devrites 3.2.27 → 4.0.0

package/scripts/check-cross-refs.py

@@ -1,139 +0,0 @@
-#!/usr/bin/env python3
-"""Cross-reference linter for the DevRites pack.
-
-Catches the maintenance-drift class the skills audit surfaced: a SKILL.md or
-reference file pointing at another file that has moved, been renamed, or never
-existed. Three checks, tuned for near-zero false positives:
-
-  1. Markdown links to local .md targets : `](path.md)` resolved relative to the
-     containing file; the target must exist.
-  2. Bare backtick .md filenames         : `` `name.md` `` must exist SOMEWHERE in
-     the pack (by basename). Catches references to a file that exists nowhere.
-  3. "canonical version: `path`" claims   : the named path (relative to the skills
-     root) must exist. Catches a file disclaiming itself secondary to a missing one.
-
-Scans pack/.claude/. Exit 1 on any dead reference. Read-only.
-"""
-import argparse
-import os
-import re
-import sys
-
-parser = argparse.ArgumentParser()
-parser.add_argument("--root", default=".", help="repository root containing pack/.claude")
-args = parser.parse_args()
-
-REPO_ROOT = os.path.normpath(args.root)
-ROOT = os.path.join(REPO_ROOT, "pack", ".claude")
-SKILLS_ROOT = os.path.join(ROOT, "skills")
-
-# Runtime artifacts live under .devrites/ (per-feature work/<slug>/ files, plus the
-# project-level conventions ledger), not in the pack. References to them by filename are
-# legitimate, not dead refs.
-WORKSPACE_ARTIFACTS = {
-    "spec.md", "plan.md", "tasks.md", "state.md", "decisions.md", "assumptions.md",
-    "questions.md", "drift.md", "evidence.md", "browser-evidence.md", "touched-files.md",
-    "review.md", "seal.md", "ship.md", "brief.md", "design-brief.md", "strategy.md",
-    "polish-report.md", "handoff.md", "eng-review.md", "test-plan.md", "references.md",
-    # forge competition record (work/<slug>/forge-report.md): written when a Forge: yes slice competes candidates
-    "forge-report.md",
-    "conventions.md", "coverage.md", "analysis.md", "learnings.md",
-    # developer-experience scorecard (work/<slug>/devex.md) + project-level retro ledger (.devrites/retro.md)
-    "devex.md", "retro.md",
-    # spec-quality checklists (.devrites/work/<slug>/checklists/<domain>.md)
-    "functional.md", "data-model.md", "interaction.md", "non-functional.md", "edge-cases.md",
-    # feature manifest (work/<slug>/feature.md) + the planning/proof artifacts the
-    # lifecycle generates: rite-define writes architecture.md + traceability.md, rite-spec
-    # writes flows.md + index.md, and proof.md is the SectionProof file (see engine state schema).
-    "feature.md", "architecture.md", "traceability.md", "flows.md", "index.md", "proof.md",
-    # Named outputs created in the user's workspace by their owning workflow.
-    "agent.md", "dogfood.md", "walkthrough.md", "ai-spec.md",
-}
-
-# Files the skills legitimately tell Claude to read in the USER's project / the repo,
-# which are not part of the shipped pack.
-PROJECT_DOCS = {
-    "CLAUDE.md", "AGENTS.md", "DESIGN.md", "PRODUCT.md", "CONTEXT.md", "NOTES.md",
-    "README.md", "CHANGELOG.md", "CONTRIBUTING.md", "cli.md",
-    "ADR-NNN.md",  # generated per-decision ADR in the user repo (docs/adr/), promoted at /rite-ship
-}
-
-
-def resolve(here, link):
-    """Resolve a link. `.claude/...`-rooted paths are install-root-relative (= pack/
