@opensip-tools/fitness 1.0.8 → 1.0.10

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> @opensip-tools/fitness@1.0.8 build /home/runner/work/opensip-tools/opensip-tools/packages/fitness/engine
+> @opensip-tools/fitness@1.0.10 build /home/runner/work/opensip-tools/opensip-tools/packages/fitness/engine
 > tsc
 

package/.turbo/turbo-test.log

@@ -1,49 +1,49 @@
 
-> @opensip-tools/fitness@1.0.8 test /home/runner/work/opensip-tools/opensip-tools/packages/fitness/engine
+> @opensip-tools/fitness@1.0.10 test /home/runner/work/opensip-tools/opensip-tools/packages/fitness/engine
 > vitest run --passWithNoTests
 
 
  RUN  v2.1.9 /home/runner/work/opensip-tools/opensip-tools/packages/fitness/engine
 
- ✓ src/__tests__/gate.test.ts (28 tests) 258ms
- ✓ src/recipes/__tests__/service.test.ts (28 tests) 672ms
- ✓ src/framework/__tests__/registry.test.ts (24 tests) 73ms
- ✓ src/framework/__tests__/import-graph.test.ts (20 tests) 778ms
-   ✓ findStronglyConnectedComponents > handles a deep graph without recursion blowing the stack 533ms
- ✓ src/plugins/__tests__/check-package-discovery.test.ts (16 tests) 244ms
- ✓ src/recipes/__tests__/check-resolution.test.ts (14 tests) 155ms
- ✓ src/__tests__/sarif.test.ts (15 tests) 70ms
- ✓ src/plugins/__tests__/lang-domain.test.ts (8 tests) 142ms
- ✓ src/framework/__tests__/result-builder.test.ts (25 tests) 114ms
- ✓ src/framework/__tests__/scope-resolver.test.ts (8 tests) 265ms
- ✓ src/plugins/__tests__/loader.test.ts (10 tests) 6800ms
-   ✓ loadPlugin > registers Check instances exported as named exports (no array wrapper) 6459ms
- ✓ src/framework/__tests__/content-filter.test.ts (10 tests) 74ms
- ✓ src/framework/__tests__/define-check.test.ts (17 tests) 62ms
- ✓ src/framework/__tests__/file-cache.test.ts (15 tests) 137ms
- ✓ src/framework/__tests__/path-matcher.test.ts (12 tests) 194ms
- ✓ src/framework/__tests__/content-filter-dispatch.test.ts (6 tests) 93ms
- ✓ src/recipes/__tests__/registry.test.ts (15 tests) 20ms
- ✓ src/targets/__tests__/loader.test.ts (11 tests) 94ms
- ✓ src/framework/__tests__/file-accessor.test.ts (11 tests) 106ms
- ✓ src/framework/__tests__/strip-literals.test.ts (17 tests) 26ms
- ✓ src/framework/__tests__/ast-utilities.test.ts (19 tests) 96ms
- ✓ src/recipes/__tests__/built-in-recipes.test.ts (14 tests) 62ms
- ✓ src/targets/__tests__/target-registry.test.ts (11 tests) 43ms
- ✓ src/framework/__tests__/execution-context.test.ts (4 tests) 118ms
- ✓ src/signalers/__tests__/loader.test.ts (8 tests) 109ms
- ✓ src/recipes/__tests__/retry.test.ts (6 tests) 20ms
- ✓ src/framework/__tests__/directive-parsing.test.ts (8 tests) 8ms
- ✓ src/targets/__tests__/resolver.test.ts (6 tests) 67ms
- ✓ src/framework/__tests__/command-executor.test.ts (5 tests) 106ms
- ✓ src/framework/__tests__/directive-inventory.test.ts (9 tests) 8ms
- ✓ src/framework/__tests__/check-config.test.ts (6 tests) 16ms
- ✓ src/framework/__tests__/severity-mapping.test.ts (13 tests) 17ms
- ✓ src/framework/__tests__/register-helpers.test.ts (4 tests) 17ms
- ✓ src/recipes/__tests__/check-config.test.ts (4 tests) 12ms
+ ✓ src/__tests__/gate.test.ts (28 tests) 354ms
+ ✓ src/recipes/__tests__/service.test.ts (28 tests) 666ms
+ ✓ src/framework/__tests__/registry.test.ts (24 tests) 99ms
+ ✓ src/framework/__tests__/import-graph.test.ts (20 tests) 745ms
+   ✓ findStronglyConnectedComponents > handles a deep graph without recursion blowing the stack 557ms
+ ✓ src/plugins/__tests__/check-package-discovery.test.ts (16 tests) 327ms
+ ✓ src/recipes/__tests__/check-resolution.test.ts (14 tests) 145ms
+ ✓ src/__tests__/sarif.test.ts (15 tests) 101ms
+ ✓ src/plugins/__tests__/lang-domain.test.ts (8 tests) 84ms
+ ✓ src/framework/__tests__/result-builder.test.ts (25 tests) 124ms
+ ✓ src/framework/__tests__/scope-resolver.test.ts (8 tests) 181ms
+ ✓ src/plugins/__tests__/loader.test.ts (10 tests) 6479ms
+   ✓ loadPlugin > registers Check instances exported as named exports (no array wrapper) 6108ms
+ ✓ src/framework/__tests__/content-filter.test.ts (10 tests) 111ms
+ ✓ src/framework/__tests__/define-check.test.ts (17 tests) 85ms
+ ✓ src/framework/__tests__/file-cache.test.ts (15 tests) 60ms
+ ✓ src/framework/__tests__/path-matcher.test.ts (12 tests) 150ms
+ ✓ src/recipes/__tests__/registry.test.ts (15 tests) 33ms
+ ✓ src/framework/__tests__/content-filter-dispatch.test.ts (6 tests) 67ms
+ ✓ src/targets/__tests__/loader.test.ts (11 tests) 71ms
+ ✓ src/framework/__tests__/file-accessor.test.ts (11 tests) 147ms
+ ✓ src/framework/__tests__/strip-literals.test.ts (17 tests) 38ms
+ ✓ src/recipes/__tests__/built-in-recipes.test.ts (14 tests) 64ms
+ ✓ src/framework/__tests__/ast-utilities.test.ts (19 tests) 88ms
+ ✓ src/targets/__tests__/target-registry.test.ts (11 tests) 30ms
+ ✓ src/framework/__tests__/execution-context.test.ts (4 tests) 150ms
+ ✓ src/signalers/__tests__/loader.test.ts (8 tests) 153ms
+ ✓ src/recipes/__tests__/retry.test.ts (6 tests) 25ms
+ ✓ src/recipes/__tests__/check-config.test.ts (5 tests) 20ms
+ ✓ src/framework/__tests__/directive-parsing.test.ts (8 tests) 16ms
+ ✓ src/targets/__tests__/resolver.test.ts (6 tests) 113ms
+ ✓ src/framework/__tests__/command-executor.test.ts (5 tests) 101ms
+ ✓ src/framework/__tests__/directive-inventory.test.ts (9 tests) 12ms
+ ✓ src/framework/__tests__/check-config.test.ts (6 tests) 47ms
+ ✓ src/framework/__tests__/severity-mapping.test.ts (13 tests) 18ms
+ ✓ src/framework/__tests__/register-helpers.test.ts (4 tests) 20ms
 
