@rigour-labs/core 6.2.5 → 6.3.1

package/dist/gates/hallucinated-imports/tsconfig-paths.js

@@ -0,0 +1,120 @@
+/**
+ * tsconfig `paths`, `baseUrl` and `rootDirs`, resolved the way tsc does.
+ *
+ * Each option is resolved against the config that declares it, not the one
+ * that extends it: SvelteKit's generated `.svelte-kit/tsconfig.json` says
+ * `"$lib": ["../src/lib"]`, which means `<repo>/src/lib`, not `<repo>/../src/lib`.
+ * A child's `paths` replaces its parent's; later entries of an `extends`
+ * array override earlier ones.
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import { Logger } from '../../utils/logger.js';
+const CONFIG_NAMES = ['tsconfig.json', 'jsconfig.json', 'tsconfig.base.json'];
+/** The first config in `searchDir` that defines `paths` or `rootDirs` (directly or inherited). */
+export async function loadTsPathConfig(searchDir) {
+    for (const name of CONFIG_NAMES) {
+        const configPath = path.join(searchDir, name);
+        if (!(await fs.pathExists(configPath)))
+            continue;
+        const effective = await readChain(configPath, new Set());
+        if (!effective.paths && !effective.rootDirs?.length)
+            continue;
+        return {
+            baseDir: effective.baseUrl ?? effective.paths?.dir ?? searchDir,
+            rules: toRules(effective.paths?.entries ?? {}),
+            rootDirs: effective.rootDirs ?? [],
+        };
+    }
+    return null;
+}
+async function readChain(configPath, visited) {
+    const resolved = path.resolve(configPath);
+    if (visited.has(resolved))
+        return {};
+    visited.add(resolved);
+    const parsed = await readLooseJson(resolved);
+    if (!parsed)
+        return {};
+    let effective = {};
+    for (const extendsPath of extendsList(parsed.extends)) {
+        const target = await resolveExtends(resolved, extendsPath);
+        if (target)
+            effective = { ...effective, ...await readChain(target, visited) };
+        else
+            warnMissingExtends(resolved, extendsPath);
+    }
+    const dir = path.dirname(resolved);
+    const options = parsed.compilerOptions ?? {};
+    if (typeof options.baseUrl === 'string')
+        effective.baseUrl = path.resolve(dir, options.baseUrl);
+    if (options.paths && typeof options.paths === 'object')
+        effective.paths = { entries: options.paths, dir };
+    if (Array.isArray(options.rootDirs)) {
+        effective.rootDirs = options.rootDirs.filter((r) => typeof r === 'string').map((r) => path.resolve(dir, r));
+    }
+    return effective;
+}
+function extendsList(value) {
+    if (typeof value === 'string')
+        return [value];
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+async function resolveExtends(configPath, extendsPath) {
+    const base = extendsPath.startsWith('.') || path.isAbsolute(extendsPath)
+        ? path.resolve(path.dirname(configPath), extendsPath)
+        : path.resolve(path.dirname(configPath), 'node_modules', extendsPath);
+    for (const candidate of [base, `${base}.json`, path.join(base, 'tsconfig.json')]) {
+        if (await fs.pathExists(candidate) && (await fs.stat(candidate)).isFile())
+            return candidate;
+    }
+    return null;
+}
+function toRules(entries) {
+    const rules = [];
+    for (const [key, value] of Object.entries(entries)) {
+        if (!Array.isArray(value))
+            continue;
+        const targets = value.filter((v) => typeof v === 'string');
+        if (targets.length === 0)
+            continue;
+        const [prefix, suffix = ''] = key.split('*');
+        rules.push({ key, hasWildcard: key.includes('*'), prefix, suffix, targets });
+    }
+    // Exact keys first, then the longest wildcard prefix/suffix (tsc's precedence).
+    return rules.sort((left, right) => {
+        if (left.hasWildcard !== right.hasWildcard)
+            return left.hasWildcard ? 1 : -1;
+        return (right.prefix.length + right.suffix.length) - (left.prefix.length + left.suffix.length);
+    });
+}
+const warnedMissingExtends = new Set();
+/**
+ * A missing `extends` target drops its options. Say so once, instead of
+ * reporting every aliased import as missing without a reason.
+ */
+function warnMissingExtends(configPath, extendsPath) {
+    const key = `${configPath}\0${extendsPath}`;
+    if (warnedMissingExtends.has(key))
+        return;
+    warnedMissingExtends.add(key);
+    const hint = extendsPath.includes('.svelte-kit') ? ' Run `svelte-kit sync` first to generate it.' : '';
+    Logger.warn(`${path.basename(configPath)} extends '${extendsPath}', which does not exist; its path aliases are ignored.${hint}`);
+}
+/** JSON with comments and trailing commas, as tsconfig files allow. */
+async function readLooseJson(filePath) {
+    try {
+        const text = await fs.readFile(filePath, 'utf-8');
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            const noBlockComments = text.replace(/\/\*[\s\S]*?\*\//g, '');
+            const noLineComments = noBlockComments.replace(/(^|\s)\/\/.*$/gm, '$1');
+            return JSON.parse(noLineComments.replace(/,\s*([}\]])/g, '$1'));
+        }
+    }
+    catch {
+        return null;
+    }
+}