-    in this repo); everything else is relative to the containing file."""
-    if link.startswith(".claude/"):
-        return os.path.normpath(os.path.join(REPO_ROOT, "pack", link))
-    if link.startswith("docs/"):
-        return os.path.normpath(os.path.join(REPO_ROOT, link))
-    return os.path.normpath(os.path.join(here, link))
-
-md_files = []
-all_basenames = set()
-for base, _dirs, files in os.walk(ROOT):
-    for f in files:
-        if f.endswith(".md"):
-            p = os.path.join(base, f)
-            md_files.append(p)
-            all_basenames.add(f)
-
-LINK_RE = re.compile(r"\]\(([^)]+)\)")
-BACKTICK_MD_RE = re.compile(r"`([A-Za-z0-9._/\-]+\.md)`")
-SEE_RE = re.compile(r"\(see\s+`?([A-Za-z0-9._/\-]+\.md)`?[^)]*\)")
-CANONICAL_RE = re.compile(r"[Cc]anonical version:\s*`?\s*`?([A-Za-z0-9._/\-]+\.md)`")
-
-errors = []
-
-for path in md_files:
-    with open(path, encoding="utf-8") as fh:
-        text = fh.read()
-    here = os.path.dirname(path)
-
-    # 1. markdown links to .md
-    for link in LINK_RE.findall(text):
-        link = link.strip()
-        if link.startswith(("http://", "https://", "mailto:", "#")):
-            continue
-        target = link.split("#", 1)[0]
-        if not target.endswith(".md"):
-            continue
-        resolved = resolve(here, target)
-        if not os.path.isfile(resolved):
-            errors.append(f"{path}: markdown link -> {link} (resolved {resolved}) does not exist")
-
-    # 2. bare backtick filenames must exist somewhere in the pack (by basename),
-    #    excluding runtime workspace artifacts and user-project docs.
-    for tok in BACKTICK_MD_RE.findall(text):
-        base = os.path.basename(tok)
-        if base in WORKSPACE_ARTIFACTS or base in PROJECT_DOCS or base in all_basenames:
-            continue
-        if "/" in tok:  # a path inside the pack must resolve
-            if not os.path.isfile(resolve(here, tok)):
-                errors.append(f"{path}: backtick `{tok}` does not resolve")
-            continue
-        errors.append(f"{path}: backtick `{tok}`: no `{base}` exists anywhere in the pack")
-
-    # 4. "(see X.md)" prose pointers: slash form resolves (install-aware);
-    #    bare form must exist in the pack (or be a workspace artifact / project doc).
-    for tok in SEE_RE.findall(text):
-        base = os.path.basename(tok)
-        if "/" in tok:
-            resolved = resolve(here, tok)
-            if not os.path.isfile(resolved):
-                errors.append(f"{path}: (see {tok}) (resolved {resolved}) does not exist")
-        elif base not in WORKSPACE_ARTIFACTS and base not in PROJECT_DOCS and base not in all_basenames:
-            errors.append(f"{path}: (see {tok}): no `{base}` exists anywhere in the pack")
-
-    # 3. "canonical version: `path`" must resolve against the skills root
-    for claim in CANONICAL_RE.findall(text):
-        resolved = os.path.normpath(os.path.join(SKILLS_ROOT, claim))
-        if not os.path.isfile(resolved):
-            errors.append(f"{path}: 'canonical version' -> {claim} (resolved {resolved}) does not exist")
-
-if errors:
-    print(f"check-cross-refs: {len(errors)} dead reference(s):\n")
-    for e in sorted(errors):
-        print("  " + e)
-    sys.exit(1)
-
-print(f"check-cross-refs: OK: {len(md_files)} markdown files, no dead references.")

