ruvnet-brain 4.7.20 → 4.7.21

package/scripts/route-gold-rank.mjs

@@ -29,6 +29,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { wilson, repoMatchesExpected } from './eval-brain.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -151,6 +152,6 @@ async function main() {
   console.log(JSON.stringify(brief, null, 1));
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   await main();
 }

package/scripts/route-index-memory.mjs

@@ -13,6 +13,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const arg = (name) => { const i = process.argv.indexOf(name); return i >= 0 ? process.argv[i + 1] : undefined; };
@@ -48,4 +49,4 @@ async function main() {
   console.log(JSON.stringify({ impl: rel.startsWith('..') ? '<impl>' : rel, kbBuild, stores: repos.length, coldMs, warmMs, retained: retained(before, after) }));
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) await main();
+if (isDirectInvocation(import.meta.url)) await main();

package/scripts/route-latency-warm.mjs

@@ -22,6 +22,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 export const percentile = (xs, p) => {
   const s = [...xs].sort((a, b) => a - b);
@@ -120,4 +121,4 @@ async function main() {
   process.exit(0);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) await main();
+if (isDirectInvocation(import.meta.url)) await main();

package/scripts/router-utilization.mjs

@@ -179,4 +179,5 @@ export function mainUtil() {
 
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) mainUtil();
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
+if (isDirectInvocation(import.meta.url)) mainUtil();

package/scripts/routing-flywheel.mjs

@@ -55,6 +55,7 @@ import {
 import { effectivePrices, loadLabelledRows, OUTCOMES } from './metaharness-router.mjs';
 import { assertEvolutionAllowed } from './metaharness-gate.mjs';
 import { loadCatalog, applyProfile, loadProfile } from './model-router-engine.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 // ─── HARD CAPS — the self-DDoS fence. Clamped, never raised by flags. ─────────────────────────────
 export const HARD_MAX_GENERATIONS = 6;
@@ -599,7 +600,7 @@ async function main() {
   }
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isDirectInvocation(import.meta.url)) {
   main().catch((e) => {
     process.stderr.write(`routing-flywheel: ${e.stack || e.message}\n`);
     process.exit(1);

package/scripts/run-operational-benchmark.mjs

@@ -14,6 +14,7 @@ import {
   latencyDistribution,
   verifyFixtureSourceSupport,
 } from '../evals/operational-benchmark.v2.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const execFileAsync = promisify(execFile);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -146,6 +147,6 @@ async function main() {
   if (report.passed !== report.total || report.unavailable.length) process.exitCode = 1;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   main().catch((error) => { console.error(error.stack || error.message); process.exitCode = 2; });
 }

package/scripts/run-operational-benchmark.v3.mjs

@@ -16,6 +16,7 @@ import {
   preflightOperationalOracle,
 } from '../evals/operational-benchmark.v3.mjs';
 import { verifyGrounding as evaluatorVerifyGrounding } from '../kb/verify-citation.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const execFileAsync = promisify(execFile);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -189,6 +190,6 @@ async function main() {
   if (!report.qualificationPass) process.exitCode = 1;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   main().catch((error) => { console.error(error.stack || error.message); process.exitCode = 2; });
 }

package/scripts/rvf-index-audit.mjs

@@ -37,6 +37,7 @@ import {
   writeRvfGeneration,
 } from './rvf-generation.mjs';
 import { metricFromId, readRvfStoredVectors } from './rvf-wire.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 export const RVF_HNSW_THRESHOLD = 1024;
@@ -675,22 +676,7 @@ async function main() {
   if (failed.length) process.exitCode = 1;
 }
 
-// Entry-point guard. Compares REALPATHS on both sides: path.resolve() normalizes a path but does
-// NOT follow symlinks, while import.meta.url IS symlink-resolved by Node. Through a symlink (npm bin
-// shims, wrapper scripts, and every os.tmpdir() path on macOS) the two sides disagree, so main()
-// never runs -- and because nothing throws, the process exits 0. A silent exit 0 is indistinguishable
-// from "ran, found nothing", which is how prepareCorpusCandidate once reported SUCCESS with no
-// archive on disk. Reproduced live 2026-07-27; pinned by tests/unit/entrypoint-symlink.test.mjs.
-function isDirectInvocation() {
-  try {
-    if (!process.argv[1]) return false;
-    return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-
-if (isDirectInvocation()) {
+if (isDirectInvocation(import.meta.url)) {
   main().catch((error) => {
     console.error(error.stack || error.message);
     process.exitCode = 1;

package/scripts/seal-gist-receipt.mjs

@@ -13,6 +13,7 @@ import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { observeSourceUniverse } from './source-coverage.mjs';
 import { buildGistAggregate } from './gist-receipts.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 export const REPO_KB = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'kb');
 
