@soleur/opencode 0.0.0-stage → 3.354.2

package/scripts/lib/affected-tests/js.sh

@@ -0,0 +1,188 @@
+#!/usr/bin/env bash
+# js.sh — JS/TS adapter for affected-tests.sh (#9307 PR2). Sourced, not executed.
+#
+# Detection: package.json / bunfig.toml / pnpm-workspace.yaml.
+# Selector: `vitest related <files> --run` — `related` is a SUBCOMMAND, not a
+# `--related` flag (verified at vitest 4.1.11, #9815) — or jest
+# `--findRelatedTests <files>`; a repo without either falls back to its own
+# `scripts.test` for the full command.
+# Vacuous runs ("No test files found" / jest "No tests found" / passWithNoTests)
+# are a NON-VACUOUS-check failure, never a pass.
+#
+# External binaries: find, grep, node (probe only), npx, npm, pnpm, yarn, bun,
+# vitest, jest (via the resolved exec prefix).
+
+if [[ "${_SOLEUR_AFFECTED_JS_LOADED:-}" == "1" ]]; then
+  return 0 2>/dev/null || true
+fi
+_SOLEUR_AFFECTED_JS_LOADED=1
+
+affected_js_detect() {
+  [[ -f package.json || -f bunfig.toml || -f pnpm-workspace.yaml ]]
+}
+
+affected_js_pm() {
+  if [[ -f pnpm-lock.yaml ]]; then echo pnpm
+  elif [[ -f yarn.lock ]]; then echo yarn
+  elif [[ -f bun.lockb || -f bun.lock || -f bunfig.toml ]]; then echo bun
+  else echo npm; fi
+}
+
+# Resolve an executable prefix for a tool into ADP_TOOL (an argv array).
+# Probe order: node_modules/.bin, the detected package manager's exec, npx
+# --no-install, a bare PATH entry. A RESOLVABLE name is not a RUNNABLE one —
+# every candidate must pass a bounded `--version` probe (the #8266 class: an
+# unpinned mise shim resolves and exits non-zero on every call).
+#
+# rc: 0 resolved | 2 no test tool configured for this repo | 4 toolchain missing
+affected_js_tool() {
+  local pm tool=""
+  ADP_TOOL=()
+  ADP_TOOL_KIND=""
+  pm="$(affected_js_pm)"
+  if compgen -G 'vitest.config.*' >/dev/null 2>&1 \
+     || { [[ -f package.json ]] && grep -q '"vitest"' package.json; }; then
+    tool=vitest
+  elif compgen -G 'jest.config.*' >/dev/null 2>&1 \
+     || { [[ -f package.json ]] && grep -q '"jest"' package.json; }; then
+    tool=jest
+  elif [[ -f package.json ]] && grep -q '"test"[[:space:]]*:' package.json; then
+    # No selector-capable runner; the repo's own scripts.test is the only
+    # command. It can only run FULL — selection has no native form here.
+    case "$pm" in
+      pnpm) ADP_TOOL=(pnpm test) ;;
+      yarn) ADP_TOOL=(yarn test) ;;
+      bun)  ADP_TOOL=(bun test) ;;
+      *)    ADP_TOOL=(npm test) ;;
+    esac
+    for b in "${ADP_TOOL[0]}"; do
+      command -v "$b" >/dev/null 2>&1 || { ADP_TOOL=(); return 4; }
+    done
+    ADP_TOOL_KIND=script
+    return 0
+  else
+    return 2
+  fi
+
+  if [[ -x "node_modules/.bin/$tool" ]]; then
+    ADP_TOOL=("node_modules/.bin/$tool")
+  else
+    case "$pm" in
+      pnpm) command -v pnpm >/dev/null 2>&1 && ADP_TOOL=(pnpm exec "$tool") ;;
+      yarn) command -v yarn >/dev/null 2>&1 && ADP_TOOL=(yarn "$tool") ;;
+      # NO `bun x` arm: bunx auto-installs and executes registry content when
+      # the package is absent — asymmetric with `npx --no-install` below
+      # (oven-sh/bun#23673: bun's --no-install flag is not yet honoured
+      # consistently). A bun-only repo resolves via node_modules/.bin or PATH.