package/scripts/check-generated-skill-budget.mjs

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-// Guard generated host skill payloads against accidental context bloat.
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join, relative } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const root = fileURLToPath(new URL('..', import.meta.url));
-const base = process.argv[2] || join(root, 'pack', '.claude', 'skills');
-const totalLimit = Number(process.env.DEVRITES_SKILL_TOTAL_BUDGET || 900_000);
-const fileLimit = Number(process.env.DEVRITES_SKILL_FILE_BUDGET || 64_000);
-const referenceFileLimit = Number(process.env.DEVRITES_REFERENCE_FILE_BUDGET || 32_000);
-let total = 0;
-let failures = 0;
-
-function fail(msg) {
-  console.error(`FAIL: ${msg}`);
-  failures++;
-}
-
-if (!existsSync(base)) {
-  console.log(`skill-budget: skip missing ${base}`);
-  process.exit(0);
-}
-function markdownFiles(dir) {
-  const files = [];
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const file = join(dir, entry.name);
-    if (entry.isDirectory()) files.push(...markdownFiles(file));
-    else if (entry.isFile() && entry.name.endsWith('.md')) files.push(file);
-  }
-  return files;
-}
-
-for (const file of markdownFiles(base)) {
-  const bytes = Buffer.byteLength(readFileSync(file));
-  total += bytes;
-  const limit = file.endsWith('/SKILL.md') ? fileLimit : referenceFileLimit;
-  if (bytes > limit) fail(`${relative(root, file)} is ${bytes} bytes (max ${limit})`);
-}
-if (total > totalLimit) fail(`${relative(root, base)} markdown payload is ${total} bytes (max ${totalLimit})`);
-console.log(`skill-budget: ${total} markdown bytes under ${relative(root, base) || base}`);
-process.exit(failures ? 1 : 0);

