATTERNS.some((re) => re.test(filePath));
+}
+
+function getFixCommits(baseRef) {
+  const log = execSync(
+    `git log ${baseRef}..HEAD --format='%H%x09%s' --no-merges`,
+    { encoding: 'utf8', timeout: 10000 },
+  );
+  return log
+    .trim()
+    .split('\n')
+    .filter(Boolean)
+    .map((line) => {
+      const [sha, subject] = line.split('\t');
+      const match = subject.match(FIX_OR_FEAT_RE);
+      return match ? { sha: sha.slice(0, 12), subject, issue: match[1] } : null;
+    })
+    .filter(Boolean);
+}
+
+function getChangedTestFiles(baseRef) {
+  const diff = execSync(
+    `git diff ${baseRef}...HEAD --name-only --no-merges`,
+    { encoding: 'utf8', timeout: 10000 },
+  );
+  return diff
+    .trim()
+    .split('\n')
+    .filter(Boolean)
+    .filter(isRealTestFile);
+}
+
+function main() {
+  if (process.env.GSD_SKIP_REGRESSION_TEST_GATE === '1') {
+    console.log('lint-fix-has-regression-test: SKIPPED (GSD_SKIP_REGRESSION_TEST_GATE=1)');
+    return;
+  }
+
+  const baseRef = process.env.GSD_REGRESSION_GATE_BASE || 'origin/next';
+
+  let fixCommits;
+  try {
+    fixCommits = getFixCommits(baseRef);
+  } catch {
+    console.log(`lint-fix-has-regression-test: no fix/feat commits found vs ${baseRef}, skipping`);
+    return;
+  }
+
+  if (fixCommits.length === 0) {
+    console.log('lint-fix-has-regression-test: no fix/feat commits, passing');
+    return;
+  }
+
+  let testFiles;
+  try {
+    testFiles = getChangedTestFiles(baseRef);
+  } catch {
+    testFiles = [];
+  }
+
+  if (testFiles.length === 0) {
+    const commitList = fixCommits
+      .map((c) => `  ${c.sha} ${c.subject}`)
+      .join('\n');
+    throw new ExitError(1,
+      `lint-fix-has-regression-test: ${fixCommits.length} fix/feat commit(s) but ZERO behavioral test files (*.test.cjs) in the diff.\n` +
+      `Auto-generated fixtures (tests/fixtures/, *-baseline.json) do NOT count.\n\n` +
+      `Fix commits:\n${commitList}\n\n` +
+      `CONTRIBUTING.md:47: "Write a test that would have caught the bug."\n` +
+      `Add a regression test to an existing tests/*.test.cjs file, or set ` +
+      `GSD_SKIP_REGRESSION_TEST_GATE=1 if no behavioral test is possible (auditable in CI).`
+    );
+  }
+
+  console.log(
+    `lint-fix-has-regression-test: PASS — ${fixCommits.length} fix/feat commit(s), ` +
+    `${testFiles.length} behavioral test file(s): ${testFiles.join(', ')}`
+  );
+}
+
+runMain(main);