+    esac
+    if (( ${#ADP_TOOL[@]} == 0 )) && command -v npx >/dev/null 2>&1; then
+      ADP_TOOL=(npx --no-install "$tool")
+    fi
+    if (( ${#ADP_TOOL[@]} == 0 )) && command -v "$tool" >/dev/null 2>&1; then
+      ADP_TOOL=("$tool")
+    fi
+  fi
+  if (( ${#ADP_TOOL[@]} == 0 )); then
+    return 4
+  fi
+  # RESOLVABLE IS NOT RUNNABLE — probe, bounded.
+  if ! affected_timeout 15 "${ADP_TOOL[@]}" --version >/dev/null 2>&1; then
+    ADP_TOOL=()
+    return 4
+  fi
+  ADP_TOOL_KIND="$tool"
+  return 0
+}
+
+# Total test files discoverable in the repo (spec/test conventions + __tests__).
+# jest's `__tests__/**/*.[jt]s` convention carries no .test./.spec. marker in
+# the filename, so the census needs the directory shape too — deduped via
+# sort -u against the pattern-matched set.
+affected_js_total() {
+  { affected_find_files count '*.test.*' '*.spec.*' || true
+    affected_find_files count '*.[jt]s' '*.[jt]sx' | grep '/__tests__/' || true
+  } | sort -u | grep -c . || true
+}
+
+# Count the test files a runner reported running, from its own summary line.
+affected_js_parse_ran() { # $1 = log file; prints count or -
+  local log="$1" n=""
+  if [[ "$ADP_TOOL_KIND" == vitest ]]; then
+    # `  Test Files  2 passed | 1 failed (3)` — the parenthesised TOTAL.
+    n="$(grep -oE 'Test Files.*\(([0-9]+)\)' "$log" 2>/dev/null | grep -oE '[0-9]+' | tail -n 1 || true)"
+  elif [[ "$ADP_TOOL_KIND" == jest ]]; then
+    # `Test Suites: 1 failed, 2 passed, 3 total`
+    n="$(grep -oE 'Test Suites:.*[0-9]+ total' "$log" 2>/dev/null | grep -oE '[0-9]+ total' | grep -oE '[0-9]+' | tail -n 1 || true)"
+  fi
+  printf '%s\n' "${n:--}"
+}
+
+# affected_js_run <selected|full> — runs the resolved tool. Sets ADP_RAN,
+# ADP_OF, ADP_VACUOUS. rc: 0 pass | 1 fail | 5 vacuous | 124 budget-expired |
+# other runner rc.
+affected_js_run() {
+  local mode="$1" width="$2"
+  ADP_VACUOUS=0
+  ADP_ESCALATED_FULL=0   # set when a selected run silently became a full one
+  ADP_OF="$(affected_js_total)"
+  local -a cmd=()
+  local log rc=0 ran="-"
+  affected_mktemp js || return 4; log="$AFFECTED_TMP"
+
+  if [[ "$mode" == selected && "$ADP_TOOL_KIND" == vitest ]]; then
+    local -a files=()
+    local f
+    for f in ${AFFECTED_CHANGED[@]+"${AFFECTED_CHANGED[@]}"}; do
+      [[ -f "$f" ]] && files+=("$f")
+    done
+    if (( ${#files[@]} == 0 )); then
+      rm -f "$log"
+      ADP_VACUOUS=1
+      ADP_RAN=0
+      return 5
+    fi
+    cmd=("${ADP_TOOL[@]}" related "${files[@]}" --run "--maxWorkers=${width}")
+  elif [[ "$mode" == selected && "$ADP_TOOL_KIND" == jest ]]; then
+    local -a files=()
+    local f
+    for f in ${AFFECTED_CHANGED[@]+"${AFFECTED_CHANGED[@]}"}; do
+      [[ -f "$f" ]] && files+=("$f")
+    done
+    if (( ${#files[@]} == 0 )); then
+      rm -f "$log"
+      ADP_VACUOUS=1
+      ADP_RAN=0
+      return 5
+    fi
+    cmd=("${ADP_TOOL[@]}" --findRelatedTests "${files[@]}" "--maxWorkers=${width}")
+  else
+    # full, or selected on a tool with no native selector (scripts.test). The
+    # escalation is reported so the gate's marker can say mode=full
+    # reason=no-selector — a full run must never masquerade as a selection.