package/scripts/check-instruction-size-baseline.mjs

@@ -1,88 +0,0 @@
-#!/usr/bin/env node
-// Track canonical instruction files individually and skills as a group.
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
-import { dirname, join, relative, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const defaultRoot = fileURLToPath(new URL('..', import.meta.url));
-const argv = process.argv.slice(2);
-function option(name, fallback) {
-  const i = argv.indexOf(name);
-  return i >= 0 ? argv[i + 1] : fallback;
-}
-const root = resolve(option('--root', defaultRoot));
-const baselinePath = resolve(option('--baseline', join(root, 'tests', 'instruction-size-baseline.json')));
-const write = argv.includes('--write');
-const ratchetLimit = 855_000;
-
-function lfBytes(text) {
-  return Buffer.byteLength(text.replace(/\r\n/g, '\n'));
-}
-
-function markdownFiles(dir) {
-  if (!existsSync(dir)) return [];
-  const files = [];
-  for (const entry of readdirSync(dir, { withFileTypes: true })) {
-    const file = join(dir, entry.name);
-    if (entry.isDirectory()) files.push(...markdownFiles(file));
-    else if (entry.isFile() && entry.name.endsWith('.md')) files.push(file);
-  }
-  return files;
-}
-
-function collect(roots) {
-  const out = {};
-  for (const file of roots.flatMap(markdownFiles)) {
-    out[relative(root, file)] = lfBytes(readFileSync(file, 'utf8'));
-  }
-  return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a.localeCompare(b)));
-}
-
-const skillRoot = join(root, 'pack', '.claude', 'skills');
-const files = collect([
-  skillRoot,
-  join(root, 'pack', '.claude', 'agents'),
-  join(root, 'pack', '.claude', 'rules'),
-]);
-const skillFiles = collect([skillRoot]);
-const totalBytes = Object.values(skillFiles).reduce((sum, bytes) => sum + bytes, 0);
-const current = { version: 2, total_bytes: totalBytes, files };
-if (totalBytes > ratchetLimit) {
-  console.error(`FAIL: canonical skill Markdown is ${totalBytes} bytes (ratchet ${ratchetLimit})`);
-  process.exit(1);
-}
-if (write) {
-  mkdirSync(dirname(baselinePath), { recursive: true });
-  writeFileSync(baselinePath, JSON.stringify(current, null, 2) + '\n');
-  console.log(
-    `instruction-size: wrote ${relative(root, baselinePath)} (${Object.keys(files).length} instruction files, ${totalBytes} skill bytes)`,
-  );
-  process.exit(0);
-}
-
-if (!existsSync(baselinePath)) {
-  console.error(`FAIL: missing ${relative(root, baselinePath)}; run node scripts/check-instruction-size-baseline.mjs --write`);
-  process.exit(1);
-}
-const baseline = JSON.parse(readFileSync(baselinePath, 'utf8'));
-if (baseline.version !== 2 || !baseline.files || !Number.isInteger(baseline.total_bytes)) {
-  console.error(`FAIL: ${relative(root, baselinePath)} uses an obsolete schema; regenerate it with --write`);
-  process.exit(1);
-}
-let failures = 0;
-function fail(msg) {
-  console.error(`FAIL: ${msg}`);
-  failures++;
-}
-for (const file of Object.keys(files)) {
-  if (!(file in baseline.files)) fail(`${file} missing from baseline (${files[file]} bytes)`);
-  else if (files[file] > baseline.files[file]) fail(`${file} grew by ${files[file] - baseline.files[file]} bytes (${baseline.files[file]} -> ${files[file]})`);
-}
-for (const file of Object.keys(baseline.files)) {
-  if (!(file in files)) fail(`${file} in baseline but file is gone`);
-}
-if (totalBytes > baseline.total_bytes) {
-  fail(`aggregate instruction payload grew by ${totalBytes - baseline.total_bytes} bytes (${baseline.total_bytes} -> ${totalBytes})`);
-}
-console.log(`instruction-size: ${Object.keys(files).length} instruction files checked, ${totalBytes} skill bytes`);
-process.exit(failures ? 1 : 0);