package/scripts/lint-portable-timeout.cjs

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * lint-portable-timeout.cjs — ban hardcoded GNU-`timeout` in gsd
+ * workflow / agent / reference / command markdown (#2351).
+ *
+ * ## Why
+ *
+ * `timeout` and `gtimeout` are GNU coreutils. Stock macOS ships NEITHER
+ * (`brew install coreutils` only provides `gtimeout`, and only if installed).
+ * A hardcoded `timeout <n> <cmd>` inside an executable workflow snippet exits
+ * 127 ("command not found") on such a host, and the gate that runs it — which
+ * only distinguishes 0 (pass) / 124 (timeout) / other (fail) — misreports a
+ * perfectly good build or test command as a FAILURE (#2351).
+ *
+ * The portable, coreutils-independent replacement is the
+ * `gsd_run run-with-timeout <secs> [--] <cmd…>` verb (gsd-core/bin/gsd-tools.cjs):
+ * a Node-based wall-clock cap that keeps GNU `timeout`'s exit-code contract
+ * (124 on timeout) on every platform. The resolution lives there ONCE and is
+ * reused by every call site instead of a per-file `command -v timeout` probe.
+ *
+ * This ratchet fails the build if a NEW bare `timeout`/`gtimeout` execution
+ * slips into any of these surfaces.
+ *
+ * ## What PASSES
+ *
+ * - `gsd_run run-with-timeout 300 -- bash -c "$CMD"` — the approved verb.
+ * - `command -v timeout` / `command -v gtimeout` / `which timeout` capability
+ *   PROBES — portable: they detect the binary, they do not unconditionally
+ *   execute it (see gsd-core/workflows/review.md's `_AGY_KILLER` fallback).
+ * - Prose ("timed out after 5 minutes"), config keys
+ *   (`workflow.test_gate_timeout`), CI `timeout-minutes:`, the agy
+ *   `--print-timeout` flag, `$TIMEOUT`-style variable names — none of which is
+ *   a bare timeout command invocation.
+ *
+ * ## What FAILS
+ *
+ * A bare `timeout <duration> …` / `gtimeout <duration> …` command invocation,
+ * where `<duration>` is a number, a `"$VAR"`, or a `${VAR}` (optionally with a
+ * leading `-k`/`-s` option).
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const ROOT = path.join(__dirname, '..');
+
+// Surfaces whose markdown carries agent-executed bash. Kept broad so the guard
+// catches a regression anywhere a workflow snippet could bound a command.
+const DEFAULT_ROOTS = ['gsd-core/workflows', 'gsd-core/references', 'agents', 'commands'];
+
+// Capability probes to strip BEFORE testing for an invocation, so a portable
+// `command -v timeout` on the same line is never mistaken for a bare execution.
+const PROBE_RE = /command\s+-v\s+g?timeout|which\s+g?timeout/g;
+
+// A `timeout`/`gtimeout` token INVOKED AS A COMMAND with a duration argument.
+// Anchored to a command position — line start or right after `| & ; ( ` {` — so
+// prose ("increase the timeout 30 seconds") and the `--print-timeout` flag / the
+// approved `run-with-timeout` verb (no separator before "timeout") never match.
+// Between the token and the duration, allow any number of leading options in
+// short OR long form (`-k5`, `-k 5`, `--kill-after=5`, `--foreground`,
+// `--signal=KILL`). The duration is a digit, `$((arith))`, a `$VAR`, or `${VAR}`.
+const EXEC_RE = /(?:^|[|&;(`{])[ \t]*g?timeout[ \t]+(?:-{1,2}[\w-]+(?:=\S+)?[ \t]+)*["']?(?:\$\{?[A-Za-z_]|\$\(\(|\d)/;
+
+/**
+ * Locate bare `timeout`/`gtimeout` invocations in a block of text.
+ *
+ * Pure (no I/O): callers pass the file contents; the caller reads files. Returns
+ * structured findings so tests assert on typed values, never on grepped text.
+ *
+ * @param {string} text  file contents
+ * @returns {{ line: number, snippet: string }[]}  findings (empty array = clean)
+ */
+function findRawTimeoutInvocations(text) {
+  const findings = [];
+  const lines = String(text).split(/\r?\n/);
+  for (let i = 0; i < lines.length; i += 1) {
+    const stripped = lines[i].replace(PROBE_RE, '');
+    if (EXEC_RE.test(stripped)) findings.push({ line: i + 1, snippet: lines[i].trim() });
+  }
+  return findings;
+}
+
+function walkMarkdown(dir) {
+  const out = [];
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out; // a missing root is not an error — some surfaces are optional
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...walkMarkdown(full));
+    else if (entry.isFile() && entry.name.endsWith('.md')) out.push(full);
+  }
+  return out;
+}
+
+/**
+ * Scan the given roots (repo-relative) for bare timeout invocations.
+ * @param {string[]} roots
+ * @returns {{ file: string, line: number, snippet: string }[]}
+ */
+function scan(roots = DEFAULT_ROOTS) {
+  const offenders = [];
+  for (const rel of roots) {
+    const abs = path.isAbsolute(rel) ? rel : path.join(ROOT, rel);
+    for (const file of walkMarkdown(abs)) {
+      const findings = findRawTimeoutInvocations(fs.readFileSync(file, 'utf8'));
+      for (const f of findings) {
+        offenders.push({ file: path.relative(ROOT, file), line: f.line, snippet: f.snippet });
+      }
+    }
+  }
+  return offenders;
+}
+
+function main() {
+  const rootsEnv = process.env.GSD_LINT_PORTABLE_TIMEOUT_ROOTS;
+  const roots = rootsEnv ? rootsEnv.split(path.delimiter).filter(Boolean) : DEFAULT_ROOTS;
+  const offenders = scan(roots);
+  if (offenders.length > 0) {
+    const detail = offenders.map((o) => `  ${o.file}:${o.line}  ${o.snippet}`).join('\n');
+    throw new ExitError(
+      1,
+      'lint-portable-timeout: hardcoded `timeout`/`gtimeout` is not portable — stock\n' +
+        'macOS ships no coreutils, so these exit 127 and misreport a passing command as a\n' +
+        'failure. Use `gsd_run run-with-timeout <secs> [--] <cmd…>` instead (#2351):\n' +
+        detail,
+    );
+  }
+  console.log(`ok lint-portable-timeout: no hardcoded timeout invocations in ${roots.length} root(s)`);
+}
+
+module.exports = { findRawTimeoutInvocations, scan, DEFAULT_ROOTS };
+
+if (require.main === module) runMain(main);

