session-orchestrator 3.22.0 → 3.23.0

package/scripts/lib/validate/repo-files.mjs

@@ -0,0 +1,275 @@
+/**
+ * scripts/lib/validate/repo-files.mjs
+ *
+ * File enumeration for the `scripts/lib/validate/` scanners — TWO exports,
+ * because the population a scanner needs genuinely splits in two:
+ *
+ *   listRepoFiles()   — what git TRACKS. The right default for any scanner
+ *                       asking "what does this repository contain?".
+ *   listOnDiskFiles() — what the filesystem HOLDS, minus a named exclusion
+ *                       set. For the scanners whose oracle is deliberately
+ *                       "exists on disk" — `check-untracked-test-deps.mjs`
+ *                       states it outright: "untracked = ignored OR (exists on
+ *                       disk AND not in git ls-files)". That check needs BOTH
+ *                       halves and diffs them; collapsing them into one
+ *                       enumerator would delete its subject.
+ *
+ * Why this module exists (#1143). A scanner that walks with `readdirSync`
+ * cannot see `.gitignore`, so every gitignored artefact under a scan root
+ * enters its census as if it were repository content. Two populations arrive
+ * that way, and only the first is widely known:
+ *
+ *   1. A git worktree created inside the repo. This repo's own convention is
+ *      `.claude/worktrees/<name>` (gitignored, `.gitignore:20`), which drops a
+ *      COMPLETE second checkout into any root-anchored walk. Measured by
+ *      `check-unwired-features.mjs` (see its EXCLUDED_DIRS comment) with one
+ *      peer worktree present: +755 `.md` and +1209 `.mjs` files, 133 MB — and,
+ *      worse than the cost, the peer's copy of a rule file was counted as an
+ *      INDEPENDENT document, so a finding cited two sources where one exists.
+ *
+ *   2. Ordinary gitignored content, present with no worktree at all. Measured
+ *      2026-08-26 on a clean checkout of this repo (`.claude/worktrees/` empty,
+ *      `find .claude/worktrees -mindepth 1 | wc -l` → 0): the `.md` corpus of
+ *      `check-doc-cli-commands.mjs` was 4 files wider on disk than in the index
+ *      — `.claude/STATE.md` (per-session mutable state) and three
+ *      `docs/specs/*.md` (gitignored design notes). So the exposure is LIVE,
+ *      not merely latent on the worktree case.
+ *
+ * The index is also the cheaper oracle: one `git ls-files -z` beats a
+ * recursive `readdirSync` over the same subtree, and it never descends into
+ * `node_modules` at all.
+ *
+ * Both exports return ABSOLUTE paths, sorted, and never throw for a missing
+ * directory (it contributes zero files). Symlinks are skipped in the walk —
+ * following them can leave the root entirely, and a symlinked file is not
+ * independent content.
+ *
+ * @module scripts/lib/validate/repo-files
+ */
+
+import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+/**
+ * Environment handed to `git`. An allowlist rather than `process.env`: an
+ * inherited `GIT_DIR` / `GIT_WORK_TREE` (set by any hook that spawned us)
+ * would silently re-point `ls-files` at a DIFFERENT repository, and the
+ * result would look like a plausible file list. Same allowlist as
+ * `check-banner-parity.mjs`, whose enumeration pattern this lifts.
+ */
+const GIT_ENV_ALLOWLIST = Object.freeze(['PATH', 'HOME', 'LANG', 'LC_ALL', 'TMPDIR', 'TZ']);
+
+/**
+ * Directory names excluded from every filesystem walk in this module.
+ *
+ * `worktrees` is the #1143 entry and is here for a MEASURED reason, not by
+ * analogy to `node_modules` (see the module header). The other four are the
+ * usual generated/vendored trees; excluding them is what makes the walk
+ * fallback comparable in cost to the `ls-files` path it replaces.
+ *
+ * NOT exhaustive by intent: this is the exclusion set for a walk that has
+ * already lost `.gitignore`. The fix for a new gitignored tree is to use
+ * `listRepoFiles()`, not to grow this list.
+ */
+export const EXCLUDED_DIRS = Object.freeze([
+  'node_modules',
+  '.git',
+  'worktrees',
+  'dist',
+  'coverage',
+]);
+
+/**
+ * `realpathSync` that degrades to its input. Used only to compare two paths
+ * for identity, where an unresolvable path can never equal a resolvable one.