  Test Files  34 passed (34)
-      Tests  427 passed (427)
-   Start at  21:42:26
-   Duration  24.97s (transform 7.13s, setup 0ms, collect 24.18s, tests 11.07s, environment 62ms, prepare 13.30s)
+      Tests  428 passed (428)
+   Start at  00:26:54
+   Duration  25.75s (transform 5.14s, setup 0ms, collect 22.49s, tests 10.92s, environment 43ms, prepare 14.54s)
 

package/.turbo/turbo-typecheck.log

@@ -1,4 +1,4 @@
 
-> @opensip-tools/fitness@1.0.8 typecheck /home/runner/work/opensip-tools/opensip-tools/packages/fitness/engine
+> @opensip-tools/fitness@1.0.10 typecheck /home/runner/work/opensip-tools/opensip-tools/packages/fitness/engine
 > tsc --noEmit
 

package/dist/recipes/__tests__/check-config.test.js

@@ -33,5 +33,26 @@ describe('getCheckConfig', () => {
         const cfg = getCheckConfig('sample-check');
         expect(cfg).toEqual({});
     });
+    it('shares state with a separately-loaded copy of this module (multi-instance contract)', () => {
+        // Regression test for the multi-instance bug fixed in 1.0.9. The
+        // runtime frequently has TWO copies of `@opensip-tools/fitness`:
+        // the CLI's bundled copy (running the recipe service) and the
+        // plugin pack's resolved copy (running the check). Each copy has
+        // its own module-scope state; the prior `let currentRecipeCheckConfig`
+        // implementation made cross-copy state invisible. The fix moves
+        // the slot onto a `Symbol.for(...)` keyed `globalThis` entry so
+        // every copy reads + writes the same slot.
+        //
+        // Simulating "two copies" within one test: stash a value, look it
+        // up under the same well-known symbol from a separate import path
+        // (here: globalThis directly), and confirm the values match.
+        setCurrentRecipeCheckConfig({
+            'sample-check': { additionalEntries: ['cross-copy'] },
+        });
+        const KEY = Symbol.for('@opensip-tools/fitness/currentRecipeCheckConfig');
+        const slot = globalThis[KEY];
+        expect(slot).toBeDefined();
+        expect(slot['sample-check'].additionalEntries).toEqual(['cross-copy']);
+    });
 });
 //# sourceMappingURL=check-config.test.js.map

