forgedock 1.29.1 → 1.31.0

package/scripts/symbol-index.mjs

@@ -8,13 +8,17 @@
 // run prints only {"unsupported":"ts"|"js","reason":"no-parser"} and exits 0.
 // .py targets are handed to symbol-index.py. Never emits source text or literal values.
 //
-// Usage: node scripts/symbol-index.mjs <file | dir>...
+// Usage: node scripts/symbol-index.mjs [--shape] <file | dir>...
 // Output: {"symbols":[{name,kind,start,end,lines,public[,file]}], "edges":[{from,to}],
 //          "imports":[{module,names,line[,file]}], "cycles":[[module,...],...]}
 //   kind: function|async_function|class|method|const|interface|type|enum. public = exported (methods: exported class
 //   and not private/#private). One file: bare names; otherwise `file` on entries and "<module>:<symbol>" edge ends,
 //   module = path relative to its root without extension (index files name their directory). cycles = strongly
 //   connected components of the relative-import graph between indexed modules (`import type` ignored).
+//   --shape (forge#4449, bin/lean/apishape.mjs): functions, methods/accessors/constructors and consts initialised with
+//   an arrow or function expression also carry async, generator (`function*`) and sig: the normalized parameter list
+//   (`...` rest, name, `?` optional, `: <type text>`, `=` for a default but never its value) plus " -> <return type>".
+//   Kinds are unchanged; without --shape the output is unchanged. --shape is forwarded to symbol-index.py.
 // Exit: 0 ok or unsupported | 2 usage or missing path.
 
 import { spawnSync } from "node:child_process";
@@ -94,7 +98,18 @@ function tarjan(graph) {
   return comps;
 }
 
-function index(ts, entries, multi) {
+function fnShape(ts, fn, src) {
+  const K = ts.SyntaxKind;
+  const params = fn.parameters.map((p) => `${p.dotDotDotToken ? "..." : ""}${p.name.getText(src)}${p.questionToken ? "?" : ""}`
+    + `${p.type ? `: ${p.type.getText(src)}` : ""}${p.initializer ? "=" : ""}`);
+  return {
+    async: (ts.getModifiers?.(fn) ?? fn.modifiers ?? []).some((m) => m.kind === K.AsyncKeyword),
+    generator: !!fn.asteriskToken,
+    sig: `(${params.join(", ")})${fn.type ? ` -> ${fn.type.getText(src)}` : ""}`,
+  };
+}
+
+function index(ts, entries, multi, shape = false) {
   const K = ts.SyntaxKind;
   const byFile = new Map(entries.map((e) => [path.resolve(e.file), e]));
   const symbols = [], imports = [], edges = new Set(), graph = new Map(entries.map((e) => [e.module, new Set()]));
@@ -114,7 +129,9 @@ function index(ts, entries, multi) {
     tables.set(e.module, table);
     const add = (name, kind, node, pub, owner = null) => {
       const start = line(src, node.getStart(src)), end = line(src, node.getEnd());
-      symbols.push({ name, kind, start, end, lines: end - start + 1, public: !!pub, ...(multi ? { file: e.file } : {}) });
+      const fn = !shape ? null : ts.isFunctionLike(node) ? node
+        : ts.isVariableDeclaration(node) && node.initializer && (ts.isArrowFunction(node.initializer) || ts.isFunctionExpression(node.initializer)) ? node.initializer : null;
+      symbols.push({ name, kind, start, end, lines: end - start + 1, public: !!pub, ...(multi ? { file: e.file } : {}), ...(fn ? fnShape(ts, fn, src) : {}) });
       table.set(name, { node, owner });
     };
     const exportNames = new Set();
@@ -218,9 +235,11 @@ function index(ts, entries, multi) {
   };
 }
 