@@ -57,7 +58,7 @@ async function main(argv = process.argv.slice(2)) {
   return 0;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   main().then((code) => { process.exitCode = code; }).catch((error) => {
     console.error(`[seal-gist-receipt] ${error.message}`);
     process.exitCode = 1;

package/scripts/security-guidance-codex-compat.mjs

@@ -14,6 +14,7 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 export const COMPATIBILITY = Object.freeze({
   version: '2.0.9', nativeContract: 'Codex 0.160.0 PostToolUse',
@@ -128,7 +129,7 @@ export function repairSecurityGuidance({ codexHome = process.env.CODEX_HOME || p
   return { ...receipt, status: 'patched', backup, patchedSha256: sha256(readRegular(target).bytes) };
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   try {
     const args = process.argv.slice(2);
     let codexHome; let apply = false;

package/scripts/selfcheck.mjs

@@ -67,6 +67,7 @@ import { fileURLToPath } from 'node:url';
 // THE canonical continuity policy — the same module bin/install.mjs and scripts/hook-retirement-check.mjs
 // import. Never re-implement this predicate locally; see the note below the imports.
 import { isAllowedContinuityRegistration } from '../plugin/scripts/continuity-hook-policy.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 // ── contract constants (ADR-053 §2.5 / §2.3) ────────────────────────────────────────────────────
 export const STDOUT_CAP_BYTES = 4096; // it lands in the user's context window
@@ -739,7 +740,7 @@ export function formatVerdict(result, { color = null } = {}) {
 }
 
 // ── CLI ─────────────────────────────────────────────────────────────────────────────────────────
-if (process.argv[1] && (() => { try { return fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })()) {
+if (isDirectInvocation(import.meta.url)) {
   const noSecurity = process.argv.includes('--no-security');
   const json = process.argv.includes('--json');
   const result = await selfCheck({ security: !noSecurity });

package/scripts/signal-watch.mjs

@@ -47,6 +47,7 @@ import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { assessCiGate } from './ci-verdict.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const BRAIN_HOME = process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain');
 const SIGNAL_DIR = process.env.RUVNET_SIGNAL_DIR || path.join(BRAIN_HOME, 'external-signals');
@@ -164,7 +165,7 @@ function main() {
 }
 
 function isMain() {
-  try { return process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href; }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 }
 

package/scripts/source-coverage.mjs

@@ -10,6 +10,7 @@ import { canonicalJson, coverageGenerationFor, digest, validateGistAggregateRece
 import { repositoryNames } from '../kb/card-lane.mjs';
 import { rootNeverMaterialized, storeRoot } from '../kb/store-root.mjs';
 import { isTransientText, retryTransient, sleepSync } from './transient-gh.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 export { canonicalJson, digest } from './coverage-integrity.mjs';
 
@@ -759,6 +760,6 @@ export async function main(argv = process.argv.slice(2)) {
   return 0;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   process.exitCode = await main();
 }

package/scripts/stabilization-receipt.mjs

@@ -8,6 +8,7 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { evaluateStabilizationCandidateReceipt } from './release-proof.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const readJson = (file) => JSON.parse(fs.readFileSync(file, 'utf8'));
 const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
@@ -115,4 +116,4 @@ export function main(args = process.argv.slice(2)) {
   }
 }
 
-if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) process.exitCode = main();
+if (isDirectInvocation(import.meta.url)) process.exitCode = main();

package/scripts/stamp-sweep.mjs

@@ -39,6 +39,7 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { ensureStamp, hasStamp, stampInsertionPoint } from '../plugin/scripts/md-stamp.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 export const REPO_ROOT = path.resolve(HERE, '..');
@@ -137,7 +138,7 @@ function main() {
 }
 
 function isMain() {
-  try { return process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url); }
+  try { return isDirectInvocation(import.meta.url); }
   catch { return false; }
 }
 

package/scripts/status-honesty.mjs

@@ -28,6 +28,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -115,7 +116,7 @@ export function scanRepo(root = ROOT) {
   return out;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   const bad = scanRepo();
   if (bad.length) {
     console.error('status-honesty: ASSERTED (underived) terminal success literals found:\n');

