create-agent-rig 0.4.0 → 0.6.0

package/templates/agent-os/universal/.claude/hooks/guard-bash.mjs

@@ -135,6 +135,43 @@ const WRAPPER_VALUE_FLAGS = {
 const KEYWORDS = new Set(['do', 'then', 'else', 'elif', 'fi', 'done', 'in', '!', '{', '}']);
 /** Shells whose `-c` argument is itself a command line, so it must be parsed too. */
 const SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh']);
+/** Shell options that consume the following token before the `-c` script. */
+const SHELL_VALUE_FLAGS = new Set(['-o', '-O', '+o', '+O', '--init-file', '--rcfile']);
+const compactShellValueCount = (value) =>
+  /^[+-][^+-]+$/.test(value)
+    ? [...value].filter((flag) => flag === 'o' || flag === 'O').length
+    : 0;
+
+const shellScript = (args) => {
+  let commandFlag = -1;
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index].value;
+    if (value === '--' || value === '-' || value === '+' || !/^[+-]/.test(value)) break;
+    if (value === '-c' || (/^-[^-]+$/.test(value) && value.includes('c'))) {
+      commandFlag = index;
+      break;
+    }
+    const valueCount = compactShellValueCount(value);
+    if (valueCount > 0 || SHELL_VALUE_FLAGS.has(value)) index += Math.max(1, valueCount);
+  }
+  if (commandFlag === -1) return '';
+
+  const compactFlag = args[commandFlag].value;
+  const compactValues = compactShellValueCount(compactFlag);
+  const firstCandidate = commandFlag + 1 + compactValues;
+  for (let index = firstCandidate; index < args.length; index += 1) {
+    const value = args[index].value;
+    if (value === '--') return args[index + 1]?.value ?? '';
+    const valueCount = compactShellValueCount(value);
+    if (valueCount > 0 || SHELL_VALUE_FLAGS.has(value)) {
+      index += Math.max(1, valueCount);
+      continue;
+    }
+    if ((value.startsWith('-') || value.startsWith('+')) && value !== '-' && value !== '+') continue;
+    return value;
+  }
+  return '';
+};
 /**
  * Flags whose VALUE is prose or a path, never a ref. Skipping them is what keeps
  * a commit message from being read as a live argument.
@@ -735,11 +772,10 @@ export const inspect = (raw, brake, depth = 0) => {
       // `bash -c "<command line>"` / `eval "<command line>"` — the payload is a
       // command line of its own. Taken whether or not it is quote-delimited: a
       // backslash-joined payload is still a payload.
-      const flagIndex = command.args.findIndex(({ value }) => value === '-c');
       const script =
-        flagIndex >= 0
-          ? command.args[flagIndex + 1]?.value
-          : command.args.map(({ value }) => value).join(' ');
+        command.name === 'eval'
+          ? command.args.map(({ value }) => value).join(' ')
+          : shellScript(command.args);
       if (script) {
         const reason = inspect(script, brake, depth + 1);
         if (reason) return reason;
@@ -774,7 +810,9 @@ function main() {
     return 0;
   }
   if (input.tool_name !== 'Bash') return 0;
-  const raw = String(input.tool_input?.command ?? '');
+  const commandValue = input.tool_input?.command;
+  if (typeof commandValue !== 'string') return 0;
+  const raw = commandValue;
   if (!raw.trim()) return 0;
 
   try {

package/templates/agent-os/universal/.claude/hooks/guard-core-purity.mjs

@@ -3,9 +3,13 @@
 // an agent (or a human using the agent) cannot write an impure line into
 // packages/core/src/ even if it wants to.
 //
-// Contract (Claude Code): JSON on stdin; exit 0 = allow, exit 2 = block, and
+// Contract (Claude Code and Codex): JSON on stdin; exit 0 = allow, exit 2 = block, and
 // stderr is shown to the agent as the reason.
+// Generator-owned coverage for the neutral bounded-inspection refusal lives upstream in
+// codex.test.ts › "$guard blocks with a neutral, actionable size-limit refusal"; generated
+// projects do not carry that suite, and a downstream edit requires a local replacement test.
 import { readFileSync } from 'node:fs';
+import { editFragments } from './lib/edit-input.mjs';
 