-function main(argv) {
+function main(args) {
+  const shape = args.includes("--shape");
+  const argv = args.filter((a) => a !== "--shape");
   if (!argv.length || argv[0] === "-h" || argv[0] === "--help") {
-    process.stderr.write("usage: symbol-index.mjs <file | dir>...\n");
+    process.stderr.write("usage: symbol-index.mjs [--shape] <file | dir>...\n");
     return 2;
   }
   for (const p of argv) if (!existsSync(p)) { process.stderr.write(`symbol-index: no such path: ${p}\n`); return 2; }
@@ -229,7 +248,7 @@ function main(argv) {
   if (exts.includes(".py")) {
     if (exts.some((x) => x !== ".py")) return emit({ unsupported: "mixed", reason: "mixed-languages" }), 0;
     const py = path.join(path.dirname(fileURLToPath(import.meta.url)), "symbol-index.py");
-    const r = spawnSync("python3", [py, ...argv], { stdio: "inherit" });
+    const r = spawnSync("python3", [py, ...(shape ? ["--shape"] : []), ...argv], { stdio: "inherit" });
     if (r.error) return emit({ unsupported: "python", reason: "no-python3" }), 0;
     return r.status ?? 2;
   }
@@ -242,7 +261,7 @@ function main(argv) {
   if (!ts) return emit({ unsupported: lang, reason: "no-parser" }), 0;
   const multi = !(argv.length === 1 && files.length === 1);
   let out;
-  try { out = index(ts, entries, multi); } catch (err) {
+  try { out = index(ts, entries, multi, shape); } catch (err) {
     if (err && err.reason) return emit({ unsupported: err.lang, reason: err.reason }), 0;
     throw err;
   }

package/scripts/symbol-index.py

@@ -5,13 +5,16 @@
 # symbol-index.py: deterministic Python symbol index + module import-cycle detector for refactor:split (forge#4208).
 # stdlib only (ast). No LLM, no network. Never emits source text, docstrings or literal values.
 #
-# Usage: python3 scripts/symbol-index.py <file.py | dir>...
+# Usage: python3 scripts/symbol-index.py [--shape] <file.py | dir>...
 # Output (stdout, one JSON object):
 #   {"symbols":[{name,kind,start,end,lines,public[,file]}], "edges":[{from,to}],
 #    "imports":[{module,names,line[,file]}], "cycles":[[module,...],...]}
 #   kind: function|async_function|class|method|const. Methods (and nested classes) are named Class.method.
 #   start includes decorators; lines = end - start + 1. public = no leading underscore (method dunders count as
 #   public), and listed in a static __all__ when the module defines one.
+#   --shape (forge#4449, bin/lean/apishape.mjs): function/async_function/method entries also carry async (bool),
+#   generator (yield in the def's own scope) and sig: the normalized parameter list (kinds, names, annotation text,
+#   "=" for a default but never its value) plus " -> <return annotation>". Without --shape the output is unchanged.
 #   One .py file: names are bare. Otherwise (a directory or several files) each entry carries `file` and edge ends
 #   are "<module>:<symbol>"; module names are dotted paths relative to each root (a root that has __init__.py is
 #   itself the top package, so root .../pkg yields pkg.a). edges = references from one indexed symbol to another.
@@ -108,9 +111,47 @@ def module_imports(body):
     return out
 
