@opensip-cli/checks-typescript 0.1.7 → 0.1.9

package/dist/__tests__/null-safety-typed.test.js

@@ -0,0 +1,112 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { RunScope, runWithScope } from '@opensip-cli/core';
+import { fileCache, setCurrentRecipeCheckConfig } from '@opensip-cli/fitness';
+import { createTypeCheckedProgram } from '@opensip-cli/lang-typescript';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { analyzeNullSafetyTyped, nullSafety, } from '../checks/quality/data-integrity/null-safety.js';
+let dir;
+beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'opensip-nstyped-'));
+});
+afterEach(() => {
+    fileCache.clear();
+    rmSync(dir, { recursive: true, force: true });
+});
+function write(rel, content) {
+    const abs = join(dir, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, content);
+    return abs;
+}
+/** A scope carrying the fitness fileCache + a fresh shared-Program cell. */
+function scopeWithFitness() {
+    const scope = new RunScope();
+    Object.assign(scope, { fitness: { fileCache, tsProgram: { value: undefined } } });
+    return scope;
+}
+// One fixture exercising every decision: nullable/undefined call receivers
+// (flag), non-null receiver (ok), `any` receiver (fail-open), optional chain
+// (skip), and a nullable element-access receiver (flag).
+const FIXTURE = [
+    'function getNullable(): { x: number } | null { return null; }',
+    'function getMaybe(): { y: number } | undefined { return undefined; }',
+    'function getSafe(): { z: number } { return { z: 1 }; }',
+    'function getAny(): any { return 1; }',
+    'const arr: ({ a: number } | null)[] = [];',
+    'export function f(): unknown[] {',
+    '  const out: unknown[] = [];',
+    '  out.push(getNullable().x);',
+    '  out.push(getMaybe().y);',
+    '  out.push(getSafe().z);',
+    '  out.push(getAny().w);',
+    '  out.push(getNullable()?.x ?? 0);',
+    '  out.push(arr[0].a);',
+    '  return out;',
+    '}',
+].join('\n');
+describe('analyzeNullSafetyTyped (type-aware detector)', () => {
+    it('flags only receivers whose actual type includes null/undefined', () => {
+        const file = write('src/sample.ts', FIXTURE);
+        const { checker, getSourceFile } = createTypeCheckedProgram([file], { projectRoot: dir });
+        const found = analyzeNullSafetyTyped(getSourceFile(file), checker, file).map((v) => v.match);
+        expect(found).toEqual(expect.arrayContaining(['getNullable().x', 'getMaybe().y', 'arr[0].a']));
+        expect(found).toHaveLength(3);
+        // Non-null, `any` (fail-open), and optional-chained receivers are NOT flagged.
+        expect(found).not.toContain('getSafe().z');
+        expect(found).not.toContain('getAny().w');
+        expect(found.some((m) => m?.includes('?.'))).toBe(false);
+    });
+    it('skips safe-by-construction paths (schema/DI) entirely', () => {
+        const file = write('src/sample.ts', FIXTURE);
+        const { checker, getSourceFile } = createTypeCheckedProgram([file], { projectRoot: dir });
+        // The filePath drives the path skip independently of the SourceFile content.
+        expect(analyzeNullSafetyTyped(getSourceFile(file), checker, '/proj/src/schema/x.ts')).toEqual([]);
+    });
+    it('honors additionalSafeBuilders as a manual escape hatch for unresolved symbols', async () => {
+        const file = write('src/sample.ts', FIXTURE);
+        const { checker, getSourceFile } = createTypeCheckedProgram([file], { projectRoot: dir });
+        const sf = getSourceFile(file);
+        const scope = new RunScope();
+        await runWithScope(scope, () => {
+            setCurrentRecipeCheckConfig(scope, {
+                'null-safety': { additionalSafeBuilders: ['getNullable('] },
+            });
+            const found = analyzeNullSafetyTyped(sf, checker, file).map((v) => v.match);
+            expect(found).not.toContain('getNullable().x'); // suppressed by escape hatch
+            expect(found).toContain('getMaybe().y'); // still flagged
+            return Promise.resolve();
+        });
+    });
+});
+describe('null-safety check — analyzeAll mode selection', () => {
+    it('defaults to type-aware — catches nullable-return accesses the convention misses', async () => {
+        const file = write('src/svc.ts', FIXTURE);
+        const scope = scopeWithFitness();
+        await runWithScope(scope, async () => {
+            // No typeAware config → default on.
+            await fileCache.prewarm(dir, ['**/*']);
+            const result = await nullSafety.run(dir, { targetFiles: [file] });
+            expect(result.signals.length).toBeGreaterThanOrEqual(3);
+            expect(result.signals.every((s) => s.message.includes('unsafe property access'))).toBe(true);
+            // The `get*`-prefixed nullable returns are caught (convention would miss them).
+            expect(result.signals.some((s) => s.message.includes("'.x'"))).toBe(true);
+        });
+    });
+    it('falls back to the convention heuristic when typeAware is disabled', async () => {
+        const file = write('src/svc.ts', FIXTURE);
+        const scope = scopeWithFitness();
+        await runWithScope(scope, async () => {
+            setCurrentRecipeCheckConfig(scope, { 'null-safety': { typeAware: false } });
+            await fileCache.prewarm(dir, ['**/*']);
+            const result = await nullSafety.run(dir, { targetFiles: [file] });
+            // Convention trusts `get*` calls as non-null (its false-negative), so the
+            // nullable-return accesses are missed; the unknown element-access receiver
+            // (`arr[0]`) is still flagged.
+            expect(result.signals.some((s) => s.message.includes("'.x'"))).toBe(false);
+            expect(result.signals.some((s) => s.message.includes("'.a'"))).toBe(true);
+        });
+    });
+});
+//# sourceMappingURL=null-safety-typed.test.js.map