 /** The only non-relative import the core may use: its schema/validation library. */
 const ALLOWED_PACKAGES = ['zod'];
@@ -31,17 +35,27 @@ function main() {
   } catch {
     return 0; // unparseable payload: not ours to judge
   }
-  const toolName = input.tool_name;
-  const toolInput = input.tool_input ?? {};
-  if (toolName !== 'Write' && toolName !== 'Edit') return 0;
-
-  const filePath = String(toolInput.file_path ?? '').replaceAll('\\', '/');
-  if (!CORE_PATH.test(filePath) || !CODE_FILE.test(filePath)) return 0;
-
-  const fragment = String(
-    (toolName === 'Write' ? toolInput.content : toolInput.new_string) ?? '',
+  const fragments = editFragments(input);
+  const blocked = fragments.find(
+    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
   );
-  const violations = findViolations(fragment);
+  const globalRefusal = blocked?.inspectionRefusal;
+  if (globalRefusal) {
+    process.stderr.write(
+      `BLOCKED — cannot safely inspect this edit: ${globalRefusal}\n` +
+        // The remedy has to match the refusal: splitting cannot change a
+        // container shape, and a fixed line sent the agent into a retry loop
+        // on the one path it could not retry out of.
+        `${blocked.remedy ?? 'Split it into a smaller patch and retry.'}\n`,
+    );
+    return 2;
+  }
+
+  const violations = fragments.flatMap(({ filePath, fragment, inspectionRefusal }) => {
+    if (!CORE_PATH.test(filePath) || !CODE_FILE.test(filePath)) return [];
+    if (inspectionRefusal) return [`cannot safely inspect this move — ${inspectionRefusal}`];
+    return findViolations(fragment);
+  });
   if (violations.length === 0) return 0;
 