package/scripts/check-invocation-integrity.py

@@ -1,115 +0,0 @@
-#!/usr/bin/env python3
-"""Invocation-integrity gate: every skill/rule an agent or skill NAMES must resolve, both harnesses.
-
-`check-cross-refs.py` validates markdown links. This validates the thing it can't: a **bare
-skill-name invocation** (`$devrites-frontend-craft`, `Skill(devrites-source-driven)`, "invoke the
-`devrites-api-interface` skill") and a **rule read** (`.claude/skills/devrites-lib/reference/standards/security.md`) must each point
-at something that exists (on Claude Code AND on the Codex-translated tree) or the agent
-calls into the void at runtime. Also asserts the Claude→Codex skill/rule mirror is complete.
-
-Self-contained: installs DevRites into a temp dir to get the Codex tree, sweeps, cleans up.
-Run: python3 scripts/check-invocation-integrity.py    (exit 0 clean, 1 on any unresolved reference)
-"""
-import os, re, sys, glob, subprocess, tempfile, shutil
-
-REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-PACK = os.path.join(REPO, "pack/.claude")
-
-# devrites-* tokens that are scripts/hooks/mcp, not skills: legitimate non-skill references.
-NONSKILL = {
-    "devrites-mcp", "devrites-lib", "devrites-reviewer-readonly", "devrites-wright-scope",
-    "devrites-a1-guard", "devrites-allow", "devrites-redwatch", "devrites-orient",
-    "devrites-statusline", "devrites-stop-gate", "devrites-cursor", "devrites-refresh-indexes",
-    "devrites-source-cache", "devrites-source-cache-pre", "devrites-source-cache-post",
-    "devrites-subagent-orient", "devrites-detect", "devrites-prose-craft-report",
-    # the control-plane binary, invoked by name in skill/agent prose ("devrites-engine seal")
-    "devrites-engine",
-    # a git commit-trailer marker ("[devrites-context]" body in a WIP checkpoint), not a skill
-    "devrites-context",
-    # typed contract schemas and a generated-hook diagnostic marker, not skills
-    "devrites-forge", "devrites-git-authority", "devrites-codex-leaf-guard",
-}
-# names a skill deliberately mentions as NON-existent (self-documenting prose).
-DOCUMENTED_NONEXISTENT = {"rite-use"}
-
-SKILL_TOK = re.compile(r"\$?\b(devrites-[a-z0-9-]+|rite-[a-z0-9-]+)\b")
-RULE_REF = re.compile(r"(?:\.claude/skills/devrites-lib/reference/standards|\.agents/skills/devrites-lib/reference/standards)/([a-z0-9-]+)\.md")
-CODEX_SLASH_RITE = re.compile(r"(^|[^A-Za-z0-9_./-])/(rite(?:-[a-z0-9-]+)?)([^A-Za-z0-9_-]|$)")
-
-
-def names(pattern, strip):
-    return {os.path.basename(p)[:-strip] if strip else os.path.basename(p) for p in glob.glob(pattern)}
-
-
-def scan(path, valid_names, valid_rules, problems):
-    try:
-        txt = open(path, encoding="utf-8").read()
-    except Exception:
-        return
-    for name in set(SKILL_TOK.findall(txt)):
-        if name in valid_names or name in NONSKILL or name in DOCUMENTED_NONEXISTENT:
-            continue
-        problems.append(f"{os.path.relpath(path, REPO)}: unresolved skill/agent name '{name}'")
-    for r in set(RULE_REF.findall(txt)):
-        if r not in valid_rules:
-            problems.append(f"{os.path.relpath(path, REPO)}: rule ref '{r}.md' not present")
-
-
-def scan_codex_sigils(path, problems):
-    try:
-        txt = open(path, encoding="utf-8").read()
-    except Exception:
-        return
-    for lineno, line in enumerate(txt.splitlines(), 1):
-        if CODEX_SLASH_RITE.search(line):
-            problems.append(f"{os.path.relpath(path, REPO)}:{lineno}: Codex mirror uses /rite invocation; use $rite")
-
-
-def main():
-    target = tempfile.mkdtemp()
-    try:
-        env = os.environ.copy()
-        env["DEVRITES_NO_BINARY"] = "1"
-        r = subprocess.run(["bash", os.path.join(REPO, "install.sh"), "--target", target, "--no-binary"],
-                           capture_output=True, text=True, env=env)
-        if r.returncode != 0:
-            print("FAIL: install failed\n" + r.stderr[-2000:]); return 1
-
-        claude_skills = names(f"{PACK}/skills/*", 0)
-        claude_rules = names(f"{PACK}/skills/devrites-lib/reference/standards/*.md", 3)
-        claude_agents = names(f"{PACK}/agents/*.md", 3)
-        codex_skills = names(f"{target}/.agents/skills/*", 0)
-        codex_rules = names(f"{target}/.agents/skills/devrites-lib/reference/standards/*.md", 3)
-        codex_agents = names(f"{target}/.codex/agents/*.toml", 5)
-
-        problems, mirror = [], []
-        if claude_skills != codex_skills:
-            mirror.append(f"skills not mirrored: {sorted(claude_skills ^ codex_skills)}")
-        if claude_rules != codex_rules:
-            mirror.append(f"rules not mirrored: {sorted(claude_rules ^ codex_rules)}")
-
-        # Claude side
-        for f in glob.glob(f"{PACK}/agents/*.md") + glob.glob(f"{PACK}/skills/**/*.md", recursive=True):
-            scan(f, claude_skills | claude_agents, claude_rules, problems)
-        # Codex side
-        for f in glob.glob(f"{target}/.codex/agents/*.toml") + glob.glob(f"{target}/.agents/skills/**/SKILL.md", recursive=True):
-            scan(f, codex_skills | codex_agents, codex_rules, problems)
-            scan_codex_sigils(f, problems)
-
-        print(f"invocation-integrity: {len(claude_skills)} skills / {len(claude_rules)} rules / "
-              f"{len(claude_agents)} agents, mirrored to Codex; scanned agents + skills, both harnesses.")
-        for m in mirror:
-            print("  MIRROR: " + m)
-        for p in sorted(set(problems)):
-            print("  DEAD: " + p)
-        if problems or mirror:
-            print("INVOCATION-INTEGRITY: FAIL")
-            return 1
-        print("INVOCATION-INTEGRITY: PASS: every named skill/rule resolves on both harnesses.")
-        return 0
-    finally:
-        shutil.rmtree(target, ignore_errors=True)
-
-
-if __name__ == "__main__":
-    sys.exit(main())