 
+def is_generator(fn):
+    """True when yield / yield from occurs in fn's own scope (not in nested defs, lambdas or classes)."""
+    work = list(ast.iter_child_nodes(fn))
+    while work:
+        n = work.pop()
+        if isinstance(n, (ast.Yield, ast.YieldFrom)):
+            return True
+        if not isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda, ast.ClassDef)):
+            work.extend(ast.iter_child_nodes(n))
+    return False
+
+
+def signature(fn):
+    """Normalized parameter list of a def: names, kinds, annotation text, '=' for a default (never its value)."""
+    a = fn.args
+
+    def one(arg, default=False, prefix=""):
+        out = prefix + arg.arg
+        if arg.annotation is not None:
+            out += ": " + ast.unparse(arg.annotation)
+        return out + ("=" if default else "")
+
+    positional = a.posonlyargs + a.args
+    first_default = len(positional) - len(a.defaults)
+    parts = [one(x, i >= first_default) for i, x in enumerate(positional)]
+    if a.posonlyargs:
+        parts.insert(len(a.posonlyargs), "/")
+    if a.vararg is not None:
+        parts.append(one(a.vararg, prefix="*"))
+    elif a.kwonlyargs:
+        parts.append("*")
+    parts += [one(x, d is not None) for x, d in zip(a.kwonlyargs, a.kw_defaults)]
+    if a.kwarg is not None:
+        parts.append(one(a.kwarg, prefix="**"))
+    sig = "(" + ", ".join(parts) + ")"
+    return sig + (" -> " + ast.unparse(fn.returns) if fn.returns is not None else "")
+
+
 class Module:
-    def __init__(self, path, name, is_pkg):
-        self.path, self.name, self.is_pkg = path, name, is_pkg
+    def __init__(self, path, name, is_pkg, shape=False):
+        self.path, self.name, self.is_pkg, self.shape = path, name, is_pkg, shape
         self.symbols = []      # dicts without file
         self.nodes = {}        # symbol name -> (ast node, owning class name or None)
         self.imports = []      # (ast import node)
@@ -131,8 +172,11 @@ class Module:
 
         def add(name, kind, node, public, owner=None):
             start, end = def_start(node), node.end_lineno or node.lineno
-            self.symbols.append({"name": name, "kind": kind, "start": start, "end": end,
-                                 "lines": end - start + 1, "public": public})
+            sym = {"name": name, "kind": kind, "start": start, "end": end, "lines": end - start + 1, "public": public}
+            if self.shape and isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                sym.update({"async": isinstance(node, ast.AsyncFunctionDef), "generator": is_generator(node),
+                            "sig": signature(node)})
+            self.symbols.append(sym)
             self.nodes[name] = (node, owner)
 
         def add_class(node, prefix, public):
@@ -241,12 +285,12 @@ def tarjan(graph):
     return comps
 
 
-def build(paths):
+def build(paths, shape=False):
     entries = walk_roots(paths)
     multi = not (len(entries) == 1 and os.path.isfile(paths[0]) and len(paths) == 1)
     modules, by_name = [], {}
     for path, name, is_pkg in entries:
-        m = Module(path, name, is_pkg)
+        m = Module(path, name, is_pkg, shape)
         m.parse()
         modules.append(m)
         by_name.setdefault(name, m)
@@ -335,15 +379,17 @@ def build(paths):
 
 
 def main(argv):
+    shape = "--shape" in argv
+    argv = [a for a in argv if a != "--shape"]
     if not argv or argv[0] in ("-h", "--help"):
-        sys.stderr.write("usage: symbol-index.py <file.py | dir>...\n")
+        sys.stderr.write("usage: symbol-index.py [--shape] <file.py | dir>...\n")
         return 2
     for p in argv:
         if not os.path.exists(p):
             sys.stderr.write("symbol-index: no such path: %s\n" % p)
             return 2
     try:
-        out = build(argv)
+        out = build(argv, shape)
     except Unsupported as u:
         out = {"unsupported": u.lang, "reason": u.reason}
     sys.stdout.write(json.dumps(out, sort_keys=True, separators=(",", ":")) + "\n")