package/dist/recipes/__tests__/check-config.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-config.test.js","sourceRoot":"","sources":["../../../src/recipes/__tests__/check-config.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAExD,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAM3B,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,SAAS,CAAC,GAAG,EAAE;QACb,6BAA6B,EAAE,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG,cAAc,CAAe,UAAU,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,2BAA2B,CAAC;YAC1B,aAAa,EAAE,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE;SAC5C,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,cAAc,CAAe,SAAS,CAAC,CAAA;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,2BAA2B,CAAC;YAC1B,cAAc,EAAE,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;SAClD,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,cAAc,CAAe,cAAc,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,2BAA2B,CAAC;YAC1B,cAAc,EAAE,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;SAClD,CAAC,CAAA;QACF,6BAA6B,EAAE,CAAA;QAC/B,MAAM,GAAG,GAAG,cAAc,CAAe,cAAc,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"check-config.test.js","sourceRoot":"","sources":["../../../src/recipes/__tests__/check-config.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAExD,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAM3B,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,SAAS,CAAC,GAAG,EAAE;QACb,6BAA6B,EAAE,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG,cAAc,CAAe,UAAU,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,2BAA2B,CAAC;YAC1B,aAAa,EAAE,EAAE,iBAAiB,EAAE,CAAC,GAAG,CAAC,EAAE;SAC5C,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,cAAc,CAAe,SAAS,CAAC,CAAA;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,2BAA2B,CAAC;YAC1B,cAAc,EAAE,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;SAClD,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,cAAc,CAAe,cAAc,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,2BAA2B,CAAC;YAC1B,cAAc,EAAE,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;SAClD,CAAC,CAAA;QACF,6BAA6B,EAAE,CAAA;QAC/B,MAAM,GAAG,GAAG,cAAc,CAAe,cAAc,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,iEAAiE;QACjE,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,uEAAuE;QACvE,gEAAgE;QAChE,gEAAgE;QAChE,2CAA2C;QAC3C,EAAE;QACF,kEAAkE;QAClE,kEAAkE;QAClE,6DAA6D;QAC7D,2BAA2B,CAAC;YAC1B,cAAc,EAAE,EAAE,iBAAiB,EAAE,CAAC,YAAY,CAAC,EAAE;SACtD,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAA;QACzE,MAAM,IAAI,GAAI,UAAiD,CAAC,GAAG,CAAC,CAAA;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1B,MAAM,CAAE,IAA4D,CAAC,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAA;IACjI,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/recipes/check-config.d.ts

@@ -28,13 +28,13 @@ import type { RecipeCheckConfigMap } from './types.js';
  */
 export declare function getCheckConfig<T extends Record<string, unknown>>(slug: string): T;
 /**
- * Replace the module-level recipe config. Called by the recipe service at
+ * Replace the global recipe config. Called by the recipe service at
  * the start of a recipe run, before any check executes.
  */
 export declare function setCurrentRecipeCheckConfig(config: RecipeCheckConfigMap | undefined): void;
 /**
- * Clear the module-level recipe config. Called by the recipe service at
- * the end of a recipe run (success or failure).
+ * Clear the global recipe config. Called by the recipe service at the end
+ * of a recipe run (success or failure).
  */
 export declare function clearCurrentRecipeCheckConfig(): void;
 //# sourceMappingURL=check-config.d.ts.map

package/dist/recipes/check-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-config.d.ts","sourceRoot":"","sources":["../../src/recipes/check-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AActD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAKjF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAE1F;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
+{"version":3,"file":"check-config.d.ts","sourceRoot":"","sources":["../../src/recipes/check-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAmCtD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAMjF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAE1F;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/recipes/check-config.js