package/scripts/check-no-global-writes.sh

@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-# check-no-global-writes.sh: static guard that the installer/uninstaller never
-# writes to the user's global ~/.claude or ~/.codex, and that the global guard is present.
-# Exits non-zero on violation.
-
-set -u
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-fail=0
-
-SCRIPTS="$ROOT/install.sh $ROOT/uninstall.sh"
-for f in "$ROOT"/scripts/*.sh; do SCRIPTS="$SCRIPTS $f"; done
-
-# 1) the no-global guard marker must exist in install.sh
-if ! grep -q 'GUARD:no-global' "$ROOT/install.sh"; then
-  echo "FAIL: install.sh is missing the GUARD:no-global guard"
-  fail=1
-else
-  echo "ok: install.sh contains the no-global guard"
-fi
-
-# 2) no write operation may target ~/.claude, ~/.codex, or their $HOME forms.
-#    Write verbs are actual file-writing commands / redirections. ('install' is
-#    intentionally excluded: the installer uses cp/mkdir, and "install" appears in
-#    prose like "install into a project", which is not a write.)
-WRITE_RE='(\bmkdir\b|\bcp\b|\btee\b|\brsync\b|\bmv\b|\bln\b|>>?)'
-GLOBAL_RE='(\$HOME/\.(claude|codex)|~/\.(claude|codex))'
-for f in $SCRIPTS; do
-  [ -f "$f" ] || continue
-  # lines that contain a global-claude path AND a write verb, excluding comments
-  hits="$(grep -nE "$GLOBAL_RE" "$f" | grep -vE '^\s*[0-9]+:\s*#' | grep -E "$WRITE_RE" || true)"
-  if [ -n "$hits" ]; then
-    echo "FAIL: possible global write in ${f#$ROOT/}:"
-    printf '%s\n' "$hits" | sed 's/^/    /'
-    fail=1
-  fi
-done
-[ "$fail" -eq 0 ] && echo "ok: no write operations target global agent homes"
-
-# 3) no write operation may target a system bin directory EXCEPT the one sanctioned
-#    engine-binary path (the devrites-engine control-plane binary; issue 10). Anything else
-#    writing to /usr/bin, /usr/local/bin, /bin, /sbin, or ~/.local/bin is a global
-#    write the installer must not do. The carve-out is exactly a `devrites-engine` (or
-#    `devrites.exe`) leaf under /usr/local/bin or ~/.local/bin: never /usr/bin.
-BIN_RE='((\$HOME|~)/\.local/bin|/usr/local/bin|/usr/bin|/bin|/sbin)'
-# Sanctioned: the write's bin path ends in .../devrites-engine (optionally .exe) and sits
-# under /usr/local/bin or ~/.local/bin. The trailing boundary keeps `devrites-lib`
-# or `devritesX` from sneaking through.
-SANCTIONED_RE='((\$HOME|~)/\.local/bin|/usr/local/bin)/devrites-engine(\.exe)?([^A-Za-z0-9._-]|$)'
-for f in $SCRIPTS; do
-  [ -f "$f" ] || continue
-  hits="$(grep -nE "$BIN_RE" "$f" | grep -vE '^\s*[0-9]+:\s*#' | grep -E "$WRITE_RE" \
-    | grep -vE "$SANCTIONED_RE" || true)"
-  if [ -n "$hits" ]; then
-    echo "FAIL: possible global bin write in ${f#$ROOT/} (only /usr/local/bin/devrites-engine or ~/.local/bin/devrites-engine is sanctioned):"
-    printf '%s\n' "$hits" | sed 's/^/    /'
-    fail=1
-  fi
-done
-[ "$fail" -eq 0 ] && echo "ok: no write operations target system bin dirs (except the sanctioned devrites-engine binary)"
-
-if [ "$fail" -eq 0 ]; then
-  echo "PASS: no global-write risks detected"
-else
-  echo "FAILED: global-write check"
-fi
-exit "$fail"

package/scripts/check-no-personal-paths.py

@@ -1,50 +0,0 @@
-#!/usr/bin/env python3
-"""Fail if shipped DevRites artifacts contain maintainer-local absolute paths."""
-import os
-import re
-import sys
-
-ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
-TARGETS = ["README.md", "docs", "pack", "scripts", "install.sh", "update.sh", "uninstall.sh", "package.json"]
-PATTERNS = [
-    re.compile(r"/Users/(?!runner|homebrew|shared/)[A-Za-z0-9._-]+"),
-    re.compile(r"/home/(?!runner|circleci|github|vscode|node)[A-Za-z0-9._-]+"),
-    re.compile(r"C:\\\\Users\\\\(?!runner|Public)[A-Za-z0-9._-]+", re.I),
-]
-TEXT_EXTS = {"", ".md", ".sh", ".py", ".js", ".mjs", ".json", ".yaml", ".yml", ".toml", ".txt"}
-ALLOW = {"scripts/check-no-personal-paths.py"}
-
-findings = []
-for target in TARGETS:
-    path = os.path.join(ROOT, target)
-    if not os.path.exists(path):
-        continue
-    files = []
-    if os.path.isdir(path):
-        for base, dirs, names in os.walk(path):
-            dirs[:] = [d for d in dirs if d not in {"node_modules", ".git", "__pycache__"}]
-            files += [os.path.join(base, n) for n in names]
-    else:
-        files = [path]
-    for file in files:
-        rel = os.path.relpath(file, ROOT)
-        if rel in ALLOW:
-            continue
-        if os.path.splitext(file)[1].lower() not in TEXT_EXTS:
-            continue
-        try:
-            text = open(file, encoding="utf-8").read()
-        except (OSError, UnicodeDecodeError):
-            continue
-        for lineno, line in enumerate(text.splitlines(), 1):
-            if "no-personal-paths-ignore" in line:
-                continue
-            for rx in PATTERNS:
-                if rx.search(line):
-                    findings.append(f"{rel}:{lineno}: {line.strip()[:140]}")
-
-if findings:
-    print("personal-path findings:")
-    print("\n".join(findings))
-    sys.exit(1)
-print("no-personal-paths: PASS")