package/dist/__tests__/null-safety-typed.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"null-safety-typed.test.js","sourceRoot":"","sources":["../../src/__tests__/null-safety-typed.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EACL,sBAAsB,EACtB,UAAU,GACX,MAAM,iDAAiD,CAAC;AAEzD,IAAI,GAAW,CAAC;AAEhB,UAAU,CAAC,GAAG,EAAE;IACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,GAAG,EAAE;IACb,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,GAAW,EAAE,OAAe;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,yDAAyD;AACzD,MAAM,OAAO,GAAG;IACd,+DAA+D;IAC/D,sEAAsE;IACtE,wDAAwD;IACxD,sCAAsC;IACtC,2CAA2C;IAC3C,kCAAkC;IAClC,8BAA8B;IAC9B,8BAA8B;IAC9B,2BAA2B;IAC3B,0BAA0B;IAC1B,yBAAyB;IACzB,oCAAoC;IACpC,uBAAuB;IACvB,eAAe;IACf,GAAG;CACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE9F,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,+EAA+E;QAC/E,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,6EAA6E;QAC7E,MAAM,CAAC,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAE,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAC5F,EAAE,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,wBAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,CAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE;YAC7B,2BAA2B,CAAC,KAAK,EAAE;gBACjC,aAAa,EAAE,EAAE,sBAAsB,EAAE,CAAC,cAAc,CAAC,EAAE;aAC5D,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,6BAA6B;YAC7E,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB;YACzD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;QACjC,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACnC,oCAAoC;YACpC,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7F,gFAAgF;YAChF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;QACjC,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACnC,2BAA2B,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClE,0EAA0E;YAC1E,2EAA2E;YAC3E,+BAA+B;YAC/B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/shared-program.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=shared-program.test.d.ts.map

package/dist/__tests__/shared-program.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-program.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/shared-program.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/shared-program.test.js

@@ -0,0 +1,41 @@
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { RunScope, runWithScope } from '@opensip-cli/core';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { getSharedTypeCheckedProgram } from '../shared/type-program.js';
+let dir;
+let file;
+beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'opensip-shared-prog-'));
+    file = join(dir, 'a.ts');
+    writeFileSync(file, 'export const x: string | null = null;\n');
+});
+afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+});
+describe('getSharedTypeCheckedProgram', () => {
+    it('builds the Program once per run and reuses it across calls (memoized on the subscope cell)', async () => {
+        const scope = new RunScope();
+        // Minimal fitness subscope: the helper only reads `fitness.tsProgram`.
+        Object.assign(scope, { fitness: { tsProgram: { value: undefined } } });
+        await runWithScope(scope, () => {
+            const first = getSharedTypeCheckedProgram([file]);
+            const second = getSharedTypeCheckedProgram([file]);
+            expect(second).toBe(first); // same instance → built exactly once per run
+            return Promise.resolve();
+        });
+    });
+    it('builds a fresh, uncached Program when the run has no fitness subscope cell', async () => {
+        // A bare scope (no fitness subscope) overrides any ambient test scope; with
+        // no cell to memoize into, each call builds a fresh Program.
+        const scope = new RunScope();
+        await runWithScope(scope, () => {
+            const a = getSharedTypeCheckedProgram([file]);
+            const b = getSharedTypeCheckedProgram([file]);
+            expect(a).not.toBe(b);
+            return Promise.resolve();
+        });
+    });
+});
+//# sourceMappingURL=shared-program.test.js.map