+ * @param {string} target
+ * @returns {string}
+ */
+function safeRealpath(target) {
+  try {
+    return realpathSync(target);
+  } catch {
+    return target;
+  }
+}
+
+/** @returns {NodeJS.ProcessEnv} the allowlisted git environment */
+function gitEnv() {
+  /** @type {NodeJS.ProcessEnv} */
+  const env = {};
+  for (const key of GIT_ENV_ALLOWLIST) {
+    if (process.env[key] !== undefined) env[key] = process.env[key];
+  }
+  return env;
+}
+
+/**
+ * True when `root` is the top level of a git working tree — the precondition
+ * for trusting `git ls-files` to describe it.
+ *
+ * The realpath comparison is load-bearing: inside a SUBDIRECTORY of a repo
+ * (or inside a worktree of one), `rev-parse --show-toplevel` succeeds and
+ * names a DIFFERENT directory, and `ls-files` run there would enumerate a
+ * corpus that is not the caller's root.
+ *
+ * @param {string} root absolute path
+ * @param {NodeJS.ProcessEnv} [env] allowlisted git environment (default: {@link gitEnv})
+ * @returns {boolean}
+ */
+export function isGitToplevel(root, env = gitEnv()) {
+  try {
+    const toplevel = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      env,
+    }).trim();
+    return Boolean(toplevel) && safeRealpath(toplevel) === safeRealpath(root);
+  } catch {
+    return false; // not a git checkout, or no git binary
+  }
+}
+
+/**
+ * Normalise the `exts` option into a predicate.
+ * @param {string[] | null | undefined} exts
+ * @returns {(absolute: string) => boolean}
+ */
+function extFilter(exts) {
+  if (!exts || exts.length === 0) return () => true;
+  const set = new Set(exts.map((e) => (e.startsWith('.') ? e : `.${e}`)));
+  return (absolute) => set.has(path.extname(absolute));
+}
+
+/**
+ * Recursive `readdirSync` walk under `absDir`.
+ *
+ * Defensive by design: an unreadable sub-directory is skipped rather than
+ * thrown, so one bad entry never aborts a whole census. A directory whose
+ * basename is in `exclude` is not descended into.
+ *
+ * @param {string} absDir
+ * @param {(absolute: string) => boolean} matches
+ * @param {Set<string>} exclude directory BASENAMES to skip
+ * @param {string[]} acc
+ * @returns {string[]}
+ */
+function walk(absDir, matches, exclude, acc = []) {
+  let entries;
+  try {
+    if (!existsSync(absDir) || !statSync(absDir).isDirectory()) return acc;
+    entries = readdirSync(absDir, { withFileTypes: true });
+  } catch {
+    return acc;
+  }
+  for (const entry of entries) {
+    // A symlink can leave the root entirely, and a symlinked file is not
+    // independent content — skip both directions.
+    if (entry.isSymbolicLink()) continue;
+    const full = path.join(absDir, entry.name);
+    if (entry.isDirectory()) {
+      if (exclude.has(entry.name)) continue;
+      walk(full, matches, exclude, acc);
+      continue;
+    }
+    if (entry.isFile() && matches(full)) acc.push(full);
+  }
+  return acc;
+}
+
+/**
+ * Resolve the `dirs` option to absolute directories under `root`.
+ * `'.'` (or an empty list) means the root itself.
+ * @param {string} root
+ * @param {string[] | undefined} dirs
+ * @returns {string[]}
+ */
+function resolveDirs(root, dirs) {
+  if (!dirs || dirs.length === 0) return [root];
+  return dirs.map((d) => (d === '.' ? root : path.join(root, d)));
+}
+
+/**
+ * Files git TRACKS under `dirs` — the repository's own account of its content.
+ *
+ * `git ls-files` is authoritative and honours `.gitignore` for free. When
+ * `root` is not the top level of a git checkout (a tarball export, a tmpdir
+ * fixture, a vendored copy), this falls back to a filesystem walk carrying the
+ * SAME exclusion set as {@link listOnDiskFiles} — a fallback that walked
+ * naively would reintroduce the exact bug this function exists to remove.
+ *
+ * @param {string} root absolute repository root
+ * @param {{dirs?: string[], exts?: string[] | null}} [options]
+ *   `dirs` repo-relative directories to scan (default: the whole root);
+ *   `exts` extensions to keep, with or without the dot (default: every file).