+    if [[ "$mode" == selected ]]; then
+      ADP_ESCALATED_FULL=1
+      echo "affected-tests: stack=js has no native selector (scripts.test only) — running the full command (reason=no-selector)." >&2
+    fi
+    case "$ADP_TOOL_KIND" in
+      vitest) cmd=("${ADP_TOOL[@]}" run "--maxWorkers=${width}") ;;
+      jest)   cmd=("${ADP_TOOL[@]}" "--maxWorkers=${width}") ;;
+      *)      cmd=("${ADP_TOOL[@]}") ;;
+    esac
+  fi
+
+  affected_bound "${cmd[@]}" >"$log" 2>&1 || rc=$?
+  cat "$log"
+
+  # Vacuous verdicts come from the runner's OWN words, not its rc — vitest's
+  # passWithNoTests exits 0 over zero files, and jest finds none under rc 1.
+  if grep -qE 'No test files found|No tests found|no tests found' "$log"; then
+    ADP_VACUOUS=1
+    rm -f "$log"
+    ADP_RAN=0
+    return 5
+  fi
+  ran="$(affected_js_parse_ran "$log")"
+  rm -f "$log"
+  ADP_RAN="$ran"
+  return "$rc"
+}

package/scripts/lib/affected-tests/nx-turbo.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# nx-turbo.sh — nx/turborepo adapter for affected-tests.sh (#9307 PR2). Sourced,
+# not executed. Detected FIRST in the adapter order: a workspace scheduler's
+# affected graph subsumes per-package JS selection.
+#
+# Selection: `nx affected -t test --base=<base> --parallel=<w>` /
+# `turbo run test --filter=...[<base>] --concurrency=<w>` — both compute the
+# dependency-closure themselves, which is what makes them the preferred arm.
+# A zero-task affected run is vacuous and falls back to the full workspace run
+# (`nx run-many -t test --all` / `turbo run test`).
+#
+# External binaries: grep, node (probe only), npx, nx, turbo.
+
+if [[ "${_SOLEUR_AFFECTED_NXT_LOADED:-}" == "1" ]]; then
+  return 0 2>/dev/null || true
+fi
+_SOLEUR_AFFECTED_NXT_LOADED=1
+
+affected_nxt_detect() {
+  [[ -f nx.json || -f turbo.json ]]
+}
+
+# rc: 0 resolved | 4 toolchain missing. Sets ADP_TOOL (argv prefix) and
+# ADP_TOOL_KIND (nx|turbo).
+affected_nxt_tool() {
+  local tool
+  if [[ -f nx.json ]]; then tool=nx; else tool=turbo; fi
+  if [[ -x "node_modules/.bin/$tool" ]]; then
+    ADP_TOOL=("node_modules/.bin/$tool")
+  elif command -v "$tool" >/dev/null 2>&1; then
+    ADP_TOOL=("$tool")
+  elif command -v npx >/dev/null 2>&1; then
+    ADP_TOOL=(npx --no-install "$tool")
+  else
+    ADP_TOOL=()
+    return 4
+  fi
+  if ! affected_timeout 20 "${ADP_TOOL[@]}" --version >/dev/null 2>&1; then
+    ADP_TOOL=()
+    return 4
+  fi
+  ADP_TOOL_KIND="$tool"
+  return 0
+}
+
+# affected_nxt_run <selected|full> <width> <base>
+affected_nxt_run() {
+  local mode="$1" width="$2" base="$3"
+  ADP_VACUOUS=0
+  # Project graph totals are scheduler-owned; `-` is the honest count.
+  ADP_OF="-"
+  local -a cmd=()
+  local log rc=0
+  affected_mktemp nxt || return 4; log="$AFFECTED_TMP"
+
+  if [[ "$ADP_TOOL_KIND" == nx ]]; then
+    if [[ "$mode" == selected ]]; then
+      cmd=("${ADP_TOOL[@]}" affected -t test --base="$base" --parallel="$width")
+    else
+      cmd=("${ADP_TOOL[@]}" run-many -t test --all --parallel="$width")
+    fi
+  else
+    if [[ "$mode" == selected ]]; then
+      # `...[<base>]` = packages changed since <base> plus everything that
+      # depends on them.
+      cmd=("${ADP_TOOL[@]}" run test "--filter=...[$base]" --concurrency="$width")
+    else
+      cmd=("${ADP_TOOL[@]}" run test --concurrency="$width")
+    fi
+  fi
+
+  affected_bound "${cmd[@]}" >"$log" 2>&1 || rc=$?
