mandrel-platform 1.4.2 → 1.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel-platform",
-  "version": "1.4.2",
+  "version": "1.5.1",
   "description": "Shared CI/deploy workflows, composite toolchain action, npm config package, Renovate preset, and operator runbook templates.",
   "license": "MIT",
   "repository": {
@@ -44,7 +44,7 @@
     "provenance": true
   },
   "dependencies": {
-    "mandrel": "^2.31.0"
+    "mandrel": "^2.38.0"
   },
   "scripts": {
     "typecheck": "node --input-type=module --eval 'process.exit(0)'",

package/scripts/apply-uptime-monitors.mjs

@@ -61,6 +61,8 @@
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
+import { isDirectInvocation } from './lib/entry-guard.mjs';
+
 // ---------------------------------------------------------------------------
 // Monitor config schema (pure validation — no I/O)
 // ---------------------------------------------------------------------------
@@ -436,7 +438,9 @@ async function main() {
   }
 }
 
-// Only run the CLI when invoked directly, not when imported by the self-test.
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Direct-invocation guard — symlink-safe via the shared seam (Story #407):
+// comparing an unresolved argv[1] against a realpath-resolved
+// import.meta.url silently never matches under pnpm's symlinked node_modules.
+if (isDirectInvocation(import.meta.url)) {
   main();
 }

package/scripts/check-affected-mode.test.mjs

@@ -7,7 +7,7 @@
  * `scripts/resolve-diff-range.sh` has solid unit coverage
  * (`resolve-diff-range.test.mjs`), but the affected-mode *wiring* inside the
  * reusable workflow was only covered indirectly by anchor-expansion checks.
- * This suite pins the three invariants that keep the affected-mode design
+ * This suite pins the four invariants that keep the affected-mode design
  * correct, modelled on the sibling `check-ci-required-aggregator.test.mjs`
  * (read the real workflow, extract blocks by indentation, assert):
  *
@@ -24,6 +24,12 @@
  *      `affected-base` override is rejected before the `$GITHUB_ENV` write, so
  *      it can never inject a second env line; a single-line override exports
  *      exactly `TURBO_SCM_BASE` / `TURBO_SCM_HEAD` and nothing else.
+ *   4. DOCUMENTED PRECONDITION (Story #413) — neither `.github/workflows/
+ *      pr-quality.yml` nor `docs/reusable-workflows.md` claims affected mode
+ *      can never miss a task (true only of an UNRESOLVABLE base), and both
+ *      give the conditional consumer shape `turbo run <tier>
+ *      ${TURBO_SCM_BASE:+--affected}` — the gate that stops a baked-in
+ *      `--affected` from scheduling zero tasks on a push-to-`main` run.
  *
  * The `run:` script is executed against real bash with a stubbed
  * `resolve-diff-range.sh` (the sourced derivation), so no git repo is needed;
@@ -180,3 +186,50 @@ test("single-line affected-base override exports exactly TURBO_SCM_BASE and TURB
   const nonEmpty = r.envLines.split("\n").filter((l) => l.trim() !== "");
   assert.equal(nonEmpty.length, 2, `expected exactly two env lines, got: ${JSON.stringify(nonEmpty)}`);
 });
+
+// ---------------------------------------------------------------------------
+// 4. DOCUMENTED PRECONDITION (Story #413) — the `affected` input's safety claim
+//
+// The old prose promised affected mode "can never miss a task", which is true
+// only of the UNRESOLVABLE-base case. A `--affected` baked unconditionally into
+// a consumer's package script hits the resolvable-but-EMPTY case instead: with
+// `affected: false` the TURBO_SCM_* vars are never exported, turbo falls back
+// to its own default base of `main`, and on a push to `main` that range is
+// empty — zero tasks scheduled, exit 0, a silent no-op that reads as a pass.
+// These assertions pin the correction in both consumer-facing surfaces so the
+// absolute claim cannot return and the conditional shape cannot be dropped.
+// ---------------------------------------------------------------------------
+
+const DOCS = "docs/reusable-workflows.md";
+
+/** The safe consumer shape: `--affected` only when a base was exported. */
+const CONDITIONAL_FORM = "${TURBO_SCM_BASE:+--affected}";
+
+/** Absolute claims that over-promise the fallback. Retired — must not return. */
+const ABSOLUTE_CLAIMS = ["so this can never miss a task", "never a missed task"];
+
+for (const [label, relPath] of [
+  ["the reusable workflow", WORKFLOW],
+  ["the consumer documentation", DOCS],
+]) {
+  test(`${label} states the affected-mode precondition conditionally, not absolutely`, () => {
+    const text = readFileSync(join(repoRoot, relPath), "utf8");
+    // Case-insensitive: the claim is retired as a claim, not as a casing.
+    const haystack = text.toLowerCase();
+
+    for (const claim of ABSOLUTE_CLAIMS) {
+      assert.ok(
+        !haystack.includes(claim),
+        `${relPath} still claims "${claim}" — the full-run fallback covers an ` +
+          "unresolvable base only, not a base that resolves to an empty range"
+      );
+    }
+
+    assert.ok(
+      text.includes(CONDITIONAL_FORM),
+      `${relPath} must recommend \`turbo run <tier> ${CONDITIONAL_FORM}\` — gating ` +
+        "the flag on the exported base is what keeps a push-to-`main` run from " +
+        "silently scheduling zero tasks"
+    );
+  });
+}