package/dist/__tests__/shared-program.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-program.test.js","sourceRoot":"","sources":["../../src/__tests__/shared-program.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE,IAAI,GAAW,CAAC;AAChB,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,GAAG,EAAE;IACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;QAC1G,MAAM,KAAK,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC7B,uEAAuE;QACvE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE;YAC7B,MAAM,KAAK,GAAG,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,6CAA6C;YACzE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,KAAK,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,GAAG,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/shipped-allowlists-are-generic.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=shipped-allowlists-are-generic.test.d.ts.map

package/dist/__tests__/shipped-allowlists-are-generic.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shipped-allowlists-are-generic.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/shipped-allowlists-are-generic.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/shipped-allowlists-are-generic.test.js

@@ -0,0 +1,64 @@
+/**
+ * @fileoverview De-leak guard (b): the hardcoded allowlists shipped inside the
+ * generic @opensip-cli/checks-* packs must contain only language/library-generic
+ * entries — never project-specific symbols carried over from the private
+ * codebase this tool was extracted from. A leaked safe-symbol silently
+ * suppresses real findings in any adopter that happens to use that name.
+ *
+ * Companion to the source-text guard (a) in
+ * opensip-cli/fit/checks/shipped-checks-must-be-generic.mjs. This one inspects
+ * the live exported data structures, so it catches a leak the moment it is added
+ * to an array — independent of the dogfood run.
+ */
+import { describe, expect, it } from 'vitest';
+import { DOMAIN_SPECIFIC_FUNCTION_NAMES } from '../checks/quality/code-structure/duplicate-utility-functions.js';
+import { SAFE_BUILDER_PREFIXES, SAFE_METHOD_PREFIXES, } from '../checks/quality/data-integrity/null-safety.js';
+import { THROW_ALLOWED_PATHS } from '../checks/quality/patterns/result-pattern-consistency.js';
+/**
+ * Distinctive project-specific identifiers / brand tokens from the original
+ * (pre-open-source) private codebase. None may appear in ANY shipped allowlist;
+ * adopters supply their own via recipe config (`additionalSafeBuilders`, etc.).
+ *
+ * Deliberately limited to UNAMBIGUOUS identifiers: generic-sounding names that
+ * legitimately appear in some allowlists (`getConfig`, `getLogger` are valid
+ * duplicate-name exemptions in DOMAIN_SPECIFIC_FUNCTION_NAMES) are NOT listed, so
+ * this stays false-positive-free.
+ */
+const FOREIGN_ALLOWLIST_TOKEN = /Escrow|I18nError|getSqlite|getDatabase|getRegistry|getSync|getTenantId|TypedEventBus|CredentialConfig|ContextManager|stripThinkTags|getNumberFormatter|getDateFormatter|formatRelative|ensureError|extractErrorMessage|chronoswap|sanitizeForPrompt/i;
+/**
+ * The only bare (non-member, non-call) identifiers allowed in
+ * SAFE_BUILDER_PREFIXES: documented library entry points. Every other entry
+ * must be member-qualified (`Object.`, `db.`) or a constructor/call (`new URL(`,
+ * `prepare(`). A bare camelCase identifier is almost always a project-specific
+ * getter and belongs in recipe config, not the shipped pack.
+ */
+const REVIEWED_BARE_LIBRARY_BUILDERS = new Set(['createQueryBuilder', 'getRepository']); // TypeORM
+function asStrings(entries) {
+    return [...entries].map((e) => (e instanceof RegExp ? e.source : e));
+}
+describe('shipped allowlists are generic (de-leak guard b)', () => {
+    // Count gate: any add/remove to the shipped safe-builder allowlist trips this,
+    // forcing the author to bump the count AND have a reviewer confirm the new
+    // entry is genuinely generic (not a project-specific symbol that belongs in
+    // an adopter's `additionalSafeBuilders` recipe config).
+    it('SAFE_BUILDER_PREFIXES holds exactly the reviewed number of generic entries', () => {
+        expect(SAFE_BUILDER_PREFIXES).toHaveLength(54);
+    });
+    it('every SAFE_BUILDER_PREFIXES entry is a language/library construct, not a bare project getter', () => {
+        const bareLeaks = SAFE_BUILDER_PREFIXES.filter((e) => !e.includes('.') && !e.includes('(') && !REVIEWED_BARE_LIBRARY_BUILDERS.has(e));
+        expect(bareLeaks).toEqual([]);
+    });
+    it('no shipped allowlist contains a foreign project-specific identifier', () => {
+        const arrays = {
+            SAFE_BUILDER_PREFIXES: asStrings(SAFE_BUILDER_PREFIXES),
+            SAFE_METHOD_PREFIXES: asStrings(SAFE_METHOD_PREFIXES),
+            THROW_ALLOWED_PATHS: asStrings(THROW_ALLOWED_PATHS),
+            DOMAIN_SPECIFIC_FUNCTION_NAMES: asStrings(DOMAIN_SPECIFIC_FUNCTION_NAMES),
+        };
+        for (const [name, entries] of Object.entries(arrays)) {
+            const leaked = entries.filter((e) => FOREIGN_ALLOWLIST_TOKEN.test(e));
+            expect(leaked, `${name} must not contain foreign-domain symbols`).toEqual([]);
+        }
+    });
+});
+//# sourceMappingURL=shipped-allowlists-are-generic.test.js.map