+  cat "$log"
+
+  # Vacuous verdicts from the scheduler's own words: an affected run that
+  # reached zero tasks executed nothing. The `0 tasks` alternative must not
+  # match inside a larger count — `10 tasks` is a real run, not a vacuous one.
+  if grep -qiE '(^|[^0-9])0 tasks|no tasks were executed|ran target test for 0 projects|No projects' "$log"; then
+    ADP_VACUOUS=1
+    rm -f "$log"
+    ADP_RAN=0
+    return 5
+  fi
+  ADP_RAN="$(grep -oE 'for [0-9]+ project|[0-9]+ (tasks|successful|cached)' "$log" \
+    | grep -oE '[0-9]+' | head -n 1 || true)"
+  [[ -n "$ADP_RAN" ]] || ADP_RAN="-"
+  # A NUMERIC zero is vacuous the same as a phrase match: `Tasks: 0 successful`
+  # / `ran target test for 0 projects`-adjacent spellings the phrase grep above
+  # doesn't cover still mean the scheduler executed nothing.
+  if [[ "$ADP_RAN" =~ ^[0-9]+$ ]] && (( ADP_RAN == 0 )); then
+    ADP_VACUOUS=1
+    rm -f "$log"
+    ADP_RAN=0
+    return 5
+  fi
+  rm -f "$log"
+  return "$rc"
+}

package/scripts/lib/affected-tests/python.sh

@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# python.sh — pytest adapter for affected-tests.sh (#9307 PR2). Sourced, not
+# executed.
+#
+# Detection: pyproject.toml / pytest.ini / tox.ini / setup.cfg.
+# Selection: pytest has no native affected selector — changed TEST files run
+# directly; a diff touching non-test source falls back to pytest-testmon when
+# importable, else the full suite. `-n <width>` only when pytest-xdist is
+# importable, else serial with the reason printed. pytest's rc 5 (no tests
+# collected) is a NON-VACUOUS check — it is never a pass.
+#
+# External binaries: find, grep, python3, pytest (whichever the probe resolves).
+
+if [[ "${_SOLEUR_AFFECTED_PY_LOADED:-}" == "1" ]]; then
+  return 0 2>/dev/null || true
+fi
+_SOLEUR_AFFECTED_PY_LOADED=1
+
+affected_py_detect() {
+  # A manifest alone is a Python-PROJECT marker, not a pytest-SUITE marker — a
+  # library's bare pyproject.toml must not claim the stack. Require a pytest
+  # signal: pytest.ini is one by name; the other manifests must mention pytest;
+  # with no manifest signal, test_*.py/*_test.py files are the fallback evidence.
+  local m
+  for m in pyproject.toml pytest.ini tox.ini setup.cfg; do
+    [[ -f "$m" ]] || continue
+    [[ "$m" == pytest.ini ]] && return 0
+    grep -qiE 'pytest' "$m" 2>/dev/null && return 0
+  done
+  # `< <(producer)`, not `producer | grep -q .`: under pipefail grep's early
+  # exit SIGPIPEs the producer and a match can read as a miss (#9217).
+  grep -q . < <(affected_find_files any 'test_*.py' '*_test.py')
+}
+
+# Resolve the pytest invocation into ADP_TOOL (argv). A direct `pytest` binary
+# wins over `python3 -m pytest` because a venv-provided pytest is the repo's
+# pinned one; `python3 -m pytest` covers repos where only the module exists.
+# rc: 0 resolved | 4 toolchain missing.
+affected_py_tool() {
+  if command -v pytest >/dev/null 2>&1 \
+     && affected_timeout 15 pytest --version >/dev/null 2>&1; then
+    ADP_TOOL=(pytest)
+    return 0
+  fi
+  # -I: isolated mode — a repo's cwd on sys.path would execute repo-controlled
+  # code (a pytest.py or sitecustomize.py in the tree) during a mere probe.