@@ -16,16 +16,32 @@
  * extend the safe-lists with project-specific names.
  */
 /**
- * Module-scoped current-recipe config. Populated by the recipe service at
+ * Process-shared current-recipe config. Populated by the recipe service at
  * the start of a run and cleared at the end. Checks read from it lazily via
  * {@link getCheckConfig}.
  *
- * Module-level singleton is acceptable here because a recipe service runs
- * one session at a time (the service throws SESSION_IN_PROGRESS otherwise).
- * If we ever support concurrent recipe runs in the same process, this needs
- * to move into AsyncLocalStorage.
+ * `globalThis` (not module-local `let`) is load-bearing — the runtime
+ * frequently has TWO copies of `@opensip-tools/fitness` loaded:
+ *
+ *   1. The CLI's bundled copy (running the recipe service).
+ *   2. The plugin pack's resolved copy (running the check, calling
+ *      `getCheckConfig(slug)`).
+ *
+ * Each copy has its own module-scope state, so a module-local `let` here
+ * means `setCurrentRecipeCheckConfig(...)` in copy 1 is invisible to
+ * `getCheckConfig(...)` in copy 2 — the recipe's `additionalSyncFunctions`
+ * (and every other per-check allowlist) silently never reaches the checks
+ * that read it. Storing the map on `globalThis` under a single well-known
+ * symbol means every copy reads + writes the same slot.
+ *
+ * The single-session contract still holds (the recipe service throws
+ * SESSION_IN_PROGRESS otherwise); the only thing that changes vs the prior
+ * design is the storage location, not the lifecycle.
  */
-let currentRecipeCheckConfig;
+const GLOBAL_KEY = Symbol.for('@opensip-tools/fitness/currentRecipeCheckConfig');
+function slot() {
+    return globalThis;
+}
 /**
  * Read the per-check config slice for the given slug.
  *
@@ -37,25 +53,26 @@ let currentRecipeCheckConfig;
  *                its own config interface.
  */
 export function getCheckConfig(slug) {
-    if (!currentRecipeCheckConfig)
+    const current = slot()[GLOBAL_KEY];
+    if (!current)
         return {};
-    const entry = currentRecipeCheckConfig[slug];
+    const entry = current[slug];
     if (!entry)
         return {};
     return entry;
 }
 /**
- * Replace the module-level recipe config. Called by the recipe service at
+ * Replace the global recipe config. Called by the recipe service at
  * the start of a recipe run, before any check executes.
  */
 export function setCurrentRecipeCheckConfig(config) {
-    currentRecipeCheckConfig = config;
+    slot()[GLOBAL_KEY] = config;
 }
 /**
- * Clear the module-level recipe config. Called by the recipe service at
- * the end of a recipe run (success or failure).
+ * Clear the global recipe config. Called by the recipe service at the end
+ * of a recipe run (success or failure).
  */
 export function clearCurrentRecipeCheckConfig() {
-    currentRecipeCheckConfig = undefined;
+    slot()[GLOBAL_KEY] = undefined;
 }
 //# sourceMappingURL=check-config.js.map

package/dist/recipes/check-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-config.js","sourceRoot":"","sources":["../../src/recipes/check-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;;;GASG;AACH,IAAI,wBAA0D,CAAA;AAE9D;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAoC,IAAY;IAC5E,IAAI,CAAC,wBAAwB;QAAE,OAAO,EAAO,CAAA;IAC7C,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAO,CAAA;IAC1B,OAAO,KAAU,CAAA;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAwC;IAClF,wBAAwB,GAAG,MAAM,CAAA;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B;IAC3C,wBAAwB,GAAG,SAAS,CAAA;AACtC,CAAC"}
+{"version":3,"file":"check-config.js","sourceRoot":"","sources":["../../src/recipes/check-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAA;AAMhF,SAAS,IAAI;IACX,OAAO,UAAmC,CAAA;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAoC,IAAY;IAC5E,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC,UAAU,CAAC,CAAA;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAO,CAAA;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAO,CAAA;IAC1B,OAAO,KAAU,CAAA;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAwC;IAClF,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,MAAM,CAAA;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B;IAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,SAAS,CAAA;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensip-tools/fitness",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "license": "MIT",
   "description": "Fitness checks engine for OpenSIP Tools",
   "repository": {
@@ -28,8 +28,8 @@
     "minimatch": "^10.0.0",
     "typescript": "~5.7.0",
     "zod": "^3.24.0",
-    "@opensip-tools/core": "1.0.8",
-    "@opensip-tools/contracts": "1.0.8"
+    "@opensip-tools/contracts": "1.0.10",
+    "@opensip-tools/core": "1.0.10"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.0",