package/dist/gates/hallucinated-imports-sveltekit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/hallucinated-imports-sveltekit.test.js

@@ -0,0 +1,108 @@
+/**
+ * SvelteKit on a fresh clone: `.svelte-kit/` (and its tsconfig with the
+ * `$lib` alias) does not exist until `svelte-kit sync` runs.
+ */
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { HallucinatedImportsGate } from './hallucinated-imports/index.js';
+function write(root, rel, body) {
+    fs.mkdirSync(path.dirname(path.join(root, rel)), { recursive: true });
+    fs.writeFileSync(path.join(root, rel), body);
+}
+async function missingImports(cwd) {
+    const failures = await new HallucinatedImportsGate().run({ cwd });
+    return failures.map(f => f.details).join('\n');
+}
+describe('HallucinatedImportsGate — SvelteKit', () => {
+    let cwd;
+    beforeEach(() => {
+        cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'kit-imports-'));
+        write(cwd, 'package.json', JSON.stringify({ devDependencies: { '@sveltejs/kit': '2.0.0', svelte: '5.0.0' } }));
+        write(cwd, 'tsconfig.json', JSON.stringify({ extends: './.svelte-kit/tsconfig.json' }));
+        write(cwd, 'src/lib/format.ts', 'export const format = (n: number) => String(n);\n');
+        write(cwd, 'src/lib/components/badge.svelte', '<span><slot /></span>\n');
+    });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('accepts kit virtual modules, generated $types, $lib and .svelte imports without svelte-kit sync', async () => {
+        write(cwd, 'src/routes/+page.ts', [
+            "import { goto } from '$app/navigation';",
+            "import { page } from '$app/state';",
+            "import { PUBLIC_API_URL } from '$env/static/public';",
+            "import { env } from '$env/dynamic/private';",
+            "import type { PageLoad } from './$types';",
+            "import { format } from '$lib/format';",
+            "import Badge from '$lib/components/badge.svelte';",
+            "import Local from '../lib/components/badge.svelte';",
+            'export const load: PageLoad = () => ({ goto, page, PUBLIC_API_URL, env, format, Badge, Local });',
+        ].join('\n'));
+        expect(await missingImports(cwd)).toBe('');
+    });
+    it('still flags a $lib import that points at no file', async () => {
+        write(cwd, 'src/routes/+page.ts', "import { gone } from '$lib/does-not-exist';\nexport const x = gone;\n");
+        expect(await missingImports(cwd)).toContain("'$lib/does-not-exist'");
+    });
+    it('still flags a missing relative .svelte component', async () => {
+        write(cwd, 'src/routes/+page.ts', "import Missing from './missing.svelte';\nexport const x = Missing;\n");
+        expect(await missingImports(cwd)).toContain("'./missing.svelte'");
+    });
+    it('still flags a real missing package in a kit project', async () => {
+        write(cwd, 'src/routes/+page.ts', "import made from 'package-that-does-not-exist';\nexport const x = made;\n");
+        expect(await missingImports(cwd)).toContain("'package-that-does-not-exist'");
+    });
+    it('does not treat $app or $lib as provided outside a SvelteKit project', async () => {
+        write(cwd, 'package.json', JSON.stringify({ dependencies: {} }));
+        write(cwd, 'src/index.ts', "import { goto } from '$app/navigation';\nimport { format } from '$lib/format';\nexport const x = [goto, format];\n");
+        const details = await missingImports(cwd);
+        expect(details).toContain("'$app/navigation'");