   process.stderr.write(

package/templates/agent-os/universal/.claude/hooks/guard-rulebook.mjs

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+// PreToolUse hook: in an UNATTENDED run, the rulebook is never edited outside
+// the current item's allow-list (AR-51).
+//
+// The rulebook is the set of files that decide what this session may do — the
+// hooks, their wiring, the queue config and adapters, the router and the gate
+// sweep, the rules, `CLAUDE.md`. Every one of them was editable by the run it
+// governs: a Write to `.claude/hooks/dod-checks.json` with `[]` switched the
+// stop gate off, and nothing refused it until the merge sweep, long after.
+//
+// How it decides — and it is deliberately dumb:
+//   1. No unattended flag on disk (`.claude/scripts/unattended-flag.mjs`) → an
+//      attended session → exit 0 for everything. A human at the keyboard edits
+//      the rulebook on purpose.
+//   2. Flag present and readable → every edit fragment whose repo-relative path
+//      sits under a rulebook prefix is refused (exit 2) unless it also sits
+//      under one of the item's `allow` prefixes. Paths outside the rulebook are
+//      never judged.
+//   3. Flag present and UNREADABLE → a rulebook edit is refused and the reason
+//      names the flag; an edit outside the rulebook still passes. Refusing to
+//      inspect is not allowing (`.claude/rules/invariants.md`).
+//
+// Limits — each stated here and each measured in the generator's
+// `test/template/guard-rulebook.test.ts` (absent in a generated rig), by the
+// test named beside it:
+//   - it sees one edit at a time, as text, before it lands — a rulebook file
+//     rewritten through a Bash redirect (`echo … > .claude/settings.json`), a
+//     generated file, or `git checkout` of another branch is not an edit tool
+//     call and never reaches it, and `guard-bash` does not cover that either —
+//     › "a Bash redirect into the rulebook is not an edit tool call and passes
+//     — guard-bash does not cover it either";
+//   - the flag in either home arms it (the env-derived one and the password
+//     database one, like the kill switch), and ONLY a flag arms it: an
+//     exported variable changes nothing, and an attended session that never
+//     set a flag is exactly as free as before — › "only a flag arms it — an
+//     exported RIG_UNATTENDED=1 with no flag changes nothing";
+//   - it judges paths, not content: a README that merely mentions
+//     `.claude/hooks/guard-bash.mjs` is not a rulebook edit — › "guards the
+//     path, not prose that mentions a guarded path";
+//   - it compares paths as text: the repo-relative tail is what is left after
+//     stripping `CLAUDE_PROJECT_DIR` (falling back to the working directory
+//     when the harness does not set it) from the front of the tool's absolute
+//     path, so a root spelled differently from the file path — a symlinked
+//     `/tmp` versus `/private/tmp`, a case difference on a case-insensitive
+//     disk — is not stripped, and the edit is not judged. Documented and
+//     measured, not fixed: the harness spells both from one root — › "compares
+//     paths as text: a root spelled differently from the file path is not
+//     judged (documented, fails open)";
+//   - an `allow` prefix is a string prefix of the repo-relative path and may
+//     not widen the rulebook — an entry that is itself a prefix of a rulebook
+//     prefix (`.`, `.claude/`, `.claude/scripts/`) makes the flag unreadable
+//     and the guard refuses — › "a flag whose allow-list widens the rulebook is
+//     unreadable, so `--allow .` cannot disarm it";
+//   - fail-open on its own errors and on a payload it cannot parse — › "allows
+//     an empty payload object" and › "allows non-JSON stdin" — and fail-closed
+//     on a flag it cannot read — › "blocks a rulebook edit when the flag exists
+//     but cannot be read, and names the file": the guard targets drift, not an
+//     adversary.
+//
+// The rule it enforces is stated in `.claude/rules/autonomy.md`, "Never".
+import { readFileSync } from 'node:fs';
+import { editFragments } from './lib/edit-input.mjs';
+import { RULEBOOK_PREFIXES, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
+
+export { RULEBOOK_PREFIXES, isRulebookPath };
+
+const EDIT_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply_patch']);
+
+const toPosix = (value) => String(value ?? '').replaceAll('\\', '/');
+
+/** The repo-relative tail of an absolute path, or the path itself when it is not under the root. */
+export const relativeTo = (root, filePath) => {
+  const dir = toPosix(root).replace(/\/+$/, '');
+  const file = toPosix(filePath);
+  if (dir !== '' && file.startsWith(`${dir}/`)) return file.slice(dir.length + 1);
+  return file.replace(/^\.\//, '');
+};
+
+export const isAllowed = (rel, allow) =>
+  (Array.isArray(allow) ? allow : []).some((prefix) => prefix !== '' && (rel === prefix || rel.startsWith(prefix)));
+
+function main() {
+  let input;
+  try {
+    input = JSON.parse(readFileSync(0, 'utf8'));
+  } catch {
+    return 0; // unparseable payload: not ours to judge
+  }
+  if (!EDIT_TOOLS.has(input?.tool_name)) return 0;
+
+  const root = process.env.CLAUDE_PROJECT_DIR ?? process.cwd();
+  const paths = [];
+  for (const { filePath } of editFragments(input)) {
+    if (typeof filePath !== 'string' || filePath === '') continue;
+    const rel = relativeTo(root, filePath);
+    if (isRulebookPath(rel) && !paths.includes(rel)) paths.push(rel);
+    if (paths.length >= 64) break;
+  }
+  if (paths.length === 0) return 0; // nothing under the rulebook: never judged
+
+  const mode = readUnattended();
+  if (!mode.on) return 0; // attended session
+
+  if (mode.unreadable) {
+    process.stderr.write(
+      `BLOCKED — "${paths[0]}" is part of the rulebook and the unattended flag at ${mode.path} is unreadable (${mode.why}). ` +
+        'Refusing to inspect is not allowing: fix or remove the flag (`node .claude/scripts/unattended-flag.mjs off`), then retry.\n',
+    );
+    return 2;
+  }
+
+  const refused = paths.filter((rel) => !isAllowed(rel, mode.allow));
+  if (refused.length === 0) return 0;
+  process.stderr.write(
+    `BLOCKED — "${refused[0]}" is part of the rulebook, and an unattended run never edits the rulebook outside its item's allow-list ` +
+      `(item ${mode.item ?? '(none)'}; allowed prefixes: ${mode.allow.length === 0 ? 'none' : mode.allow.join(', ')}). ` +
+      'If the item really needs this path, it belongs in the allow-list the loop wrote at claim time — a decision, not a default. ' +
+      'See .claude/rules/autonomy.md, "Never".\n',
+  );
+  return 2;
+}
+
+try {
+  process.exit(main());
+} catch {
+  process.exit(0); // a crashed guard must not block the session
+}