package/scripts/check-coverage-threshold.test.mjs

@@ -485,7 +485,7 @@ test("formatVerdict renders a skip line for the disabled gate", () => {
 //
 // The workflow's "Coverage threshold gate" step no longer embeds a copy of
 // this script (Story #230): it sparse-side-checkouts mandrel-platform at
-// `github.job_workflow_sha` into `_mandrel-platform-scripts/` and runs
+// `job.workflow_sha` into `_mandrel-platform-scripts/` and runs
 // `scripts/check-coverage-threshold.mjs` directly. These tests exercise that
 // exact invocation shape — the real script, run from the side-checkout path,
 // with the workflow's `--threshold` / `--metric` args and the consumer

package/scripts/check-destructive-migration.mjs

@@ -84,6 +84,8 @@
 import { appendFileSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
+import { isDirectInvocation } from './lib/entry-guard.mjs';
+
 // The override acknowledgement label. Documented in docs/reusable-workflows.md.
 export const DEFAULT_OVERRIDE_LABEL = "migration:destructive-ok";
 
@@ -635,7 +637,9 @@ function main() {
   process.exit(1);
 }
 
-// Only run the CLI when invoked directly, not when imported by the self-test.
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Direct-invocation guard — symlink-safe via the shared seam (Story #407):
+// comparing an unresolved argv[1] against a realpath-resolved
+// import.meta.url silently never matches under pnpm's symlinked node_modules.
+if (isDirectInvocation(import.meta.url)) {
   main();
 }

package/scripts/check-osv-scan-mode.test.mjs

@@ -191,8 +191,8 @@ test("the diff-range resolver is side-checked-out from the pinned platform SHA",
   assert.match(block, /repository:\s*dsj1984\/mandrel-platform/);
   assert.match(
     block,
-    /job_workflow_sha/,
-    "must resolve THIS repo at the SHA the caller pinned, not a floating ref",
+    /ref: \$\{\{ steps\.[A-Za-z0-9_-]+\.outputs\.sha \}\}/,
+    "must resolve THIS repo at the SHA the caller pinned, not a floating ref — and via a fail-closed resolve step, so an unresolvable ref stops the job instead of silently checking out the default branch (Story #415)",
   );
   assert.match(
     block,

package/scripts/check-pin-drift.mjs

@@ -58,7 +58,7 @@
  *      that has no canonical pin to track at all (`orphan`). A stale literal is
  *      a real configuration error and is never suppressed by the
  *      `minimumReleaseAge` hold. The fix is to adopt the resolved-ref step
- *      summary `deploy-cloudflare.yml` now emits (its `github.job_workflow_sha`
+ *      summary `deploy-cloudflare.yml` now emits (its `job.workflow_sha`
  *      single source of truth) rather than maintaining the literal by hand.
  *
  * Data-driven: a new consumer is one object in pin-drift-consumers.json.
@@ -97,6 +97,8 @@ import {
   parseSemver,
 } from "./lib/semver-duration.mjs";
 
+import { isDirectInvocation } from './lib/entry-guard.mjs';
+
 // Re-export the extracted seams so existing importers (platform-repair.mjs,
 // the test suite) keep their `check-pin-drift.mjs` import paths. The canonical
 // homes are scripts/lib/gh-json.mjs and scripts/lib/semver-duration.mjs
@@ -1114,9 +1116,9 @@ export function runCli({
   return 0;
 }
 