package/scripts/test-map.sh

@@ -27,6 +27,12 @@
 #     substitution, `${{ }}`, `$GITHUB_*`, redirect or `<(...)`/`>(...)`, a non-check make target, or a fixer form
 #     (`--fix`, `--write`, `-w`, `black`/`ruff format`/`gofmt`/`prettier` without their check flag) drops the step (forge#4316). Globs from the tool (python/go/shell/js, under the cwd), else the
 #     workflow's `paths:` filter, else `DIR/**` for a cwd; a workflow entry never gets a bare `**`.
+#     forge#4318: also dropped: any quote, fixer/snapshot flag families (`--fix-only`, `--add-noqa`, `--write=*`, `--w`,
+#     `--update*`, `--updateSnapshot`, `--snapshot-update`, `-u` on jest/vitest/package managers), write targets (`go -o`,
+#     `-exec`, `-toolexec`, `tsc --outDir/--outFile`, `pytest --junitxml/--basetemp/--html`, any absolute or `..` path) and
+#     tox/nox `dist`/`pypi`/`twine` envs in any spelling; `-w` is a workspace on npm/pnpm. Also mapped: `uv run python -m X`,
+#     `python3.N -m X`, `npx --yes X`, `pnpm --filter X`, `npm -w PKG`, `make -C DIR` (DIR becomes the cwd), `cargo +TC <sub>`,
+#     `cargo fmt --check`, gradle `--tests X` / maven `-pl X`, `./x.test.sh`, `bash -x x.test.sh`. `clean` goals stay unmapped.
 # Exit: 0 ok | 2 usage or bad repo path. bash 3.2 portable.
 set -uo pipefail
 