+        expect(details).toContain("'$lib/format'");
+    });
+    it('resolves a $lib import written with the emitted .js extension to its .ts source', async () => {
+        write(cwd, 'src/lib/utils.ts', 'export const cn = (...c: string[]) => c.join(" ");\n');
+        write(cwd, 'src/lib/components/button-variants.ts', "import { cn } from '$lib/utils.js';\nexport const x = cn;\n");
+        expect(await missingImports(cwd)).toBe('');
+    });
+    it('resolves a tsconfig path alias written with .js to its .ts source (any framework)', async () => {
+        write(cwd, 'package.json', JSON.stringify({ dependencies: {} }));
+        write(cwd, 'tsconfig.json', JSON.stringify({ compilerOptions: { baseUrl: '.', paths: { '@/*': ['src/*'] } } }));
+        write(cwd, 'src/util/math.ts', 'export const add = (a: number, b: number) => a + b;\n');
+        write(cwd, 'src/index.ts', "import { add } from '@/util/math.js';\nexport const x = add;\n");
+        expect(await missingImports(cwd)).toBe('');
+    });
+    it('resolves inherited paths against the config that declares them (after svelte-kit sync)', async () => {
+        write(cwd, '.svelte-kit/tsconfig.json', JSON.stringify({
+            compilerOptions: { paths: { $lib: ['../src/lib'], '$lib/*': ['../src/lib/*'] }, rootDirs: ['..', './types'] },
+        }));
+        write(cwd, 'src/routes/+page.ts', "import { format } from '$lib/format';\nimport { gone } from '$lib/does-not-exist';\nexport const x = [format, gone];\n");
+        const details = await missingImports(cwd);
+        expect(details).not.toContain("'$lib/format'");
+        expect(details).toContain("'$lib/does-not-exist'");
+    });
+});
+describe('HallucinatedImportsGate — tsconfig inheritance and rootDirs', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'tsconfig-inherit-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    it('resolves paths inherited from a shared base config against that config (Nx-style)', async () => {
+        write(cwd, 'package.json', JSON.stringify({ dependencies: {} }));
+        write(cwd, 'libs/tsconfig.base.json', JSON.stringify({ compilerOptions: { baseUrl: '.', paths: { '@org/util': ['util/src/index.ts'] } } }));
+        write(cwd, 'libs/util/src/index.ts', 'export const util = 1;\n');
+        write(cwd, 'apps/web/tsconfig.json', JSON.stringify({ extends: '../../libs/tsconfig.base.json' }));
+        write(cwd, 'apps/web/src/main.ts', "import { util } from '@org/util';\nexport const x = util;\n");
+        expect(await missingImports(cwd)).toBe('');
+    });
+    it('resolves a relative import through rootDirs into a generated folder', async () => {
+        write(cwd, 'package.json', JSON.stringify({ dependencies: {} }));
+        write(cwd, 'tsconfig.json', JSON.stringify({ compilerOptions: { rootDirs: ['src', 'generated'] } }));
+        write(cwd, 'generated/schema.ts', 'export const schema = {};\n');
+        write(cwd, 'src/api.ts', "import { schema } from './schema';\nexport const x = schema;\n");
+        expect(await missingImports(cwd)).toBe('');
+    });
+    it('still flags a relative import found in no root', async () => {
+        write(cwd, 'package.json', JSON.stringify({ dependencies: {} }));
+        write(cwd, 'tsconfig.json', JSON.stringify({ compilerOptions: { rootDirs: ['src', 'generated'] } }));
+        write(cwd, 'src/api.ts', "import { schema } from './nowhere';\nexport const x = schema;\n");
+        expect(await missingImports(cwd)).toContain("'./nowhere'");
+    });
+});