-// Direct-invocation guard (matches the repo's other scripts/*.mjs entry style).
-const invokedDirectly =
-  process.argv[1] && resolve(process.argv[1]) === resolve(new URL(import.meta.url).pathname);
-if (invokedDirectly) {
+// Direct-invocation guard — symlink-safe via the shared seam (Story #407):
+// comparing an unresolved argv[1] against a realpath-resolved
+// import.meta.url silently never matches under pnpm's symlinked node_modules.
+if (isDirectInvocation(import.meta.url)) {
   process.exit(runCli());
 }

package/scripts/check-repo-settings.mjs

@@ -42,6 +42,8 @@ import { readFileSync, appendFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 
+import { isDirectInvocation } from './lib/entry-guard.mjs';
+
 // ---------------------------------------------------------------------------
 // Arg parsing
 // ---------------------------------------------------------------------------
@@ -355,9 +357,9 @@ export function runCli({
   return 0;
 }
 
-// Direct-invocation guard (matches the repo's other scripts/*.mjs entry style).
-const invokedDirectly =
-  process.argv[1] && resolve(process.argv[1]) === resolve(new URL(import.meta.url).pathname);
-if (invokedDirectly) {
+// Direct-invocation guard — symlink-safe via the shared seam (Story #407):
+// comparing an unresolved argv[1] against a realpath-resolved
+// import.meta.url silently never matches under pnpm's symlinked node_modules.
+if (isDirectInvocation(import.meta.url)) {
   process.exit(runCli());
 }

package/scripts/check-ruleset.mjs

@@ -64,6 +64,8 @@ import { readFileSync, appendFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 
+import { isDirectInvocation } from './lib/entry-guard.mjs';
+
 // ---------------------------------------------------------------------------
 // Arg parsing
 // ---------------------------------------------------------------------------
@@ -427,9 +429,9 @@ export function runCli({
   return 0;
 }
 
-// Direct-invocation guard (matches the repo's other scripts/*.mjs entry style).
-const invokedDirectly =
-  process.argv[1] && resolve(process.argv[1]) === resolve(new URL(import.meta.url).pathname);
-if (invokedDirectly) {
+// Direct-invocation guard — symlink-safe via the shared seam (Story #407):
+// comparing an unresolved argv[1] against a realpath-resolved
+// import.meta.url silently never matches under pnpm's symlinked node_modules.
+if (isDirectInvocation(import.meta.url)) {
   process.exit(runCli());
 }

package/scripts/check-runner-health.mjs

@@ -55,6 +55,8 @@ import { resolve } from "node:path";
 
 import { defaultGhRunner, ghApiJson, isNotFound } from "./lib/gh-json.mjs";
 
+import { isDirectInvocation } from './lib/entry-guard.mjs';
+
 // ---------------------------------------------------------------------------
 // Arg parsing
 // ---------------------------------------------------------------------------
@@ -461,9 +463,9 @@ export function runCli({
   return 0;
 }
 
-// Direct-invocation guard (matches the repo's other scripts/*.mjs entry style).
-const invokedDirectly =
-  process.argv[1] && resolve(process.argv[1]) === resolve(new URL(import.meta.url).pathname);
-if (invokedDirectly) {
+// Direct-invocation guard — symlink-safe via the shared seam (Story #407):
+// comparing an unresolved argv[1] against a realpath-resolved
+// import.meta.url silently never matches under pnpm's symlinked node_modules.
+if (isDirectInvocation(import.meta.url)) {
   process.exit(runCli());
 }