+ * @returns {string[]} absolute paths, sorted, deduplicated
+ */
+export function listRepoFiles(root, options = {}) {
+  const { dirs, exts = null } = options;
+  const matches = extFilter(exts);
+  const env = gitEnv();
+
+  if (isGitToplevel(root, env)) {
+    const pathspecs = dirs && dirs.length > 0 ? dirs.filter((d) => d !== '.') : [];
+    try {
+      const out = execFileSync('git', ['ls-files', '-z', '--', ...pathspecs], {
+        cwd: root,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        maxBuffer: 64 * 1024 * 1024,
+        env,
+      });
+      return out
+        .split('\0')
+        .filter(Boolean)
+        .map((rel) => path.join(root, rel))
+        .filter(matches)
+        // A tracked path can be absent from the working tree (sparse checkout,
+        // a deletion staged elsewhere). A scanner that then read it would
+        // report a tool-error for a file nobody removed.
+        .filter((absolute) => {
+          try {
+            return statSync(absolute).isFile();
+          } catch {
+            return false;
+          }
+        })
+        .sort();
+    } catch {
+      // fall through to the walk — a git that answered rev-parse but failed
+      // ls-files leaves us with no index to trust.
+    }
+  }
+
+  const exclude = new Set(EXCLUDED_DIRS);
+  const found = new Set();
+  for (const dir of resolveDirs(root, dirs)) {
+    for (const file of walk(dir, matches, exclude)) found.add(file);
+  }
+  return [...found].sort();
+}
+
+/**
+ * Files the FILESYSTEM holds under `dirs`, minus {@link EXCLUDED_DIRS}.
+ *
+ * Use this only when "exists on disk" is genuinely the oracle — i.e. when the
+ * point is to find files git does NOT track. Every other scanner wants
+ * {@link listRepoFiles}.
+ *
+ * @param {string} root absolute repository root
+ * @param {{dirs?: string[], exts?: string[] | null, exclude?: string[]}} [options]
+ *   `exclude` REPLACES the default exclusion set when given; pass
+ *   `[...EXCLUDED_DIRS, 'extra']` to extend it rather than to swap it.
+ * @returns {string[]} absolute paths, sorted, deduplicated
+ */
+export function listOnDiskFiles(root, options = {}) {
+  const { dirs, exts = null, exclude = EXCLUDED_DIRS } = options;
+  const matches = extFilter(exts);
+  const excludeSet = new Set(exclude);
+  const found = new Set();
+  for (const dir of resolveDirs(root, dirs)) {
+    for (const file of walk(dir, matches, excludeSet)) found.add(file);
+  }
+  return [...found].sort();
+}

package/scripts/lib/validate-vendored-rules.mjs

@@ -35,7 +35,7 @@
  */
 
 import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
-import { join, resolve, relative } from 'node:path';
+import { join, resolve, relative, basename } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
@@ -237,6 +237,200 @@ function getTargetFileList(targetRoot) {
   return files;
 }
 
+// ---------------------------------------------------------------------------
+// Vendoring sanitizer (issue #1098)
+//
+// Lives here rather than in rules-sync.mjs because it has this module's exact
+// shape — "judge one rule file, return findings" — and because rules-sync.mjs
+// already imports from here, so the move adds no import edge and no cycle.
+// rules-sync.mjs re-exports `scanVendoringLeaks` for its existing importers.
+// ---------------------------------------------------------------------------
+
+/**
+ * Path roots that exist in the PLUGIN repo but are not part of what a consumer
+ * repo receives. A rule that cites `scripts/lib/foo.mjs` reads fine here and
+ * dangles the moment the file is vendored.
+ *
+ * Deliberately a small, named list rather than "every top-level directory":
+ * the detector below additionally requires the cited path to resolve to a real
+ * FILE inside pluginRoot, which is what separates a plugin-internal citation
+ * from a consumer-repo path that merely shares a prefix (`docs/api.md`,
+ * `tests/` as a generic directory reference, `scripts/smoke-test.ts` in a code
+ * sample). Revisit if the plugin grows another top-level source directory that
+ * rules cite.
+ */
+const REPO_LOCAL_PATH_ROOTS = ['scripts', 'hooks', 'skills', 'docs', 'tests'];
+
+// Leading boundary excludes `react-hooks/exhaustive-deps` and
+// `templates/shared/hooks/x.sh` — a root only counts at a token boundary.