@@ -207,6 +213,8 @@ check_cmd() {
   esac
   c=${c%" && popd"}
   case "$c" in *';'*|*'|'*|*'&'*) return 1 ;; esac
+  # forge#4318: a quoted word hides a flag from the word checks below ("--fix"); a real check never needs quotes
+  case "$c" in *\"*|*\'*) return 1 ;; esac
   CK_CMD=$c
   set -f
   # shellcheck disable=SC2086 # split into words on purpose; set -f stops glob expansion
@@ -214,11 +222,24 @@ check_cmd() {
   set +f
   while [ $# -gt 0 ]; do case "$1" in [A-Za-z_]*=*) shift ;; *) break ;; esac; done
   case "${1:-} ${2:-}" in
-    "uv run"|"poetry run"|"pnpm exec"|"yarn exec"|"python -m"|"python3 -m"|"bundle exec") shift 2 ;;
-    "npx "*|"bunx "*) shift ;;
+    "uv run"|"poetry run") shift 2; case "${1:-} ${2:-}" in "python -m"|"python3 -m") shift 2 ;; esac ;; # forge#4318: uv run python -m X
+    "pnpm exec"|"yarn exec"|"python -m"|"python3 -m"|"bundle exec") shift 2 ;;
+    "python3."[0-9]" -m"|"python3."[0-9][0-9]" -m") shift 2 ;; # forge#4318: a versioned interpreter
+    "npx "*|"bunx "*) shift; case "${1:-}" in --yes|-y) shift ;; esac ;;
   esac
-  # forge#4316: a fixer rewrites the tree; only its read-only check form is a check
-  for w in "$@"; do case "$w" in --fix|--fix=*|--write|-w) return 1 ;; esac; done
+  tool=${1:-}
+  # forge#4316/#4318: a fixer, snapshot updater or write-target flag rewrites the tree or writes outside it; matched as a
+  # flag family (`--fix-only`, `--write=true`, `--w`), and `-w` only off a package manager (there it names a workspace)
+  for w in "$@"; do
+    case "$w" in
+      --fix|--fix[=-]*|--add-noqa*|--unsafe-fixes*|--write|--write[=-]*|--update|--update[=-]*|--updateSnapshot*|--snapshot-update*) return 1 ;;
+      --outDir*|--outdir*|--out-dir*|--outFile*|--declarationDir*|--tsBuildInfoFile*|--junitxml*|--junit-xml*|--basetemp*|--html*|-exec|-exec=*|-toolexec*) return 1 ;;
+      /*|*=/*|..|../*|*/..|*/../*|*=..|*=../*) return 1 ;; # an absolute or parent path is outside the checkout
+      -w|-w=*|--w|--w=*) case "$tool" in npm|pnpm|yarn|bun) ;; *) return 1 ;; esac ;;
+      -u) case "$tool" in jest|vitest|npm|pnpm|yarn|bun) return 1 ;; esac ;;
+      -o|-o=*) [ "$tool" = go ] && return 1 ;;
+    esac
+  done
   case "${1:-} ${2:-}" in
     "black "*|"ruff format") has_word --check "$@" || return 1 ;;
     "gofmt "*) has_word -l "$@" || has_word -d "$@" || return 1 ;;
@@ -227,21 +248,26 @@ check_cmd() {
   case "${1:-}" in
     npm|pnpm|yarn|bun)
       pm=$1; shift
-      case "$pm ${1:-}" in # forge#4315: pnpm -r test, npm --prefix DIR test
-        "pnpm -r"|"pnpm --recursive") shift ;;
-        "npm --prefix") [ $# -ge 2 ] && safe_dir "$2" || return 1; shift 2 ;;
+      case "$pm ${1:-}" in # forge#4315: pnpm -r test, npm --prefix DIR test; forge#4318: npm -w PKG, pnpm -w, pnpm --filter X
+        "pnpm -r"|"pnpm --recursive"|"pnpm -w"|"pnpm --workspace-root") shift ;;
+        "npm --prefix"|"npm -w"|"npm --workspace") [ $# -ge 2 ] && safe_dir "$2" || return 1; shift 2 ;;
+        "pnpm --filter"|"pnpm -F") [ $# -ge 2 ] || return 1; case "$2" in *[!A-Za-z0-9@._/-]*) return 1 ;; esac; shift 2 ;;
       esac
       [ "${1:-}" = test ] && return 0
       [ "${1:-}" = run ] && pkg_check_script "${2:-}" && return 0
       case "$pm" in yarn|pnpm) pkg_check_script "${1:-}" && return 0 ;; esac
       return 1 ;;
-    cargo) case "${2:-}" in test|clippy|check) return 0 ;; esac; return 1 ;;
+    cargo)
+      a=${2:-}; [ "${a#+}" != "$a" ] && a=${3:-} # forge#4318: cargo +TOOLCHAIN <sub>
+      case "$a" in test|clippy|check) return 0 ;; fmt) has_word --check "$@"; return ;; esac; return 1 ;;
     ./gradlew|gradlew|gradle|./mvnw|mvnw|mvn)
-      # every non-flag word is a check task/goal (`:mod:test` qualified for gradle); publish/deploy/install never pass