package/dist/gates/runner.js

@@ -27,6 +27,7 @@ import { DeprecatedApisGate } from './deprecated-apis.js';
 import { TestQualityGate } from './test-quality.js';
 import { SideEffectAnalysisGate } from './side-effect-analysis/index.js';
 import { StyleDriftGate } from './style-drift.js';
+import { SemanticBugsGate } from './semantic-bugs.js';
 import { LogicDriftGate } from './logic-drift.js';
 import { execa } from 'execa';
 import { Logger } from '../utils/logger.js';
@@ -68,6 +69,10 @@ export class GateRunner {
         if (this.config.gates.checkpoint?.enabled) {
             this.gates.push(new CheckpointGate(this.config.gates.checkpoint));
         }
+        // Semantic Bugs Gate (type-aware, proven findings) — opt-in until field-validated
+        if (this.config.gates.semantic_bugs?.enabled) {
+            this.gates.push(new SemanticBugsGate(this.config.gates.semantic_bugs));
+        }
         // Security Patterns Gate (code-level vulnerability detection) — enabled by default since v2.15
         if (this.config.gates.security?.enabled !== false) {
             this.gates.push(new SecurityPatternsGate(this.config.gates.security));

package/dist/gates/semantic-bugs.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Semantic Bugs Gate: type-aware rules that prove a defect before reporting it.
+ *
+ * Each rule traces a value from where it enters to where it does harm, across
+ * files when needed (see src/semantic/). A finding names both ends; anything
+ * the engine cannot resolve produces no finding.
+ */
+import { Gate, GateContext } from './base.js';
+import { Failure, Provenance } from '../types/index.js';
+export interface SemanticBugsConfig {
+    enabled?: boolean;
+    /** Rule ids to run (`learned/<id>` for a learned rule); all rules when omitted. */
+    rules?: string[];
+}
+export declare class SemanticBugsGate extends Gate {
+    private readonly config;
+    constructor(config?: SemanticBugsConfig);
+    protected get provenance(): Provenance;
+    run(context: GateContext): Promise<Failure[]>;
+    /** Built-in rules plus the repository's learned rules (`.rigour/rules/`), filtered by config. */
+    private selectRules;
+    private toFailure;
+}

package/dist/gates/semantic-bugs.js

@@ -0,0 +1,48 @@
+/**
+ * Semantic Bugs Gate: type-aware rules that prove a defect before reporting it.
+ *
+ * Each rule traces a value from where it enters to where it does harm, across
+ * files when needed (see src/semantic/). A finding names both ends; anything
+ * the engine cannot resolve produces no finding.
+ */
+import { Gate } from './base.js';
+import { FileScanner } from '../utils/scanner.js';
+import { Logger } from '../utils/logger.js';
+import { analyzeFiles, BUILT_IN_RULES } from '../semantic/engine.js';
+import { compileLearnedRule, LEARNED_PREFIX } from '../semantic/learn/compile.js';
+import { loadLearnedRules } from '../semantic/learn/store.js';
+const SOURCE_PATTERNS = ['**/*.{ts,tsx,js,jsx,mjs,cjs,mts,cts}'];
+const TEST_FILE = /(?:^|\/)(?:__tests__|__mocks__|tests?)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/;
+export class SemanticBugsGate extends Gate {
+    config;
+    constructor(config = {}) {
+        super('semantic-bugs', 'Semantic Bug Detection');
+        this.config = config;
+    }
+    get provenance() { return 'traditional'; }
+    async run(context) {
+        const files = (await FileScanner.findFiles({
+            cwd: context.cwd,
+            patterns: context.patterns || SOURCE_PATTERNS,
+            ignore: context.ignore,
+        })).filter(file => /\.(?:[cm]?[jt]s|[jt]sx)$/i.test(file) && !/\.d\.[cm]?ts$/i.test(file) && !TEST_FILE.test(file));
+        if (files.length === 0)
+            return [];
+        const rules = this.selectRules(context.cwd);
+        if (rules.length === 0)
+            return [];
+        Logger.info(`Semantic Bugs: analyzing ${files.length} files with ${rules.length} rule(s)`);
+        return analyzeFiles(context.cwd, files, { rules }).map(finding => this.toFailure(finding));
+    }
+    /** Built-in rules plus the repository's learned rules (`.rigour/rules/`), filtered by config. */
+    selectRules(cwd) {
+        const all = [...BUILT_IN_RULES, ...loadLearnedRules(cwd).map(compileLearnedRule)];
+        const wanted = this.config.rules;
+        return wanted?.length ? all.filter(rule => wanted.includes(rule.id)) : all;
+    }
+    toFailure(finding) {
+        const failure = this.createFailure(`${finding.message}\n${finding.evidence.map(e => `  at ${e}`).join('\n')}`, [finding.file], finding.hint, `[${finding.rule}] ${finding.message.split('. ')[0]}`.slice(0, 120), finding.line, undefined, finding.severity);
+        const category = finding.rule.startsWith(LEARNED_PREFIX) ? 'learned-rule' : finding.rule;
+        return { ...failure, provenance: finding.provenance, source: 'ast', category, verified: true, confidence: 1 };
+    }
+}