package/templates/agent-os/universal/.claude/hooks/guard-secret-file.mjs

@@ -0,0 +1,180 @@
+// PreToolUse hook: a credential never enters the repository through an edit.
+//
+// Two arms, because a credential arrives two ways and only one of them has a
+// telltale name:
+//
+//   - the PATH is a credential file   (`jira.env`, `id_rsa`, `secrets/prod.txt`)
+//   - the CONTENT carries a credential VALUE, in a file named nothing special
+//
+// The second is the likelier path and the one nothing in this rulebook refused
+// before: an ignore rule can only ever answer the first.
+//
+// The vocabulary and both matchers come from `../scripts/lib/secrets.mjs`. This
+// file holds no list of its own on purpose — `.claude/rules/invariants.md`, "one
+// mechanism, one implementation": the same invariant written in two places will
+// disagree, and the copy nobody is looking at is the one that is wrong.
+//
+// Contract (Claude Code): JSON on stdin; exit 0 = allow, exit 2 = block, and
+// stderr is shown to the agent as the reason.
+//
+// 🔴 LIMITS, stated because a guard's own claim about its reach is the first
+// thing to go stale. Each names the test that pins it where one exists, and says
+// so plainly where none does — a limits comment nothing checks drifts into
+// overstatement, which is the direction that gets a reader hurt. ⚠ Those tests live in the GENERATOR this rig came from, not here;
+// `.claude/rules/invariants.md` ("About the hooks you were given") says the same
+// of this hook's own tests, and the moment you edit it they are yours.
+//
+// There are FOUR:
+//
+//   - It sees ONE edit fragment, not the resulting file. A credential assembled
+//     across two edits is not seen — see guard-secret-file.test.ts › "does not
+//     see a credential split across two edits, because it is shown one fragment
+//     at a time". This is the same limit every guard in this directory has,
+//     stated in full in `.claude/rules/invariants.md`, "What the enforcement
+//     actually is — stated exactly".
+//   - It sees only what the AGENT writes. The `toolName` branch in `main` below
+//     names the complete surface: `Write`, `Edit`, and `apply_patch`; every other
+//     tool returns before inspection. A human editing the file, or a
+//     `git commit` of something already on disk, never reaches a PreToolUse hook
+//     at all, and no test here can show that: it is a property of the harness,
+//     not of this file.
+//
+//     🔴 WHETHER ANYTHING ELSE CATCHES THAT IS NOT A QUESTION THIS FILE CAN
+//     ANSWER, and it is the one worth asking before relying on the rule. The
+//     layer that covers a human's edit is a COMMIT-TIME check — a git hook, a CI
+//     sweep — and this hook cannot see whether one is installed. Look at
+//     `.husky/` and the CI workflow rather than assuming: the generator this
+//     rulebook came from has both, running the same vocabulary; a freshly
+//     generated rig ships neither, and adding one is a decision for the project.
+//
+//   - It reads at most the first 2 MB of the text being written, the cap
+//     `findSecretValues` applies by default so a fail-open guard cannot be made
+//     to hang. A credential past that point is not seen. ⚠ No test here pins
+//     this one: the case is pinned one layer down, on the module, by
+//     secrets-lib.test.ts › "has a limit even when the caller names none". The CI sweep lifts the
+//     cap; this hook cannot, and that asymmetry is the point.
+//   - It FAILS OPEN on what it cannot understand — see guard-secret-file.test.ts
+//     › "allows a payload that is not JSON at all" and its neighbours. An
+//     unparseable payload, a missing field, or an internal throw all allow the
+//     edit; a crashed guard that blocks everything gets deleted within the hour.
+//
+//     ⚠ **An `apply_patch` command that is PRESENT and is not a shape this guard
+//     reads is the other case, and it now REFUSES** — see codex.test.ts ›
+//     "refuses, rather than failing open, when apply_patch command is supplied
+//     as %s". The line between them is whether the guard can tell: an absent
+//     field is a payload it does not understand, a container it detects and
+//     cannot read is a decision it can report. That reversed a contract this
+//     file previously pinned the other way, so it is stated rather than
+//     assumed. What catches the rest is whatever this project has put
+//     behind it: review always, a commit-time check once one exists.
+//
+// Failing open is also why every line here does provably bounded work: the scan
+// is capped inside `findSecretValues`, there is no recursion, and the one arm