package/dist/__tests__/shipped-allowlists-are-generic.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shipped-allowlists-are-generic.test.js","sourceRoot":"","sources":["../../src/__tests__/shipped-allowlists-are-generic.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,iEAAiE,CAAC;AACjH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0DAA0D,CAAC;AAE/F;;;;;;;;;GASG;AACH,MAAM,uBAAuB,GAC3B,sPAAsP,CAAC;AAEzP;;;;;;GAMG;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU;AAEnG,SAAS,SAAS,CAAC,OAAkC;IACnD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,+EAA+E;IAC/E,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,qBAAqB,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,GAAG,EAAE;QACtG,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CACtF,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,MAAM,GAA6B;YACvC,qBAAqB,EAAE,SAAS,CAAC,qBAAqB,CAAC;YACvD,oBAAoB,EAAE,SAAS,CAAC,oBAAoB,CAAC;YACrD,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,CAAC;YACnD,8BAA8B,EAAE,SAAS,CAAC,8BAA8B,CAAC;SAC1E,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,0CAA0C,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/checks/architecture/command-handler-host-owned-output.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @fileoverview Tool command handlers must let the host own output and exit.
+ *
+ * A Tool plugin declares its commands as `CommandSpec`s via `defineCommand({...})`
+ * and the host mounts them — owning rendering, `--json`, and the exit code. The
+ * handler receives a host context (`cli`) and must route its results through that
+ * seam: it returns a result/envelope and (when it must influence the exit) calls
+ * `cli.setExitCode(...)`. A handler that writes run output straight to stdout
+ * (`process.stdout.write` / `console.log`), or terminates the process itself
+ * (`process.exit`), bypasses the host: the output never reaches a formatter, never
+ * honours `--json`, and the process can exit before pending delivery drains.
+ *
+ * The escape hatch is DECLARED, not implicit: a command that genuinely owns its
+ * own output surface (a completion script, a file export, subprocess IPC) sets
+ * `output: 'raw-stream'` with a `rawStreamReason`. This check therefore fires only
+ * inside a `defineCommand({...})` whose `output` is NOT `'raw-stream'` — exactly
+ * where the host-owned-output contract applies. It is generic: it keys on the
+ * public command-authoring vocabulary every tool author uses, with no host path
+ * gating, so an adopter's own `fit` run enforces the same seam.
+ */
+import { type CheckViolation } from '@opensip-cli/fitness';
+/** Pure analysis over a parsed source file. Exported for unit tests. */
+export declare function analyzeCommandHandlerHostOwnedOutput(content: string, filePath: string): CheckViolation[];
+export declare const commandHandlerHostOwnedOutput: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=command-handler-host-owned-output.d.ts.map