package/scripts/check-npm-audit.mjs

@@ -1,110 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const args = process.argv.slice(2);
-const option = (name, fallback) => {
-  const index = args.indexOf(name);
-  return index >= 0 ? args[index + 1] : fallback;
-};
-const input = option('--input', '');
-const exceptionsPath = resolve(option('--exceptions', resolve(root, 'scripts', 'npm-audit-exceptions.json')));
-const blocking = new Set(['moderate', 'high', 'critical']);
-const failures = [];
-const fail = (message) => failures.push(message);
-const load = (path) => JSON.parse(readFileSync(path, 'utf8'));
-
-let report;
-if (input) {
-  report = load(resolve(input));
-} else {
-  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-  const result = spawnSync(npm, ['audit', '--json'], { cwd: root, encoding: 'utf8' });
-  if (result.error || ![0, 1].includes(result.status)) {
-    console.error(result.stderr || result.error?.message || `npm audit exited ${result.status}`);
-    process.exit(1);
-  }
-  try {
-    report = JSON.parse(result.stdout);
-  } catch {
-    console.error('FAIL: npm audit did not return valid JSON');
-    process.exit(1);
-  }
-}
-
-const concrete = new Map();
-let affected = 0;
-for (const [packageName, vulnerability] of Object.entries(report.vulnerabilities || {})) {
-  if (!blocking.has(vulnerability.severity)) continue;
-  affected++;
-  for (const via of vulnerability.via || []) {
-    if (!via || typeof via !== 'object' || !blocking.has(via.severity)) continue;
-    const id = via.url?.match(/GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}/i)?.[0];
-    if (!id) {
-      fail(`${packageName}: blocking advisory has no GHSA identifier`);
-      continue;
-    }
-    const finding = concrete.get(id) || {
-      id,
-      package: via.name || packageName,
-      range: via.range || vulnerability.range,
-      source: via.url,
-      nodes: [],
-    };
-    finding.nodes = [...new Set([...finding.nodes, ...(vulnerability.nodes || [])])].sort();
-    concrete.set(id, finding);
-  }
-}
-if (affected > 0 && concrete.size === 0) fail('blocking audit findings have no concrete advisory records');
-
-const exceptions = load(exceptionsPath);
-if (!Array.isArray(exceptions)) fail('npm audit exceptions must be a JSON array');
-const today = new Date().toISOString().slice(0, 10);
-const seen = new Set();
-for (const exception of Array.isArray(exceptions) ? exceptions : []) {
-  const required = ['id', 'package', 'range', 'source', 'owner', 'reason', 'expires'];
-  const missing = required.filter((field) => !exception?.[field]);
-  if (!Array.isArray(exception?.nodes) || exception.nodes.length === 0) missing.push('nodes');
-  if (missing.length) {
-    fail(`${exception?.id || 'unknown exception'}: missing ${missing.join(', ')}`);
-    continue;
-  }
-  if (!/^GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}$/i.test(exception.id) || !/^\d{4}-\d{2}-\d{2}$/.test(exception.expires)) {
-    fail(`${exception.id}: invalid id or expiry`);
-    continue;
-  }
-  if (seen.has(exception.id)) fail(`${exception.id}: duplicate exception`);
-  seen.add(exception.id);
-  if (exception.expires < today) fail(`${exception.id}: exception expired ${exception.expires}`);
-
-  const finding = concrete.get(exception.id);
-  if (!finding) {
-    fail(`${exception.id}: exception is stale; advisory is absent`);
-    continue;
-  }
-  for (const field of ['package', 'range', 'source']) {
-    if (exception[field] !== finding[field]) {
-      fail(`${exception.id}: ${field} mismatch (expected ${finding[field]})`);
-    }
-  }
-  if (JSON.stringify([...exception.nodes].sort()) !== JSON.stringify(finding.nodes)) {
-    fail(`${exception.id}: nodes mismatch (expected ${finding.nodes.join(', ')})`);
-  }
-}
-for (const finding of concrete.values()) {
-  if (!seen.has(finding.id)) fail(`${finding.id}: blocking advisory is not excepted`);
-}
-
-for (const message of failures) console.error(`FAIL: ${message}`);
-if (failures.length) process.exit(1);
-if (affected === 0) {
-  console.log('npm-audit: no moderate-or-higher advisories');
-} else {
-  for (const exception of exceptions) {
-    console.log(`npm-audit: temporary ${exception.id} exception owned by ${exception.owner}, expires ${exception.expires}`);
-  }
-  console.log(`npm-audit: ${concrete.size} exact temporary exception(s), ${affected} affected package record(s)`);
-}