+      # every non-flag word is a check task/goal (`:mod:test` qualified for gradle); publish/deploy/install/clean never pass;
+      # forge#4318: the value of --tests / -pl / --projects / -P / -D is not a goal
       case "$1" in *mvn*) goals="test|verify|validate" ;; *) goals="test|check|lint" ;; esac
-      shift; nt=0
+      shift; nt=0; skipv=""
       for w in "$@"; do
-        case "$w" in -*) continue ;; esac
+        if [ -n "$skipv" ]; then skipv=""; continue; fi
+        case "$w" in --tests|-pl|--projects|-P|-D) skipv=1; continue ;; -*) continue ;; esac
         t=${w##*:}
         case "|$goals|" in *"|$t|"*) [ -n "$t" ] && nt=$((nt+1)) ;; *) return 1 ;; esac
       done
@@ -249,19 +275,39 @@ check_cmd() {
     rspec|unittest) return 0 ;;
     python|python3) [ "${2:-}" = manage.py ] && [ "${3:-}" = test ]; return ;;
     tox|nox)
+      # forge#4318: `--env=X`, `-eX` and comma lists are split, case-folded, and packaging envs (dist, pypi) are publish too
       shift; prev=""
       for w in "$@"; do
-        case "$prev" in -e|-s|--env|--session|--sessions) case ",$w," in *publish*|*release*|*deploy*|*upload*) return 1 ;; esac ;; esac
-        case "$w" in -e*|-s*) case "${w#-?}" in *publish*|*release*|*deploy*|*upload*) return 1 ;; esac ;; esac
+        v=""
+        case "$prev" in -e|-s|--env|--session|--sessions) v=$w ;; esac
+        case "$w" in --env=*|--session=*|--sessions=*) v=${w#*=} ;; --*) ;; -e?*|-s?*) v=${w#-?} ;; esac
+        if [ -n "$v" ]; then
+          v=$(printf '%s' "$v" | tr '[:upper:]' '[:lower:]')
+          case ",$v," in *publish*|*release*|*deploy*|*upload*|*pypi*|*twine*|*,dist,*) return 1 ;; esac
+        fi
         prev=$w
       done
       return 0 ;;
     deno) [ "${2:-}" = test ]; return ;;
-    bash|sh) case "${2:-}" in *.test.sh) safe_dir "$2"; return ;; esac; return 1 ;;
+    bash|sh)
+      # forge#4318: shell option words (-x, -eu) before the script are allowed
+      shift; while [ $# -gt 0 ]; do case "$1" in -[a-z]*) shift ;; *) break ;; esac; done
+      case "${1:-}" in *.test.sh) safe_dir "$1"; return ;; esac; return 1 ;;
+    ./*.test.sh) safe_dir "${1#./}"; return ;;
     make)
       # forge#4316: every target must be a check (`make test deploy` is dropped); VAR=value and flags are not targets
-      shift; nt=0
-      for w in "$@"; do case "$w" in -*|*=*) continue ;; esac; make_check_target "$w" || return 1; nt=$((nt+1)); done
+      # forge#4318: `make -C DIR` runs in DIR: it becomes the entry cwd, not a target
+      shift; nt=0; prev=""; mdir=""
+      for w in "$@"; do
+        if [ "$prev" = -C ]; then mdir=$w; prev=$w; continue; fi
+        prev=$w
+        case "$w" in -*|*=*) continue ;; esac; make_check_target "$w" || return 1; nt=$((nt+1))
+      done
+      if [ -n "$mdir" ]; then
+        safe_dir "$mdir" || return 1
+        CK_CMD=${CK_CMD/ -C $mdir/}; mdir=${mdir%/}
+        if [ "$mdir" != . ]; then if [ "$CK_CWD" = . ]; then CK_CWD=$mdir; else CK_CWD="$CK_CWD/$mdir"; fi; fi
+      fi
       [ "$nt" -gt 0 ]; return ;;
     go) case "${2:-}" in test|vet|build) return 0 ;; esac; return 1 ;;
     node) [ "${2:-}" = --test ]; return ;;
@@ -280,7 +326,7 @@ tool_globs() {
     *\ deno\ *|*\ bun\ *|*\ bunx\ *) ext_globs . "$JS_EXT"; return ;;
     *[\ /]ruff\ *|*[\ /]flake8\ *|*[\ /]pylint\ *|*[\ /]mypy\ *|*[\ /]black\ *|*[\ /]pytest\ *) printf '**/*.py'; return ;;
     *[\ /]golangci-lint\ *|*[\ /]gofmt\ *|*[\ /]staticcheck\ *|*\ go\ *) printf '**/*.go'; return ;;
-    *[\ /]shellcheck\ *|*\ bash\ *.sh\ *|*\ sh\ *.sh\ *) printf '**/*.sh'; return ;;
+    *[\ /]shellcheck\ *|*\ bash\ *.sh\ *|*\ sh\ *.sh\ *|*.test.sh\ *) printf '**/*.sh'; return ;;
     *[\ /]eslint\ *|*[\ /]tsc\ *|*[\ /]prettier\ *|*[\ /]vitest\ *|*[\ /]jest\ *|*\ node\ --test*|*\ npm\ *|*\ pnpm\ *|*\ yarn\ *|*\ npx\ *) ext_globs . "$JS_EXT"; return ;;
   esac
   printf ''