package/scripts/lint-resolution-provenance.cjs

@@ -56,6 +56,15 @@ const REGISTRY = [
     sourceFile: 'src/init.cts',
     testFile: 'tests/agent-skills.test.cjs',
   },
+  {
+    // Registered by #1880 (ADR-1411 amendment "corrupt is not absent"). Until
+    // this entry existed the config-loader seam carried the provenance contract
+    // with nothing guarding it, so a regression that collapsed configured_empty
+    // back into not_configured would have shipped silently.
+    verb: 'config-loader',
+    sourceFile: 'src/config-loader.cts',
+    testFile: 'tests/config-loader.test.cjs',
+  },
 ];
 
 // Markers that MUST appear in every registered verb's test file.

package/scripts/lint-test-file-count.allowlist.json

@@ -60,6 +60,7 @@
     "state": {
       "files": [
         "state-acquirestatelock-non-eexist.test.cjs",
+        "state-command-cutover.test.cjs",
         "state-prune.test.cjs",
         "state-rebuild-cli.test.cjs",
         "state-rebuild.test.cjs",

package/scripts/mutation-matrix.cjs

@@ -145,6 +145,10 @@ const COVERED = {
     tests: [
       'tests/frontmatter.property.test.cjs',
       'tests/frontmatter.unit.test.cjs',
+      // #1882 added the unterminated-fence detection to frontmatter.cjs, and the tests that
+      // constrain it live here. Without this entry the mutants in that branch are covered by
+      // no test in the shard, so the module's score drops even though the behaviour is tested.
+      'tests/unusable-input.test.cjs',
     ],
     minScore: 62,
   },

package/scripts/prompt-injection-scan.sh

@@ -102,6 +102,12 @@ ALLOWLIST=(
   # exec command strings (execFileSync('npm', ['install'])) as test DATA the rule
   # must lint — not attack vectors. ADR-1703 Phase 4 (#1726).
   'tests/no-bare-npm-exec.rule.test.cjs'
+  # #2547 — the Kimi field-shadowing regression proves gsd-prompt-guard still
+  # SCANS the reconstructed edit[].new content when a model-supplied new_string
+  # tries to shadow it. The fixture must be a real injection phrase or the test
+  # asserts nothing: it is the payload the guard is required to catch, carried
+  # as test DATA. Same class as the read-injection-scanner suites above.
+  'tests/kimi-payload-field-shadowing.security.test.cjs'
 )
 
 is_allowlisted() {