package/dist/gates/semantic-bugs.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/semantic-bugs.test.js

@@ -0,0 +1,70 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { SemanticBugsGate } from './semantic-bugs.js';
+import { GateRunner } from './runner.js';
+const LEAKY = [
+    'export async function notify(endpoint: string, signature: string) {',
+    "  return fetch(endpoint, { method: 'POST', headers: { 'x-hook-signature': signature } });",
+    '}',
+].join('\n');
+describe('SemanticBugsGate', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'semantic-gate-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    function write(rel, body) {
+        fs.mkdirSync(path.dirname(path.join(cwd, rel)), { recursive: true });
+        fs.writeFileSync(path.join(cwd, rel), body);
+    }
+    it('reports a proven finding with its evidence, rule and verified metadata', async () => {
+        write('src/notify.ts', LEAKY);
+        const [failure, ...rest] = await new SemanticBugsGate().run({ cwd });
+        expect(rest).toHaveLength(0);
+        expect(failure).toMatchObject({
+            id: 'semantic-bugs', files: ['src/notify.ts'], line: 2, severity: 'high',
+            provenance: 'security', source: 'ast', category: 'credential-redirect', verified: true, confidence: 1,
+        });
+        expect(failure.title).toMatch(/^\[credential-redirect\]/);
+        expect(failure.details).toContain('at src/notify.ts:2');
+    });
+    it('skips test files and declaration files', async () => {
+        write('src/notify.test.ts', LEAKY);
+        write('src/__tests__/notify.ts', LEAKY);
+        write('types/notify.d.ts', 'export declare function notify(): void;\n');
+        expect(await new SemanticBugsGate().run({ cwd })).toEqual([]);
+    });
+    it('honours a scoped run', async () => {
+        write('src/notify.ts', LEAKY);
+        write('src/other.ts', LEAKY);
+        const failures = await new SemanticBugsGate().run({ cwd, patterns: ['src/other.ts'] });
+        expect(failures.map(f => f.files?.[0])).toEqual(['src/other.ts']);
+    });
+    it('runs only the configured rules', async () => {
+        write('src/notify.ts', LEAKY);
+        expect(await new SemanticBugsGate({ rules: ['in-memory-aggregation'] }).run({ cwd })).toEqual([]);
+    });
+    it('runs learned rules from .rigour/rules next to the built-in ones', async () => {
+        write('src/load.ts', "export const load = (url: string) => fetch(url, { method: 'GET' });\n");
+        write('.rigour/rules/require-option-redirect-abcd1234.json', JSON.stringify({
+            id: 'require-option-redirect-abcd1234', version: 1,
+            pattern: { template: 'require-option', callee: { level: 'name', key: 'fetch' }, argIndex: 1, property: 'redirect' },
+            message: 'fetch(...) does not set `redirect`.', severity: 'medium',
+            source: { commit: 'abcdef0123', file: 'src/http.ts', function: 'post' },
+            validation: { firesBefore: 1, firesAfter: 0, maxHits: 3, repoHits: [] },
+        }));
+        const [failure, ...rest] = await new SemanticBugsGate().run({ cwd });
+        expect(rest).toHaveLength(0);
+        expect(failure).toMatchObject({ files: ['src/load.ts'], line: 1, category: 'learned-rule', severity: 'medium' });
+        expect(failure.title).toContain('[learned/require-option-redirect-abcd1234]');
+        expect(failure.hint).toContain('fix abcdef01 in src/http.ts (post)');
+    });
+    it('is off unless enabled in rigour.yml', async () => {
+        write('src/notify.ts', LEAKY);
+        const base = { version: 1, commands: {}, gates: { max_file_lines: 500 } };
+        const off = await new GateRunner(base).run(cwd);
+        expect(off.failures.some(f => f.id === 'semantic-bugs')).toBe(false);
+        const on = await new GateRunner({ ...base, gates: { ...base.gates, semantic_bugs: { enabled: true } } }).run(cwd);
+        expect(on.failures.some(f => f.id === 'semantic-bugs')).toBe(true);
+    });
+});