package/scripts/test-map.test.sh

@@ -345,6 +345,61 @@ eslint .
 WF
 eq "unsafe forms dropped, check forms kept" "$(cmds)" "black --check .|eslint .|gofmt -l .|make test V=1|make test lint|prettier --check .|ruff format --check ."
 
+# ---- 5g. forge#4318: flag-family fixers, snapshot updaters, write targets, quotes and tox publish envs are dropped ----
+wf_case bypass <<'WF'
+cargo clippy --fix
+tox --env=publish
+tox --session=release
+tox -ePUBLISH
+tox -e dist,pypi
+nox -s Release
+eslint "--fix" .
+gofmt -l --w .
+gofmt -w=true .
+prettier --write=true .
+prettier -cw .
+ruff --fix-only .
+ruff check --add-noqa .
+jest -u
+jest --updateSnapshot
+vitest -u
+vitest --update
+pytest --snapshot-update
+npm test -- -u
+go build -o /tmp/x ./...
+go test -o out.test ./...
+go test -exec foo ./...
+tsc --outDir /tmp/out
+tsc --outFile out.js
+pytest --junitxml=/abs/x.xml
+pytest --basetemp=../t
+mvn clean test
+./gradlew clean test
+tox -e py311,lint
+pytest -q
+WF
+eq "bypass forms dropped" "$(cmds)" "pytest -q|tox -e py311,lint"
+
+# ---- 5h. forge#4318: workspace flags, versioned/wrapped runners, -C, toolchains and test scripts are mapped ----
+wf_case forms <<'WF'
+npm -w pkg test
+pnpm -w test
+uv run python -m pytest
+python3.12 -m pytest
+npx --yes vitest
+pnpm --filter web test
+make -C sub test
+mvn -pl mod test
+./gradlew test --tests Foo
+cargo +nightly test
+cargo fmt --check
+./x.test.sh
+bash -x x.test.sh
+WF
+eq "real forms mapped" "$(cmds)" "./gradlew test --tests Foo|./x.test.sh|bash -x x.test.sh|cargo +nightly test|cargo fmt --check|make test|mvn -pl mod test|npm -w pkg test|npx --yes vitest|pnpm --filter web test|pnpm -w test|python3.12 -m pytest|uv run python -m pytest"
+eq "make -C dir is the cwd" "$(printf '%s' "$OUTS" | jq -r '.entries[] | select(.command == "make test") | "\(.cwd) \(.globs | join(","))"')" "sub sub/**"
+eq "test script globs" "$(globs_of "./x.test.sh")" "**/*.sh"
+
 # ---- 6. usage ----
 bash "$S" --repo-path "$TMP/missing" >/dev/null 2>&1; eq "bad repo path" "$?" 2
 bash "$S" --nope >/dev/null 2>&1; eq "unknown option" "$?" 2

package/scripts/trusted-comments.test.sh

@@ -67,7 +67,7 @@ eq "trusted synthesis accepted" "$(printf '[%s]' "$(c NONE Bot b "$FAKE_SYN")" |
 eq "synthesis marker mid-body rejected" "$(printf '[%s]' "$(c NONE Bot b "intro${NL}${FAKE_SYN}")" | bash "$TC" count "$SYNTH_RE")" 0
 eq "synthesis for a different head rejected" "$(printf '[%s]' "$(c NONE Bot b "<!-- REVIEW-FINDINGS-SYNTHESIZED-START -->${NL}Reviewed-SHA: ${OTHER}")" | bash "$TC" count "$SYNTH_RE")" 0
 
-# Staging review spec (commands/review-pr-staging.md): same predicate, domains may carry digits/hyphens (bug-hunter-api)
+# Staging review (scripts/review-staging-post.sh delivery, formerly the commands/review-pr-staging.md fences): same predicate, domains may carry digits/hyphens (bug-hunter-api)
 STG_RE="^<!-- FORGE:REVIEW-AGENT:[a-z0-9-]+ -->[\\s\\S]*(^|\\n)Reviewed-SHA: ${SHA}(\\r?\\n|\$)"
 STG_DOM_RE="^<!-- FORGE:REVIEW-AGENT:bug-hunter-api -->[\\s\\S]*(^|\\n)Reviewed-SHA: ${SHA}(\\r?\\n|\$)"
 STG_TRUE="<!-- FORGE:REVIEW-AGENT:bug-hunter-api -->${NL}Reviewed-SHA: ${SHA}${NL}<!-- FINDING:real-2 -->"