+// that revisits offsets — the one that judges a candidate's value — is bounded
+// by an explicit per-line candidate cap rather than running to exhaustion. Any
+// unbounded work in a fail-open guard is a total bypass of every rule at once,
+// not just of this one.
+import { readFileSync } from 'node:fs';
+
+import { findSecretValues, isCredentialPath } from '../scripts/lib/secrets.mjs';
+import { editFragments } from './lib/edit-input.mjs';
+
+/** Where a refusal points the agent, so the block is actionable rather than a wall. */
+const WHERE_CREDENTIALS_BELONG =
+  'Credentials live outside the repo (an env file in your home config, a secret manager) ' +
+  'and reach the process through the environment — see .claude/rules/autonomy.md, "Never".';
+
+function main() {
+  let input;
+  try {
+    input = JSON.parse(readFileSync(0, 'utf8'));
+  } catch {
+    return 0; // unparseable payload: not ours to judge
+  }
+
+  const toolName = input?.tool_name;
+  if (toolName !== 'Write' && toolName !== 'Edit' && toolName !== 'apply_patch') return 0;
+
+  if (toolName === 'apply_patch') {
+    let refused = false;
+    for (const { filePath, fragment, inspectionRefusal, remedy, appliesToAll } of editFragments(input)) {
+      if (inspectionRefusal) {
+        refused = true;
+        process.stderr.write(
+          `BLOCKED — cannot safely inspect this edit: ${inspectionRefusal}\n` +
+            // The remedy has to match the refusal: splitting cannot change a
+            // container shape, and a fixed line sent the agent into a retry loop
+            // on the one path it could not retry out of.
+            `${remedy ?? 'Split it into a smaller patch and retry.'}\n`,
+        );
+        continue;
+      }
+      if (isCredentialPath(filePath)) {
+        refused = true;
+        process.stderr.write(`BLOCKED — "${filePath}" is a credential file, and this repository never carries one.\n${WHERE_CREDENTIALS_BELONG}\n`);
+        continue;
+      }
+      const findings = findSecretValues(fragment);
+      if (findings.length > 0 || appliesToAll) {
+        refused = true;
+        if (findings.length > 0) process.stderr.write(`BLOCKED — this edit writes a credential value into "${filePath}".\n${WHERE_CREDENTIALS_BELONG}\n`);
+      }
+    }
+    return refused ? 2 : 0;
+  }
+
+  const toolInput = input?.tool_input ?? {};
+  const filePath = String(toolInput.file_path ?? '').replaceAll('\\', '/');
+  if (filePath === '') return 0; // nothing to judge; fail open
+
+  // The tool sends an absolute path. Judge the repo-relative tail so a checkout
+  // living under a directory literally called `secrets` does not make every edit
+  // in the project a credential.
+  // Trailing slashes stripped: with `CLAUDE_PROJECT_DIR=/repo/` the prefix test
+  // below never matches, every path stays absolute, and a checkout that happens
+  // to live under a directory called `secrets` has EVERY edit refused. That is
+  // the "deleted within the hour" outcome `.claude/rules/invariants.md` warns
+  // about — see guard-secret-file.test.ts › "judges the repo-relative path even
+  // when the project directory is given with a trailing slash".
+  const projectDir = String(process.env.CLAUDE_PROJECT_DIR ?? '')
+    .replaceAll('\\', '/')
+    .replace(/\/+$/, '');
+  const relativePath =
+    projectDir !== '' && filePath.startsWith(`${projectDir}/`)
+      ? filePath.slice(projectDir.length + 1)
+      : filePath;
+
+  if (isCredentialPath(relativePath)) {
+    process.stderr.write(
+      `BLOCKED — "${relativePath}" is a credential file, and this repository never carries one.\n` +
+        `${WHERE_CREDENTIALS_BELONG}\n` +
+        `If this file is a documented placeholder, name it .env.example — that form stays committable.\n`,
+    );
+    return 2;
+  }
+
+  const fragment = String((toolName === 'Write' ? toolInput.content : toolInput.new_string) ?? '');
+  const findings = findSecretValues(fragment);
+  if (findings.length === 0) return 0;
+
+  process.stderr.write(
+    `BLOCKED — this edit writes a credential value into "${relativePath}":\n` +
+      findings
+        .map((finding) => `  - ${finding.id} on line ${finding.line} of the text being written`)
+        .join('\n') +
+      `\n${WHERE_CREDENTIALS_BELONG}\n` +
+      // Deliberately NOT the matched text. A guard that prints what it found has
+      // copied the credential into a hook transcript and a terminal scrollback —
+      // it has leaked the secret in the act of refusing it.
+      `The matched value is deliberately not shown; open the line above to see it.\n`,
+  );
+  return 2;
+}
+
+let status;
+try {
+  status = main();
+} catch {
+  status = 0; // fail open — see the LIMITS block above
+}
+process.exit(status);