package/src/recipes/__tests__/check-config.test.ts

@@ -48,4 +48,26 @@ describe('getCheckConfig', () => {
     const cfg = getCheckConfig<SampleConfig>('sample-check')
     expect(cfg).toEqual({})
   })
+
+  it('shares state with a separately-loaded copy of this module (multi-instance contract)', () => {
+    // Regression test for the multi-instance bug fixed in 1.0.9. The
+    // runtime frequently has TWO copies of `@opensip-tools/fitness`:
+    // the CLI's bundled copy (running the recipe service) and the
+    // plugin pack's resolved copy (running the check). Each copy has
+    // its own module-scope state; the prior `let currentRecipeCheckConfig`
+    // implementation made cross-copy state invisible. The fix moves
+    // the slot onto a `Symbol.for(...)` keyed `globalThis` entry so
+    // every copy reads + writes the same slot.
+    //
+    // Simulating "two copies" within one test: stash a value, look it
+    // up under the same well-known symbol from a separate import path
+    // (here: globalThis directly), and confirm the values match.
+    setCurrentRecipeCheckConfig({
+      'sample-check': { additionalEntries: ['cross-copy'] },
+    })
+    const KEY = Symbol.for('@opensip-tools/fitness/currentRecipeCheckConfig')
+    const slot = (globalThis as unknown as Record<symbol, unknown>)[KEY]
+    expect(slot).toBeDefined()
+    expect((slot as { 'sample-check': { additionalEntries: string[] } })['sample-check'].additionalEntries).toEqual(['cross-copy'])
+  })
 })

package/src/recipes/check-config.ts

@@ -19,16 +19,37 @@
 import type { RecipeCheckConfigMap } from './types.js'
 
 /**
- * Module-scoped current-recipe config. Populated by the recipe service at
+ * Process-shared current-recipe config. Populated by the recipe service at
  * the start of a run and cleared at the end. Checks read from it lazily via
  * {@link getCheckConfig}.
  *
- * Module-level singleton is acceptable here because a recipe service runs
- * one session at a time (the service throws SESSION_IN_PROGRESS otherwise).
- * If we ever support concurrent recipe runs in the same process, this needs
- * to move into AsyncLocalStorage.
+ * `globalThis` (not module-local `let`) is load-bearing — the runtime
+ * frequently has TWO copies of `@opensip-tools/fitness` loaded:
+ *
+ *   1. The CLI's bundled copy (running the recipe service).
+ *   2. The plugin pack's resolved copy (running the check, calling
+ *      `getCheckConfig(slug)`).
+ *
+ * Each copy has its own module-scope state, so a module-local `let` here
+ * means `setCurrentRecipeCheckConfig(...)` in copy 1 is invisible to
+ * `getCheckConfig(...)` in copy 2 — the recipe's `additionalSyncFunctions`
+ * (and every other per-check allowlist) silently never reaches the checks
+ * that read it. Storing the map on `globalThis` under a single well-known
+ * symbol means every copy reads + writes the same slot.
+ *
+ * The single-session contract still holds (the recipe service throws
+ * SESSION_IN_PROGRESS otherwise); the only thing that changes vs the prior
+ * design is the storage location, not the lifecycle.
  */
-let currentRecipeCheckConfig: RecipeCheckConfigMap | undefined
+const GLOBAL_KEY = Symbol.for('@opensip-tools/fitness/currentRecipeCheckConfig')
+
+interface GlobalSlot {
+  [GLOBAL_KEY]?: RecipeCheckConfigMap | undefined
+}
+
+function slot(): GlobalSlot {
+  return globalThis as unknown as GlobalSlot
+}
 
 /**
  * Read the per-check config slice for the given slug.
@@ -41,24 +62,25 @@ let currentRecipeCheckConfig: RecipeCheckConfigMap | undefined
  *                its own config interface.
  */
 export function getCheckConfig<T extends Record<string, unknown>>(slug: string): T {
-  if (!currentRecipeCheckConfig) return {} as T
-  const entry = currentRecipeCheckConfig[slug]
+  const current = slot()[GLOBAL_KEY]
+  if (!current) return {} as T
+  const entry = current[slug]
   if (!entry) return {} as T
   return entry as T
 }
 
 /**
- * Replace the module-level recipe config. Called by the recipe service at
+ * Replace the global recipe config. Called by the recipe service at
  * the start of a recipe run, before any check executes.
  */
 export function setCurrentRecipeCheckConfig(config: RecipeCheckConfigMap | undefined): void {
-  currentRecipeCheckConfig = config
+  slot()[GLOBAL_KEY] = config
 }
 
 /**
- * Clear the module-level recipe config. Called by the recipe service at
- * the end of a recipe run (success or failure).
+ * Clear the global recipe config. Called by the recipe service at the end
+ * of a recipe run (success or failure).
  */
 export function clearCurrentRecipeCheckConfig(): void {
-  currentRecipeCheckConfig = undefined
+  slot()[GLOBAL_KEY] = undefined
 }