package/scripts/check-runner-runs-on.test.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+/**
+ * check-runner-runs-on.test.mjs — regression guard for the `runner` input's
+ * two documented shapes (Story #421).
+ *
+ * The bug this pins: every `runs-on:` site consumed the input raw as
+ * `${{ inputs.runner }}`. GitHub does not parse a JSON-array *string* in that
+ * position — it takes the entire text as ONE label name. A caller passing the
+ * documented `'["self-hosted","my-runner"]'` therefore targeted a label no
+ * runner carries, and every tier sat `queued` until the 24-hour timeout.
+ *
+ * It was silent. Nothing went red, no job started, so there were no logs, and
+ * `gh pr checks` reported `pending 0` — indistinguishable from a busy fleet.
+ * The tell was that caller-owned jobs went green while every reusable-workflow
+ * tier reported `pending 0`.
+ *
+ * Why this is not a grep. A `grep` cannot tell a resolvable `runs-on`
+ * expression from an unresolvable one — that is precisely how this shipped,
+ * past static checks that all passed. Asserting the expression's spelling
+ * would pin the wording and not the behaviour. So this EXTRACTS each real
+ * expression from the workflow and EVALUATES it under Actions semantics, the
+ * same read-then-execute approach as check-toolchain-cache-default.test.mjs.
+ *
+ * Run: node --test scripts/check-runner-runs-on.test.mjs
+ */
+
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { readFileSync, readdirSync } from "node:fs";
+import { evaluate } from "./lib/actions-expression.mjs";
+
+const WORKFLOW_DIR = ".github/workflows";
+
+/** Every workflow that declares a `runner` workflow_call input. */
+function runnerWorkflows() {
+  return readdirSync(WORKFLOW_DIR)
+    .filter((f) => f.endsWith(".yml"))
+    .map((f) => ({ file: `${WORKFLOW_DIR}/${f}`, text: readFileSync(`${WORKFLOW_DIR}/${f}`, "utf8") }))
+    .filter(({ text }) => /^\s{6}runner:$/m.test(text));
+}
+
+/**
+ * The `${{ … }}` bodies of every `runs-on:` value that reads `inputs.runner`.
+ * Scans lines rather than building a regex around the file — the block
+ * boundary is a single line, and a dynamically-constructed regex is a SAST
+ * finding that buys nothing here.
+ */
+function runsOnExpressions(text) {
+  const out = [];
+  for (const [idx, line] of text.split("\n").entries()) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("runs-on:")) continue;
+    if (!trimmed.includes("inputs.runner")) continue;
+    const m = trimmed.match(/^runs-on:\s*\$\{\{(.+)\}\}\s*$/);
+    assert.ok(m, `line ${idx + 1}: runs-on reads inputs.runner but is not a single expression: ${trimmed}`);
+    out.push({ line: idx + 1, expr: m[1].trim() });
+  }
+  return out;
+}
+
+const WORKFLOWS = runnerWorkflows();
+
+test("every workflow taking a `runner` input is covered by this guard", () => {
+  // A new reusable workflow with a `runner` input must not slip past unseen.
+  const names = WORKFLOWS.map(({ file }) => file.split("/").pop()).sort();
+  assert.deepEqual(names, [
+    "advisory-scan.yml",
+    "deploy-cloudflare.yml",
+    "pr-quality.yml",
+    "release-automation.yml",
+    "secret-scan-push.yml",
+    "uptime-apply.yml",
+  ]);
+});
+
+test("no `runs-on:` consumes `inputs.runner` raw", () => {
+  // The exact shape that shipped the bug. Kept as a cheap, legible tripwire
+  // alongside the behavioural assertions below.
+  for (const { file, text } of WORKFLOWS) {
+    for (const { line, expr } of runsOnExpressions(text)) {
+      assert.notEqual(
+        expr,
+        "inputs.runner",
+        `${file}:${line}: \`runs-on\` consumes the input raw — a JSON-array ` +
+          `string resolves to one unmatchable label name and the job queues forever`,
+      );
+    }
+  }
+});
+
+for (const { file, text } of WORKFLOWS) {
+  const sites = runsOnExpressions(text);
+
+  test(`${file}: has at least one runner-driven runs-on site`, () => {
+    assert.ok(sites.length > 0, "expected this workflow to drive runs-on from inputs.runner");
+  });
+
+  test(`${file}: a bare label resolves to that same string`, () => {
+    for (const { line, expr } of sites) {
+      assert.equal(evaluate(expr, { runner: "ubuntu-latest" }), "ubuntu-latest", `${file}:${line}`);
+      assert.equal(evaluate(expr, { runner: "beestera-runner" }), "beestera-runner", `${file}:${line}`);
+    }
+  });
+
+  test(`${file}: the documented JSON-array string resolves to a label ARRAY`, () => {
+    for (const { line, expr } of sites) {
+      assert.deepEqual(
+        evaluate(expr, { runner: '["self-hosted","beestera-runner"]' }),
+        ["self-hosted", "beestera-runner"],
+        `${file}:${line}: the documented array form must yield real labels, ` +
+          `not one label named after the whole JSON text`,
+      );
+    }
+  });
+
+  test(`${file}: a malformed array-shaped value fails loudly, not into the label branch`, () => {
+    // A silent fallback to the raw string would rebuild the original failure
+    // mode — an unmatchable label, queued until the 24-hour timeout — behind a
+    // fix that claims to have removed it.
+    for (const { line, expr } of sites) {
+      assert.throws(
+        () => evaluate(expr, { runner: '["unterminated' }),
+        /could not parse/,
+        `${file}:${line}: a '['-leading value that is not valid JSON must be a hard error`,
+      );
+    }
+  });
+
+  test(`${file}: every runs-on site resolves identically`, () => {
+    // One workflow must not drift into two dialects of the same decision.
+    const rendered = sites.map(({ expr }) =>
+      JSON.stringify(evaluate(expr, { runner: '["self-hosted","x"]' })),
+    );
+    assert.equal(new Set(rendered).size, 1, `${file}: runs-on sites disagree: ${rendered.join(" | ")}`);
+  });
+}
+
+test("the documented array form resolves AND derives toolchain-cache 'false'", () => {
+  // The coupling the gap report found: before this fix the only `runner` value
+  // that derived the correct cache posture was the one that never reached a
+  // runner, and the only value that reached a runner derived the wrong posture.
+  // A self-hosted caller could not get both right from the documented
+  // interface. Assert the pairing is now reachable in a single value.
+  const quality = readFileSync(`${WORKFLOW_DIR}/pr-quality.yml`, "utf8");
+  const runner = '["self-hosted","beestera-runner"]';
+
+  const [runsOn] = runsOnExpressions(quality);
+  assert.deepEqual(evaluate(runsOn.expr, { runner }), ["self-hosted", "beestera-runner"]);
+
+  const cache = quality.match(/^\s*cache:\s*\$\{\{(.+)\}\}\s*$/m);
+  assert.ok(cache, "no `cache: ${{ … }}` value found at the setup-toolchain call site");
+  assert.equal(evaluate(cache[1].trim(), { runner, "toolchain-cache": "auto" }), "false");
+});