package/templates/agent-os/universal/.claude/hooks/guard-web-boundary.mjs

@@ -3,9 +3,13 @@
 // layer (`…/db`) and never the services. Enforced at the tool layer, same as
 // core purity: best-effort text scan, failing safe toward a false block.
 //
-// Contract (Claude Code): JSON on stdin; exit 0 = allow, exit 2 = block, and
+// Contract (Claude Code and Codex): JSON on stdin; exit 0 = allow, exit 2 = block, and
 // stderr is shown to the agent as the reason.
+// Generator-owned coverage for the neutral bounded-inspection refusal lives upstream in
+// codex.test.ts › "$guard blocks with a neutral, actionable size-limit refusal"; generated
+// projects do not carry that suite, and a downstream edit requires a local replacement test.
 import { readFileSync } from 'node:fs';
+import { editFragments } from './lib/edit-input.mjs';
 
 const WEB_PATH = /(^|\/)apps\/web\//;
 const CODE_FILE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
@@ -22,21 +26,36 @@ function main() {
   } catch {
     return 0; // unparseable payload: not ours to judge
   }
-  const toolName = input.tool_name;
-  const toolInput = input.tool_input ?? {};
-  if (toolName !== 'Write' && toolName !== 'Edit') return 0;
-
-  const filePath = String(toolInput.file_path ?? '').replaceAll('\\', '/');
-  if (!WEB_PATH.test(filePath) || !CODE_FILE.test(filePath)) return 0;
-
-  const fragment = String((toolName === 'Write' ? toolInput.content : toolInput.new_string) ?? '');
   const violations = [];
   const importRe =
     /(?:\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*|^\s*import\s+)['"]([^'"]+)['"]/gm;
-  for (const match of fragment.matchAll(importRe)) {
-    const spec = match[1];
-    if (FORBIDDEN_WORKSPACE.test(spec) || FORBIDDEN_RELATIVE.test(spec)) {
-      violations.push(spec);
+  const fragments = editFragments(input);
+  const blocked = fragments.find(
+    ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,
+  );
+  const globalRefusal = blocked?.inspectionRefusal;
+  if (globalRefusal) {
+    process.stderr.write(
+      `BLOCKED — cannot safely inspect this edit: ${globalRefusal}\n` +
+        // The remedy has to match the refusal: splitting cannot change a
+        // container shape, and a fixed line sent the agent into a retry loop
+        // on the one path it could not retry out of.
+        `${blocked.remedy ?? 'Split it into a smaller patch and retry.'}\n`,
+    );
+    return 2;
+  }
+
+  for (const { filePath, fragment, inspectionRefusal } of fragments) {
+    if (!WEB_PATH.test(filePath) || !CODE_FILE.test(filePath)) continue;
+    if (inspectionRefusal) {
+      violations.push(`cannot safely inspect this move — ${inspectionRefusal}`);
+      continue;
+    }
+    for (const match of fragment.matchAll(importRe)) {
+      const spec = match[1];
+      if (FORBIDDEN_WORKSPACE.test(spec) || FORBIDDEN_RELATIVE.test(spec)) {
+        violations.push(spec);
+      }
     }
   }
   if (violations.length === 0) return 0;