package/dist/gates/side-effect-analysis/index.js

@@ -162,7 +162,8 @@ export class SideEffectAnalysisGate extends Gate {
             }
             if (varName) {
                 // Variable is stored — check for cleanup using that specific variable
-                const hasPairedCleanup = hasCleanupForVariable(lines, varName, scope.start, scope.end, cleanupPats, lang);
+                const cleanupScope = timerCleanupScope(lines, i, scope);
+                const hasPairedCleanup = hasCleanupForVariable(lines, varName, cleanupScope.start, cleanupScope.end, cleanupPats, lang);
                 if (hasPairedCleanup)
                     continue; // Properly paired
             }
@@ -545,3 +546,12 @@ export class SideEffectAnalysisGate extends Gate {
         }
     }
 }
+/**
+ * Where a stored timer's cleanup may live. A local declaration (`const t = …`)
+ * must be cleared in its own function; a timer kept on a field or an outer
+ * variable is usually cleared by another method, so the whole file counts.
+ */
+function timerCleanupScope(lines, lineIdx, scope) {
+    const isLocal = /^\s*(?:const|let|var)\s/.test(lines[lineIdx]);
+    return isLocal ? scope : { start: 0, end: lines.length };
+}

package/dist/gates/side-effect-analysis.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/side-effect-analysis.test.js