+const REPO_LOCAL_PATH_RE = new RegExp(
+  `(?<![\\w./-])((?:${REPO_LOCAL_PATH_ROOTS.join('|')})/[\\w./-]*\\w)`,
+  'g',
+);
+
+const MD_REFERENCE_RE = /[\w][\w.-]*\.md/g;
+
+/**
+ * `*.md` names a `## See Also` section may legitimately cite even though
+ * `rules/_index.md` does not register them: they are project-root instruction
+ * files every consumer repo has, not rules that travel through the sync.
+ */
+const NON_RULE_MD_REFERENCES = new Set(['CLAUDE.md', 'AGENTS.md', 'README.md']);
+
+/**
+ * 1-based line number of `index` within `content`.
+ * @param {string} content
+ * @param {number} index
+ * @returns {number}
+ */
+function lineOf(content, index) {
+  return content.slice(0, index).split('\n').length;
+}
+
+/**
+ * Extracts the body of the trailing `## See Also` section, with the offset at
+ * which it starts. Returns null when the file has no such section.
+ * @param {string} content
+ * @returns {{ body: string, offset: number } | null}
+ */
+function extractSeeAlso(content) {
+  const m = /^##\s+See Also\s*$/m.exec(content);
+  if (!m) return null;
+  const start = m.index + m[0].length;
+  const next = /^##\s+/m.exec(content.slice(start));
+  const end = next !== null ? start + next.index : content.length;
+  return { body: content.slice(start, end), offset: start };
+}
+
+/**
+ * True when `token` (a repo-relative path taken from rule prose) stays inside
+ * `pluginRoot` once resolved. `REPO_LOCAL_PATH_RE`'s character class admits
+ * `..`, so `scripts/../../../../etc/passwd` reaches this function; without the
+ * containment check its `statSync` would walk outside the plugin root and
+ * report a host file as a vendoring leak. Same shape as
+ * `git-config-drift.mjs`'s `hooksPathIsTracked` containment guard.
+ * @param {string} pluginRoot
+ * @param {string} token
+ * @returns {boolean}
+ */
+function tokenStaysInside(pluginRoot, token) {
+  const abs = resolve(pluginRoot, token);
+  const rel = relative(resolve(pluginRoot), abs);
+  return rel !== '' && !rel.startsWith('..') && !/^([a-zA-Z]:)?[\\/]/.test(rel);
+}
+
+/**
+ * Report-only vendoring sanitizer (issue #1098).
+ *
+ * Scans one rule file for the two ways a rule that reads correctly INSIDE this
+ * plugin repo breaks once it is vendored into a consumer repo:
+ *
+ *   - `repo-local-path` — a `scripts/…`, `hooks/…`, `skills/…`, `docs/…` or
+ *     `tests/…` citation that resolves to a real file under `pluginRoot`. The
+ *     consumer has no such file, so the citation dangles.
+ *   - `unresolvable-see-also` — a `## See Also` entry naming a `*.md` rule that
+ *     `rules/_index.md` does not register, so it is never vendored alongside.
+ *
+ * **This function never rewrites content.** Silent stripping would change the
+ * meaning of a rule at vendoring time, invisibly to both the author and the
+ * consumer; the finding is reported and a human decides. `@your-org/*`
+ * placeholders are deliberately NOT flagged — they are the documented
+ * placeholder convention for consumer-supplied package scopes, not a leak.
+ *
+ * @param {object} opts
+ * @param {string} opts.content - raw rule file content (never modified)
+ * @param {string} opts.relPath - manifest-relative path, used as `file`
+ * @param {string} opts.pluginRoot - repo root the repo-local check resolves against
+ * @param {Set<string>|null} [opts.manifestBasenames] - basenames registered in
+ *   `rules/_index.md`; when null the `unresolvable-see-also` check is skipped
+ * @returns {Array<{file: string, line: number, kind: 'repo-local-path'|'unresolvable-see-also', text: string}>}
+ */
+export function scanVendoringLeaks({ content, relPath, pluginRoot, manifestBasenames = null }) {
+  const findings = [];
+
+  REPO_LOCAL_PATH_RE.lastIndex = 0;
+  const seenPaths = new Set();
+  let m;
+  while ((m = REPO_LOCAL_PATH_RE.exec(content)) !== null) {
+    const token = m[1];
+    if (seenPaths.has(token)) continue;
+    let isFile;
+    try {
+      // Containment first: never stat a path that escapes pluginRoot.