package/scripts/sync-commands.mjs

@@ -34,6 +34,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const DIR = path.join(ROOT, 'plugin', 'commands');
@@ -76,8 +77,7 @@ function rebuild(aliasText, canonicalFrontmatter, canonicalBody) {
 // able to crash the caller that merely imported this module: not-resolvable means not-main.
 function resolvedIsMain() {
   try {
-    return Boolean(process.argv[1])
-      && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+    return isDirectInvocation(import.meta.url);
   } catch { return false; }
 }
 if (!resolvedIsMain()) { /* imported for its exports — do nothing else */ } else {

package/scripts/top100-benchmark.mjs

@@ -10,6 +10,7 @@ import { performance } from 'node:perf_hooks';
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { pathToFileURL, fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const CORPUS = path.join(ROOT, 'evals', 'top-100.json');
@@ -476,4 +477,4 @@ Use --out when a durable evidence artifact is intentional; release checks are pu
   });
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) await main();
+if (isDirectInvocation(import.meta.url)) await main();

package/scripts/top100-corpus.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { semanticAssertionsFor } from './top100-semantic-assertions.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HELD_OUT = path.join(ROOT, 'evals', 'held-out.json');
@@ -105,7 +106,7 @@ export function corpusHash(corpus) {
   return createHash('sha256').update(JSON.stringify(corpus.questions)).digest('hex');
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   const corpus = buildTop100();
   fs.writeFileSync(OUT, JSON.stringify({ ...corpus, sha256: corpusHash(corpus) }, null, 2) + '\n');
   console.log(`${OUT}: ${corpus.questions.length} questions, sha256=${corpusHash(corpus)}`);

package/scripts/user-model-hook-install.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import { pathToFileURL } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 export function shellQuote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
 
@@ -134,7 +135,7 @@ export function applyUserModelHooks(plan) {
   return { applied: true, written };
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+if (isDirectInvocation(import.meta.url)) {
   try {
     const args = process.argv.slice(2);
     if (args.some(arg => !['--apply', '--dry-run', '--plan'].includes(arg))) throw new Error('Usage: user-model-hook-install.mjs [--apply|--dry-run|--plan]');

package/scripts/user-model-prompt-hook.mjs

@@ -8,6 +8,7 @@ import os from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { weeklyCycleStatus } from './model-weekly-cycle.mjs';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 export const PRESENTATION = 'For terminal briefings: give concise executive status; use narrow padded ASCII tables with borders, plain cell text, aligned columns and short rows. Never send pipe-delimited Markdown tables to this terminal. Use short lists when a table would wrap. Do not flood the response with commands or technical logs.';
 
@@ -65,6 +66,6 @@ async function main() {
   process.stdout.write(JSON.stringify(envelope(promptContext(payload))) + '\n');
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+if (isDirectInvocation(import.meta.url)) {
   main().catch(() => process.stdout.write(JSON.stringify(envelope(PRESENTATION)) + '\n'));
 }

package/scripts/verify-bundle.mjs

@@ -42,7 +42,9 @@ export function verifyBundle(bundlePath, sigPath = `${bundlePath}.sig`, pubPath
 }
 
 // CLI
-if (import.meta.url === `file://${process.argv[1]}`) {
+// Copied ALONE into every brain bundle (scripts/build-bundle.mjs), so it cannot import
+// plugin/scripts/entrypoint.mjs; this is that helper's comparison, inline: real paths on both sides.
+if ((() => { try { return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return false; } })()) {
   const [bundle, sig] = process.argv.slice(2);
   if (!bundle) { console.error('Usage: node scripts/verify-bundle.mjs <bundle.zip> [<bundle.zip.sig>]'); process.exit(2); }
   const r = verifyBundle(bundle, sig);

package/scripts/verify-model-catalog.mjs

@@ -15,6 +15,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
@@ -99,6 +100,6 @@ export async function main(argv = process.argv) {
   console.log(`✓ model-catalog VERIFIED: ${r.checked} model facts match the ${live ? 'LIVE OpenRouter' : 'committed snapshot'} catalog (pulled ${source.pulledAt}, ${r.ageDays.toFixed(1)}d old ≤ 14d).`);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   main().catch((e) => { console.error('verify-model-catalog error:', e.message); process.exit(1); });
 }

package/scripts/version.mjs

@@ -6,6 +6,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 export const PLUGIN_JSON = path.join(ROOT, 'plugin', '.claude-plugin', 'plugin.json');
@@ -35,6 +36,6 @@ export function getVersionTag() {
 export const stripTag = (v) => String(v).replace(/^v/, '');
 