+  if command -v python3 >/dev/null 2>&1 \
+     && affected_timeout 15 python3 -I -c 'import pytest' >/dev/null 2>&1; then
+    ADP_TOOL=(python3 -m pytest)
+    return 0
+  fi
+  ADP_TOOL=()
+  return 4
+}
+
+affected_py_total() {
+  affected_find_files count 'test_*.py' '*_test.py' | grep -c . || true
+}
+
+# The interpreter backing the resolved ADP_TOOL: a `python3 -m pytest` tool
+# answers to python3; a `pytest` entry point answers to ITS shebang interpreter
+# — a venv-pinned pytest must probe the venv's environment, not the system's.
+# Falls back to python3 when the shebang resolves to no python at all (a
+# compiled or shell-wrapped pytest).
+affected_py_interpreter() {
+  if [[ "${ADP_TOOL[*]}" == "python3 -m pytest" ]]; then
+    command -v python3 2>/dev/null
+    return 0
+  fi
+  local bin sheb interp=""
+  bin="$(command -v "${ADP_TOOL[0]:-pytest}" 2>/dev/null || true)"
+  if [[ -n "$bin" && -f "$bin" ]]; then
+    sheb="$(head -n 1 "$bin" 2>/dev/null)"
+    case "$sheb" in
+      '#!'*)
+        sheb="${sheb#\#!}"
+        # `read -ra`, never `set -- $sheb`: unquoted word-splitting also GLOBS,
+        # and clobbering the function's positional params is a side effect.
+        local -a sheb_argv=()
+        read -ra sheb_argv <<<"$sheb"   # "/usr/bin/env python3" | "/venv/bin/python -E"
+        if [[ "${sheb_argv[0]##*/}" == env && -n "${sheb_argv[1]:-}" ]]; then
+          interp="${sheb_argv[1]}"
+        else
+          interp="${sheb_argv[0]:-}"
+        fi
+        case "${interp##*/}" in python*|py) ;; *) interp="" ;; esac
+        ;;
+    esac
+  fi
+  [[ -n "$interp" ]] || interp="$(command -v python3 2>/dev/null || true)"
+  printf '%s\n' "$interp"
+}
+
+# Append parallelism flags to ADP_TOOL-derived argv when xdist is importable;
+# print the serial reason when it is not (P4: the operator sees what ran).
+affected_py_width() {
+  local width="$1" pybin
+  pybin="$(affected_py_interpreter)"
+  if [[ -n "$pybin" ]] && affected_timeout 15 "$pybin" -I -c 'import xdist' >/dev/null 2>&1; then
+    printf -- '-n %s' "$width"
+  else
+    echo "pytest-xdist not importable — running serially" >&2
+    printf ''
+  fi
+}
+
+# affected_py_run <selected|full> <width>. Sets ADP_RAN/ADP_OF/ADP_VACUOUS.
+# rc: 0 pass | 1 fail | 5 vacuous (collected nothing) | 124 budget | other.
+affected_py_run() {
+  local mode="$1" width="$2"
+  ADP_VACUOUS=0
+  ADP_OF="$(affected_py_total)"
+  local -a cmd=("${ADP_TOOL[@]}")
+  local -a width_args=()
+  local -a test_files=()
+  local f non_test=0 testmon=0
+  local w
+  w="$(affected_py_width "$width")"
+  # shellcheck disable=SC2206  # `affected_py_width` emits flag words only
+  [[ -n "$w" ]] && width_args=($w)
+  local log rc=0
+  affected_mktemp py || return 4; log="$AFFECTED_TMP"
+
+  if [[ "$mode" == selected ]]; then
+    # Partition the changed set: changed test files run directly; the presence
+    # of non-test sources requires coverage pytest cannot compute natively.
+    for f in ${AFFECTED_CHANGED[@]+"${AFFECTED_CHANGED[@]}"}; do
+      [[ -f "$f" ]] || continue
+      case "${f##*/}" in
+        test_*.py|*_test.py) test_files+=("$f") ;;
+        *.py) non_test=1 ;;
+      esac
+    done
+    local pybin_t
+    pybin_t="$(affected_py_interpreter)"
+    if [[ -n "$pybin_t" ]] \
+       && affected_timeout 15 "$pybin_t" -I -c 'import pytest_testmon' >/dev/null 2>&1; then
+      testmon=1
+    fi
+    if (( testmon )); then
+      # testmon selects tests whose coverage the diff touches — it needs a
+      # recorded baseline (.testmondata) and widens safely when absent.