package/scripts/check-toolchain-cache-default.test.mjs

@@ -31,6 +31,7 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
 import { readFileSync } from "node:fs";
+import { evaluate } from "./lib/actions-expression.mjs";
 
 const QUALITY = ".github/workflows/pr-quality.yml";
 const ADVISORY = ".github/workflows/advisory-scan.yml";
@@ -68,146 +69,13 @@ function inputDefault(text, name, file) {
 }
 
 // ---------------------------------------------------------------------------
-// A minimal GitHub Actions expression evaluator
-//
-// Only the surface this expression uses: string literals, `inputs.<name>` /
-// `inputs['<name>']` context reads, `==`/`!=`, `&&`/`||`, parentheses, and
-// `contains()`. The semantics that matter and that a hand-read gets wrong:
-//
-//   - `a && b` yields `b` when `a` is truthy, else `a`.
-//   - `a || b` yields `a` when `a` is truthy, else `b`.
-//   - EVERY non-empty string is truthy — including the string `'false'`.
-//   - String comparison is case-insensitive.
+// The Actions expression evaluator now lives in scripts/lib/actions-expression.mjs
+// (extracted by Story #421, when check-runner-runs-on.test.mjs needed the same
+// read-then-execute approach). Its own semantics are covered by
+// scripts/lib/actions-expression.test.mjs, so this file asserts only the
+// toolchain-cache contract.
 // ---------------------------------------------------------------------------
 