package/dist/checks/architecture/command-handler-host-owned-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-handler-host-owned-output.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/command-handler-host-owned-output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAqHpF,wEAAwE;AACxE,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,cAAc,EAAE,CA0BlB;AAED,eAAO,MAAM,6BAA6B,sCAcxC,CAAC"}

package/dist/checks/architecture/command-handler-host-owned-output.js

@@ -0,0 +1,165 @@
+/**
+ * @fileoverview Tool command handlers must let the host own output and exit.
+ *
+ * A Tool plugin declares its commands as `CommandSpec`s via `defineCommand({...})`
+ * and the host mounts them — owning rendering, `--json`, and the exit code. The
+ * handler receives a host context (`cli`) and must route its results through that
+ * seam: it returns a result/envelope and (when it must influence the exit) calls
+ * `cli.setExitCode(...)`. A handler that writes run output straight to stdout
+ * (`process.stdout.write` / `console.log`), or terminates the process itself
+ * (`process.exit`), bypasses the host: the output never reaches a formatter, never
+ * honours `--json`, and the process can exit before pending delivery drains.
+ *
+ * The escape hatch is DECLARED, not implicit: a command that genuinely owns its
+ * own output surface (a completion script, a file export, subprocess IPC) sets
+ * `output: 'raw-stream'` with a `rawStreamReason`. This check therefore fires only
+ * inside a `defineCommand({...})` whose `output` is NOT `'raw-stream'` — exactly
+ * where the host-owned-output contract applies. It is generic: it keys on the
+ * public command-authoring vocabulary every tool author uses, with no host path
+ * gating, so an adopter's own `fit` run enforces the same seam.
+ */
+import { defineCheck, isTestFile } from '@opensip-cli/fitness';
+import { getSharedSourceFile } from '@opensip-cli/lang-typescript';
+import * as ts from 'typescript';
+/** The command-authoring factory whose specs the host mounts. */
+const DEFINE_COMMAND = 'defineCommand';
+/** The declared escape hatch: the handler owns its own output surface. */
+const RAW_STREAM = 'raw-stream';
+/** Output channels the host owns — a non-raw-stream handler must not write them itself. */
+const FORBIDDEN_CALLS = [
+    { chain: ['process', 'stdout', 'write'], label: 'process.stdout.write' },
+    { chain: ['console', 'log'], label: 'console.log' },
+    { chain: ['console', 'info'], label: 'console.info' },
+    { chain: ['console', 'debug'], label: 'console.debug' },
+    { chain: ['process', 'exit'], label: 'process.exit' },
+];
+function normalized(path) {
+    return path.replaceAll('\\', '/');
+}
+function propertyNameText(name) {
+    if (ts.isIdentifier(name) || ts.isStringLiteral(name))
+        return name.text;
+    return undefined;
+}
+/** The string value of a property assignment whose initializer is a string literal. */
+function stringPropValue(obj, key) {
+    for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop))
+            continue;
+        if (propertyNameText(prop.name) !== key)
+            continue;
+        if (ts.isStringLiteral(prop.initializer))
+            return prop.initializer.text;
+    }
+    return undefined;
+}
+/** The handler initializer (arrow / function) of a `defineCommand` object literal. */
+function handlerBody(obj) {
+    for (const prop of obj.properties) {
+        if (ts.isPropertyAssignment(prop) && propertyNameText(prop.name) === 'handler') {
+            const init = prop.initializer;
+            if (ts.isArrowFunction(init) || ts.isFunctionExpression(init))
+                return init.body;
+        }
+        if (ts.isMethodDeclaration(prop) &&
+            propertyNameText(prop.name) === 'handler' &&
+            prop.body !== undefined) {
+            return prop.body;
+        }
+    }
+    return undefined;
+}
+/** The dotted property chain of a call's callee (`process.stdout.write` → ['process','stdout','write']). */
+function calleeChain(expr) {
+    const parts = [];
+    let node = expr;
+    while (ts.isPropertyAccessExpression(node)) {
+        parts.unshift(node.name.text);
+        node = node.expression;
+    }
+    if (!ts.isIdentifier(node))
+        return undefined;
+    parts.unshift(node.text);
+    return parts;
+}
+function chainEquals(actual, expected) {
+    if (actual.length !== expected.length)
+        return false;
+    return actual.every((part, i) => part === expected[i]);
+}
+/** Find each forbidden host-owned-output call within a handler body subtree. */
+function findForbiddenCalls(body, sourceFile, filePath) {
+    const violations = [];
+    const visit = (node) => {
+        if (ts.isCallExpression(node)) {
+            const chain = calleeChain(node.expression);
+            if (chain) {
+                for (const { chain: forbidden, label } of FORBIDDEN_CALLS) {
+                    if (chainEquals(chain, forbidden)) {
+                        const line = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+                        violations.push({
+                            filePath,
+                            line,
+                            message: `Command handler calls ${label} directly. A tool command lets the host own ` +
+                                `rendering, --json, and the exit code — the handler returns its result and ` +
+                                `routes output/exit through the host context (cli.render / cli.emitJson / ` +
+                                `cli.emitEnvelope / cli.setExitCode). Direct stdout/exit bypasses that seam.`,
+                            severity: 'error',
+                            suggestion: `Return the command result (or a SignalEnvelope) and use the cli context to ` +
+                                `emit and set the exit code. If this command genuinely owns its own output ` +
+                                `surface (completion script, file export, subprocess IPC), declare ` +
+                                `output: 'raw-stream' with a rawStreamReason instead.`,
+                        });
+                    }
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(body);
+    return violations;
+}
+/** Pure analysis over a parsed source file. Exported for unit tests. */
+export function analyzeCommandHandlerHostOwnedOutput(content, filePath) {
+    const violations = [];
+    const sourceFile = getSharedSourceFile(filePath, content);
+    if (!sourceFile)
+        return violations;
+    const visit = (node) => {
+        if (ts.isCallExpression(node) &&
+            ts.isIdentifier(node.expression) &&
+            node.expression.text === DEFINE_COMMAND &&
+            node.arguments.length > 0) {
+            const arg = node.arguments[0];
+            if (ts.isObjectLiteralExpression(arg)) {
+                const output = stringPropValue(arg, 'output');
+                // A raw-stream command DECLARES that it owns its own output surface.
+                if (output !== RAW_STREAM) {
+                    const body = handlerBody(arg);
+                    if (body)
+                        violations.push(...findForbiddenCalls(body, sourceFile, filePath));
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return violations;
+}
+export const commandHandlerHostOwnedOutput = defineCheck({
+    id: 'c1f4a2e7-6b83-4d59-9e0a-2f7c4b8d1a36',
+    slug: 'command-handler-host-owned-output',
+    description: 'A tool command handler must let the host own rendering and exit — no direct stdout/console/process.exit inside a non-raw-stream defineCommand handler',
+    scope: { languages: ['typescript'], concerns: ['backend'] },
+    tags: ['architecture'],
+    fileTypes: ['ts', 'tsx'],
+    analyze: (content, filePath) => {
+        if (isTestFile(filePath))
+            return [];
+        // Cheap pre-filter: only files that author a command can violate the rule.
+        if (!content.includes(DEFINE_COMMAND))
+            return [];
+        return analyzeCommandHandlerHostOwnedOutput(content, normalized(filePath));
+    },
+});
+//# sourceMappingURL=command-handler-host-owned-output.js.map