 // CLI: `node scripts/version.mjs` prints the version (handy for shell scripts).
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isDirectInvocation(import.meta.url)) {
   process.stdout.write(getVersion() + '\n');
 }

package/scripts/wired-check.mjs

@@ -172,8 +172,8 @@ const STANDALONE = [
   // plist's own ProgramArguments on 2026-07-23, not assumed from the header comment alone:
   ['clear-claude-tmp', 'launchd, every 3h (out-of-repo scheduler) — confirmed live: '
     + 'com.stuartkerr.clear-claude-tmp.plist is loaded and its ProgramArguments invoke this exact file'],
-  ['nightly-gists', 'launchd nightly 21:47 (out-of-repo scheduler) — confirmed live: '
-    + 'com.ruvnet.brain-gists.plist is loaded and its ProgramArguments invoke this exact file'],
+  ['nightly-gists', 'manual re-embed of the developer checkout gists store (the launchd job '
+    + 'com.ruvnet.brain-gists was retired 2026-10-26: no installed brain reads that store)'],
   ['nightly-wrapper', 'author-run maintenance harness, deliberately unscheduled; refuses primary, nested, and dirty worktrees'],
   ['routing-flywheel', 'launchd nightly 04:45 --dry-run (out-of-repo scheduler) — confirmed live: '
     + 'com.ruvnet.routing-flywheel.plist is loaded and its ProgramArguments invoke this exact file'],
@@ -409,13 +409,13 @@ export const REQUIRED_OPERATIONAL_EXPORTS = [
 const isTestFile = (f) => /\.(test|spec)\.(mjs|js)$/.test(path.basename(f))
   || f.includes(`${path.sep}tests${path.sep}`) || f.startsWith(`tests${path.sep}`);
 
-function walk(abs, recurse, out = []) {
+function walk(abs, recurse, out = [], prune = () => false) {
   let entries = [];
   try { entries = fs.readdirSync(abs, { withFileTypes: true }); } catch { return out; }
   for (const e of entries) {
     const full = path.join(abs, e.name);
     if (e.isDirectory()) {
-      if (recurse && e.name !== 'node_modules' && !e.name.startsWith('.')) walk(full, recurse, out);
+      if (recurse && e.name !== 'node_modules' && !e.name.startsWith('.') && !prune(full)) walk(full, recurse, out, prune);
     } else out.push(full);
   }
   return out;
@@ -451,7 +451,10 @@ function callerFiles(repo = REPO) {
     // wired into pre-push and `wired-check` went on reporting it `manual`. This file's own note names
     // the remedy: "an invoker outside the roots proves the ROOTS are incomplete — the fix is to add
     // the root, never to" special-case the module. Same rule, applied to the extension filter.
-    for (const f of walk(abs, true)) {
+    // Pruned BEFORE descending (see the worktrees note below): 100+ agent worktrees under .claude/ are full
+    // repository copies, and walking them only to drop every file afterwards dominated this audit's run time.
+    const worktrees = path.join(repo, '.claude', 'worktrees');
+    for (const f of walk(abs, true, [], (dir) => dir === worktrees)) {
       // `.claude/` is a caller root because `.claude/settings.json` genuinely invokes hooks. But
       // `.claude/worktrees/<agent>/` holds FULL COPIES of this repository (Claude Code agent
       // worktrees), and a copy of the repo is not a caller of the repo. Measured 2026-09-11: with any
@@ -634,6 +637,9 @@ export function callersOf(mod, files, repo = REPO, sourceCache = createInvocatio
     const rel = path.relative(repo, f).split(path.sep).join('/');
     if (rel === mod.rel) continue;              // self
     if (isTestFile(rel)) continue;              // a test is not a caller
+    // Cheap substring pre-filter: callerPattern() only ever matches text that contains the literal file
+    // name, so skipping the regex when the name is absent cannot change the result, only its cost.
+    if (!sourceCache.read(f)?.includes(mod.file)) continue;
     const src = sourceCache.commentFree(f);
     if (src !== null && re.test(src)) hits.push(rel);
   }

package/scripts/worktree-integrity.mjs

@@ -12,6 +12,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { isDirectInvocation } from '../plugin/scripts/entrypoint.mjs';
 
 function git(cwd, args) {
   const result = spawnSync('git', ['-C', cwd, ...args], { encoding: 'utf8' });
@@ -101,8 +102,7 @@ export function assertPrimaryCheckoutUnchanged(root, before) {
   return after;
 }
 
-const invokedDirectly = process.argv[1]
-  && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+const invokedDirectly = isDirectInvocation(import.meta.url);
 if (invokedDirectly) {
   try {
     const command = process.argv[2];