-function truthy(v) {
-  if (typeof v === "boolean") return v;
-  if (typeof v === "number") return v !== 0;
-  if (typeof v === "string") return v !== "";
-  return v !== null && v !== undefined;
-}
-
-function looseEqual(a, b) {
-  if (typeof a === "string" && typeof b === "string") {
-    return a.toLowerCase() === b.toLowerCase();
-  }
-  return a === b;
-}
-
-function evaluate(expr, inputs) {
-  let i = 0;
-
-  const ws = () => {
-    while (i < expr.length && /\s/.test(expr[i])) i++;
-  };
-  const eat = (token) => {
-    ws();
-    if (expr.startsWith(token, i)) {
-      i += token.length;
-      return true;
-    }
-    return false;
-  };
-
-  function parseOr() {
-    let left = parseAnd();
-    for (;;) {
-      ws();
-      if (!eat("||")) return left;
-      const right = parseAnd();
-      left = truthy(left) ? left : right;
-    }
-  }
-
-  function parseAnd() {
-    let left = parseCompare();
-    for (;;) {
-      ws();
-      if (!eat("&&")) return left;
-      const right = parseCompare();
-      left = truthy(left) ? right : left;
-    }
-  }
-
-  function parseCompare() {
-    const left = parsePrimary();
-    ws();
-    if (eat("!=")) return !looseEqual(left, parsePrimary());
-    if (eat("==")) return looseEqual(left, parsePrimary());
-    return left;
-  }
-
-  function parsePrimary() {
-    ws();
-    if (eat("(")) {
-      const v = parseOr();
-      ws();
-      assert.ok(eat(")"), `unbalanced parenthesis at ${i} in: ${expr}`);
-      return v;
-    }
-    if (expr[i] === "'") {
-      i++;
-      let out = "";
-      while (i < expr.length) {
-        if (expr[i] === "'" && expr[i + 1] === "'") {
-          out += "'";
-          i += 2;
-          continue;
-        }
-        if (expr[i] === "'") {
-          i++;
-          return out;
-        }
-        out += expr[i++];
-      }
-      assert.fail(`unterminated string literal in: ${expr}`);
-    }
-    if (expr.startsWith("contains(", i)) {
-      i += "contains(".length;
-      const hay = parseOr();
-      ws();
-      assert.ok(eat(","), `contains() expects two arguments in: ${expr}`);
-      const needle = parseOr();
-      ws();
-      assert.ok(eat(")"), `unclosed contains() in: ${expr}`);
-      return String(hay).toLowerCase().includes(String(needle).toLowerCase());
-    }
-    const ident = expr.slice(i).match(/^[A-Za-z_][A-Za-z0-9_.\-]*(\['[^']*'\])?/);
-    assert.ok(ident, `unparseable token at ${i} in: ${expr}`);
-    i += ident[0].length;
-    const raw = ident[0];
-    if (raw === "true") return true;
-    if (raw === "false") return false;
-    const bracket = raw.match(/^inputs\['([^']*)'\]$/);
-    const dotted = raw.match(/^inputs\.(.+)$/);
-    const key = bracket ? bracket[1] : dotted ? dotted[1] : null;
-    assert.ok(key !== null, `unsupported context read \`${raw}\` in: ${expr}`);
-    assert.ok(key in inputs, `expression reads \`inputs.${key}\`, not provided by the test case`);
-    return inputs[key];
-  }
-
-  const value = parseOr();
-  ws();
-  assert.equal(i, expr.length, `trailing tokens at ${i} in: ${expr}`);
-  return value;
-}
-
-// ---------------------------------------------------------------------------
-// The evaluator itself must be trustworthy before it can judge the workflow.
-// ---------------------------------------------------------------------------
-
-test("the expression evaluator models Actions truthiness, not JavaScript's", () => {
-  // The trap the real expression depends on: the STRING 'false' is truthy, so
-  // an explicitly-pinned 'false' survives the first arm of the ternary.
-  assert.equal(evaluate("'false' && 'yes' || 'no'", {}), "yes");
-  // `&&`/`||` yield operands, not booleans.
-  assert.equal(evaluate("true && 'kept'", {}), "kept");
-  assert.equal(evaluate("'' || 'fallback'", {}), "fallback");
-  // Comparison is case-insensitive.
-  assert.equal(evaluate("'AUTO' == 'auto'", {}), true);
-  assert.equal(evaluate("contains('[\"self-hosted\",\"x\"]', 'self-hosted')", {}), true);
-});
-
 // ---------------------------------------------------------------------------
 // The contract
 // ---------------------------------------------------------------------------

package/scripts/check-workflow-gh-flags.mjs

@@ -34,6 +34,8 @@
 import { readFileSync, readdirSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 
+import { isDirectInvocation } from './lib/entry-guard.mjs';
+
 const WORKFLOW_DIRS = ['.github/workflows', 'templates/workflows'];
 
 /**
@@ -166,7 +168,9 @@ function main() {
   return 1;
 }
 
-// Run only as a CLI, not when imported by the test suite.
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Direct-invocation guard — symlink-safe via the shared seam (Story #407):
+// comparing an unresolved argv[1] against a realpath-resolved
+// import.meta.url silently never matches under pnpm's symlinked node_modules.
+if (isDirectInvocation(import.meta.url)) {
   process.exit(main());
 }