package/dist/checks/architecture/command-handler-host-owned-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-handler-host-owned-output.js","sourceRoot":"","sources":["../../../src/checks/architecture/command-handler-host-owned-output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAuB,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjC,iEAAiE;AACjE,MAAM,cAAc,GAAG,eAAe,CAAC;AAEvC,0EAA0E;AAC1E,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,2FAA2F;AAC3F,MAAM,eAAe,GAGf;IACJ,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACxE,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE;IACnD,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;IACrD,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE;IACvD,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE;CACtD,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAqB;IAC7C,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACxE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uFAAuF;AACvF,SAAS,eAAe,CAAC,GAA+B,EAAE,GAAW;IACnE,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG;YAAE,SAAS;QAClD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sFAAsF;AACtF,SAAS,WAAW,CAAC,GAA+B;IAClD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;YAC9B,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAClF,CAAC;QACD,IACE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAC5B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;YACzC,IAAI,CAAC,IAAI,KAAK,SAAS,EACvB,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,4GAA4G;AAC5G,SAAS,WAAW,CAAC,IAAmB;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,OAAO,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,MAAyB,EAAE,QAA2B;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,SAAS,kBAAkB,CACzB,IAAa,EACb,UAAyB,EACzB,QAAgB;IAEhB,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,eAAe,EAAE,CAAC;oBAC1D,IAAI,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;wBAClC,MAAM,IAAI,GACR,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;wBAC/E,UAAU,CAAC,IAAI,CAAC;4BACd,QAAQ;4BACR,IAAI;4BACJ,OAAO,EACL,yBAAyB,KAAK,8CAA8C;gCAC5E,4EAA4E;gCAC5E,2EAA2E;gCAC3E,6EAA6E;4BAC/E,QAAQ,EAAE,OAAO;4BACjB,UAAU,EACR,6EAA6E;gCAC7E,4EAA4E;gCAC5E,oEAAoE;gCACpE,sDAAsD;yBACzD,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oCAAoC,CAClD,OAAe,EACf,QAAgB;IAEhB,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU;QAAE,OAAO,UAAU,CAAC;IAEnC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACzB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc;YACvC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EACzB,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC9C,qEAAqE;gBACrE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;oBAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,IAAI;wBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,CAAC;IAClB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,WAAW,CAAC;IACvD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,mCAAmC;IACzC,WAAW,EACT,uJAAuJ;IACzJ,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;IAC3D,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IACxB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC7B,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,2EAA2E;QAC3E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,OAAO,EAAE,CAAC;QACjD,OAAO,oCAAoC,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/architecture/host-tool-runtime-import-boundary.d.ts