+      cmd+=("--testmon" ${width_args[@]+"${width_args[@]}"})
+    elif (( non_test )) || (( ${#test_files[@]} == 0 )); then
+      # A source diff with no testmon, or a diff with no runnable pytest file:
+      # coverage-favoring — the full suite is the only honest selection.
+      rm -f "$log"
+      ADP_VACUOUS=1
+      ADP_RAN=0
+      return 5
+    else
+      cmd+=("${test_files[@]}" ${width_args[@]+"${width_args[@]}"})
+    fi
+  fi
+  # full mode (or the selected testmon arm) uses cmd as built above; a bare
+  # `full` runs the whole suite.
+  if [[ "$mode" == full ]]; then
+    cmd=("${ADP_TOOL[@]}" ${width_args[@]+"${width_args[@]}"})
+  fi
+
+  affected_bound "${cmd[@]}" >"$log" 2>&1 || rc=$?
+  cat "$log"
+
+  # pytest rc 5 = "no tests collected" — a vacuous verdict, never a pass.
+  if (( rc == 5 )) || grep -qE 'no tests ran|collected 0 items' "$log"; then
+    ADP_VACUOUS=1
+    rm -f "$log"
+    ADP_RAN=0
+    return 5
+  fi
+  # ran is in FILE units to match of= (the repo test-file census). pytest's
+  # `collected N items` counts test ITEMS — a different unit, and under testmon
+  # `collected N / M deselected` the pre-slash figure even overstates. So: the
+  # file-diff arm ran exactly the files it passed pytest; full ran the whole
+  # census; under testmon no honest file count is derivable → `-`.
+  if [[ "$mode" == full ]]; then
+    ADP_RAN="$ADP_OF"
+  elif (( testmon )); then
+    ADP_RAN="-"
+  else
+    ADP_RAN="${#test_files[@]}"
+  fi
+  rm -f "$log"
+  return "$rc"
+}

package/scripts/lib/context-sanitize.sh

@@ -0,0 +1,49 @@
+# shellcheck shell=bash
+# context-sanitize.sh — shared context/display boundary sanitizer (#10395).
+#
+# Sourced lib. Two byte-equal copies exist:
+#   .claude/hooks/lib/context-sanitize.sh          (repo-side consumers)
+#   plugins/soleur/scripts/lib/context-sanitize.sh (plugin-side consumers)
+# Keep them identical — context-sanitize.test.sh pins parity with `cmp`.
+#
+# Contract: stdin -> stdout pipe filters. All strip C0 + DEL (0x7F) and the
+# UTF-8 line-break class (NEL \xc2\x85, LS \xe2\x80\xa8, PS \xe2\x80\xa9);
+# variants differ only in which C0 whitespace survives the tr stage.
+# The sed patterns MUST use $'...' ANSI-C quoting — BSD sed does not
+# interpret bare '\xHH', which would silently strip nothing.
+# `\177` is octal: tr does not interpret \xHH.
+#
+# No `set` options here — this file is sourced into hooks that own their
+# own option state.
+
+# When sed is absent (restricted-PATH callers — e.g. run-in-pid-namespace's
+# private-PATH probe fixtures), degrade to the tr-only set: exactly every
+# site's pre-change strip set. Never weaker than the adoption contract.
+_soleur_ctx_sed() {
+  if command -v sed >/dev/null 2>&1; then
+    LC_ALL=C sed -e $'s/\xc2\x85//g' -e $'s/\xe2\x80\xa8//g' -e $'s/\xe2\x80\xa9//g'
+  else
+    cat
+  fi
+}
+
+# strip-all: single-line fields (no C0 survives).
+soleur_ctx_sanitize() {
+  LC_ALL=C tr -d '\000-\037\177' | _soleur_ctx_sed
+}
+
+# keep-lines: multi-line blocks (TAB and LF survive).
+soleur_ctx_sanitize_lines() {
+  LC_ALL=C tr -d '\000-\010\013-\037\177' | _soleur_ctx_sed
+}
+
+# newline-only: LF survives, TAB stripped too.
+soleur_ctx_sanitize_nl() {
+  LC_ALL=C tr -d '\000-\011\013-\037\177' | _soleur_ctx_sed
+}
+
+# Direct execution is a usage error: this is a sourced lib, not a command.
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  echo "context-sanitize.sh: source this file; do not execute it" >&2
+  exit 1
+fi