@@ -0,0 +1,162 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { SideEffectAnalysisGate } from './side-effect-analysis/index.js';
+describe('SideEffectAnalysisGate', () => {
+    let cwd;
+    beforeEach(() => { cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'side-effect-')); });
+    afterEach(() => { fs.rmSync(cwd, { recursive: true, force: true }); });
+    async function titlesFor(file, source) {
+        fs.mkdirSync(path.dirname(path.join(cwd, file)), { recursive: true });
+        fs.writeFileSync(path.join(cwd, file), source);
+        const failures = await new SideEffectAnalysisGate().run({ cwd });
+        return failures.map(f => f.title);
+    }
+    describe('recursion', () => {
+        it('ends an expression-bodied arrow at its expression, not at the next block', async () => {
+            // Shape of scripts/measure-intent.mjs: a one-line helper used inside a later loop that logs.
+            const titles = await titlesFor('scripts/measure.mjs', [
+                'const pct = (n, d) => (d === 0 ? \'n/a\' : `${Math.round((100 * n) / d)}%`);',
+                'for (const run of [1, 2]) {',
+                '    process.stderr.write(`run ${run}: ${pct(run, 2)}\\n`);',
+                '}',
+            ].join('\n'));
+            expect(titles).not.toContain('Side-Effect: Unbounded Recursion');
+        });
+        it('still flags a block-bodied arrow that recurses with I/O and no base case', async () => {
+            const titles = await titlesFor('src/walk.ts', [
+                "import fs from 'fs';",
+                'export const walk = (dir) => {',
+                '    for (const entry of fs.readdirSync(dir)) walk(`${dir}/${entry}`);',
+                '};',
+            ].join('\n'));
+            expect(titles).toContain('Side-Effect: Unbounded Recursion');
+        });
+    });
+    describe('process spawns', () => {
+        it('does not treat RegExp.prototype.exec as a process spawn', async () => {
+            // Verbatim shape of the SvelteKit repo's scripts/lint-fonts.mjs.
+            const titles = await titlesFor('scripts/lint-fonts.mjs', [
+                'function checkFontFamilyDeclarations(file, source) {',
+                '\tconst findings = [];',
+                '\tconst re = /font-family\\s*:/gi;',
+                '\tlet match;',
+                '\twhile ((match = re.exec(source)) !== null) {',
+                '\t\tconst valueStart = match.index + match[0].length;',
+                '\t\tfindings.push({ file, valueStart });',
+                '\t}',
+                '\treturn findings;',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('does not treat a database exec method as a process spawn', async () => {
+            const titles = await titlesFor('src/db.ts', "export function migrate(db: any) { db.exec('create table t (id int)'); }\n");
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('does not flag a synchronous execFileSync call', async () => {
+            const titles = await titlesFor('scripts/eval/run.ts', [
+                "import { execFileSync } from 'node:child_process';",
+                "export const revision = () => execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();",
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('accepts once("exit") as exit handling for a spawned process', async () => {
+            const titles = await titlesFor('scripts/upload.ts', [
+                "import { spawn } from 'node:child_process';",
+                'export async function upload(args: string[]) {',
+                '  const code = await new Promise<number>((resolve, reject) => {',
+                "    const child = spawn('npx', args, { stdio: 'inherit' });",
+                "    child.once('error', reject);",
+                "    child.once('exit', (c) => resolve(c ?? 1));",
+                '  });',
+                '  return code;',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('does not read prose in a comment as a fork call', async () => {
+            const titles = await titlesFor('src/lib/seo/json-ld.ts', [
+                "// Canonical profiles, ported as data from the fork (verified against production).",
+                'export const profiles = [];',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(false);
+        });
+        it('still flags a child_process exec whose process is never handled', async () => {
+            const titles = await titlesFor('src/run.ts', [
+                "import { exec } from 'child_process';",
+                'export function run() {',
+                "  exec('ls -la');",
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(true);
+        });
+        it('still flags a spawn through a child_process namespace', async () => {
+            const titles = await titlesFor('src/run.ts', [
+                "import * as cp from 'node:child_process';",
+                'export function run() {',
+                "  cp.spawn('node', ['worker.js']);",
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Orphan Process/.test(t))).toBe(true);
+        });
+    });
+    describe('timers', () => {
+        it('does not flag a one-shot awaited setTimeout delay', async () => {
+            const titles = await titlesFor('scripts/deploy.ts', [
+                'export async function retry(attempt: number) {',
+                '  await new Promise((resolve) => setTimeout(resolve, attempt * 250));',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
+        });
+        it('pairs a timer kept on a private field with a clearInterval in another method', async () => {
+            const titles = await titlesFor('src/lib/review-state.svelte.ts', [
+                'export class ReviewState {',
+                '  #progressTimer: ReturnType<typeof setInterval> | undefined;',
+                '  start() {',
+                '    this.#progressTimer = setInterval(() => this.tick(), 500);',
+                '  }',
+                '  stop() {',
+                '    clearInterval(this.#progressTimer);',
+                '  }',
+                '  tick() {}',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
+        });
+        it('pairs a timer kept in an outer variable with a clearInterval in another function', async () => {
+            const titles = await titlesFor('src/lib/poller.ts', [
+                'let pollTimer: ReturnType<typeof setInterval> | undefined;',
+                'export function startPolling(refresh: () => void) {',
+                '  pollTimer = setInterval(refresh, 5000);',
+                '}',
+                'export function stopPolling() {',
+                '  clearInterval(pollTimer);',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(false);
+        });
+        it('still flags a local interval whose own function never clears it', async () => {
+            const titles = await titlesFor('src/lib/leak.ts', [
+                'export function start(refresh: () => void) {',
+                '  const timer = setInterval(refresh, 5000);',
+                '  return 1;',
+                '}',
+                'export function stop(other: ReturnType<typeof setInterval>) {',
+                '  clearInterval(other);',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(true);
+        });
+        it('still flags a setInterval that is never cleared', async () => {
+            const titles = await titlesFor('src/poll.ts', [
+                'export function poll(check: () => void) {',
+                '  setInterval(check, 1000);',
+                '}',
+            ].join('\n'));
+            expect(titles.some(t => /Unbounded Timer/.test(t))).toBe(true);
+        });
+    });
+});