@@ -1,12 +1,29 @@
 /**
- * @fileoverview Keep ADR-0054's host-process runtime import exception narrow.
+ * @fileoverview Mechanize the ADR-0054 M4-G CAPSTONE invariant: no
+ * `importToolRuntime(...)` for external-provenance tools in the HOST process.
  *
- * External Tool runtimes still execute in the host process during the
- * ADR-0054 migration because the current manifest only carries command
- * metadata, not executable CommandSpec/RPC descriptors. That exception must
- * remain explicit: every importToolRuntime call needs a source policy, and no
- * new production call sites should appear outside the admission/discovery
- * boundary.
+ * After the capstone, external tool runtime code NEVER loads in the host. The
+ * host registers a manifest-derived synthetic Tool (command shells from the
+ * static manifest) and mounts its commands without importing the runtime; the
+ * forked dispatch WORKER imports the untrusted runtime when a command actually
+ * dispatches. This is no longer a transition guardrail — it is the enforced
+ * boundary. The check asserts three things across the CLI host package:
+ *
+ *   1. `importToolRuntime` may be called only from the admission/discovery
+ *      boundary or the worker-owned dispatch plane (the allowlisted files).
+ *      Any other host-process call site is a violation.
+ *   2. A HOST import must pass a BUNDLED policy — `hostRuntimeImportPolicyFor(...)`
+ *      (type-narrowed to `'bundled'`) or a literal `{ source: 'bundled' }`. A
+ *      non-bundled host policy is a violation (the type already forbids it; this
+ *      catches a hand-rolled literal that bypasses the constructor).
+ *   3. `workerRuntimeImportPolicyFor(...)` — the policy that authorizes loading an
+ *      EXTERNAL runtime — is permitted only on the worker-owned plane (the
+ *      discovery leg gated behind `isHostRuntimeImportForbidden`, the worker entry,
+ *      and the admission module that defines it). Using it elsewhere would import
+ *      an external runtime in the host.
+ *
+ * The `adr0054Transition` exception is gone: the worker is now the only path for
+ * external runtime import, and the host import policy is bundled-only.
  */
 import { type CheckViolation } from '@opensip-cli/fitness';
 /** Pure analysis over a parsed source file. Exported for unit tests. */

package/dist/checks/architecture/host-tool-runtime-import-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-tool-runtime-import-boundary.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/host-tool-runtime-import-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA4EpF,wEAAwE;AACxE,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,cAAc,EAAE,CAyClB;AAED,eAAO,MAAM,6BAA6B,sCAYxC,CAAC"}
+{"version":3,"file":"host-tool-runtime-import-boundary.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/host-tool-runtime-import-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA2HpF,wEAAwE;AACxE,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,cAAc,EAAE,CA2DlB;AAED,eAAO,MAAM,6BAA6B,sCAYxC,CAAC"}