+      if (!tokenStaysInside(pluginRoot, token)) continue;
+      const abs = join(pluginRoot, token);
+      isFile = existsSync(abs) && statSync(abs).isFile();
+    } catch {
+      isFile = false;
+    }
+    if (!isFile) continue;
+    seenPaths.add(token);
+    findings.push({
+      file: relPath,
+      line: lineOf(content, m.index),
+      kind: 'repo-local-path',
+      text: token,
+    });
+  }
+
+  if (manifestBasenames) {
+    const seeAlso = extractSeeAlso(content);
+    if (seeAlso) {
+      const ownBasename = basename(relPath);
+      const seenRefs = new Set();
+      MD_REFERENCE_RE.lastIndex = 0;
+      let r;
+      while ((r = MD_REFERENCE_RE.exec(seeAlso.body)) !== null) {
+        const ref = r[0];
+        const refBase = basename(ref);
+        if (refBase === ownBasename || seenRefs.has(refBase)) continue;
+        if (NON_RULE_MD_REFERENCES.has(refBase)) continue;
+        if (manifestBasenames.has(refBase)) continue;
+        seenRefs.add(refBase);
+        findings.push({
+          file: relPath,
+          line: lineOf(content, seeAlso.offset + r.index),
+          kind: 'unresolvable-see-also',
+          text: ref,
+        });
+      }
+    }
+  }
+
+  return findings;
+}
+
+/**
+ * Reads `<pluginRoot>/rules/_index.md` and returns the set of rule basenames it
+ * registers, for `scanVendoringLeaks()`'s `unresolvable-see-also` check.
+ * Returns `null` when the manifest is absent or unreadable — the caller then
+ * skips that check rather than reporting every See-Also entry as a leak.
+ *
+ * The bullet shape is the one `rules-sync.mjs`'s `parseIndex()` parses; it is
+ * matched here with a local regex rather than imported, because `rules-sync.mjs`
+ * imports from THIS module and an import back would create a module-load cycle
+ * (same reasoning as the `PLUGIN_HEADER_PREFIX` copy above).
+ *
+ * @param {string} pluginRoot
+ * @returns {Set<string>|null}
+ */
+export function readManifestBasenames(pluginRoot) {
+  const indexPath = join(pluginRoot, 'rules', '_index.md');
+  let indexContent;
+  try {
+    indexContent = readFileSync(indexPath, 'utf8');
+  } catch {
+    return null;
+  }
+  const names = new Set();
+  const bulletRe = /^-\s+`([^`]+\.md)`/gm;
+  let m;
+  while ((m = bulletRe.exec(indexContent)) !== null) {
+    names.add(basename(m[1]));
+  }
+  return names;
+}
+
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -396,13 +590,21 @@ export function validateRuleContent({ content, relPath, targetRoot = null, requi
  * Validates every `*.md` rule file under `dir`, recursively (skips dotfiles
  * and `_index.md`).
  *
+ * When `pluginRoot` is given, every scanned file is additionally passed through
+ * `scanVendoringLeaks()` and the findings are collected into the additive
+ * `sanitizer[]` array (issue #1098). Report-only, exactly as in `syncRules()`:
+ * a finding contributes to neither `errorCount` nor `warnCount`, so it can
+ * never change this function's `ok` verdict or its CLI's exit code.
+ *
  * @param {object} opts
  * @param {string} opts.dir - absolute path to a directory of rule files
  * @param {string|null} [opts.targetRoot] - forwarded to validateRuleContent
  * @param {boolean} [opts.requireProvenance] - forwarded to validateRuleContent
- * @returns {{ ok: boolean, files: Array<{ file: string, violations: RuleViolation[] }>, errorCount: number, warnCount: number }}
+ * @param {string|null} [opts.pluginRoot] - when provided, enables the vendoring
+ *   sanitizer scan against this plugin root
+ * @returns {{ ok: boolean, files: Array<{ file: string, violations: RuleViolation[] }>, errorCount: number, warnCount: number, sanitizer: Array<{file: string, line: number, kind: string, text: string}> }}
  */
-export function validateRulesDir({ dir, targetRoot = null, requireProvenance = false }) {
+export function validateRulesDir({ dir, targetRoot = null, requireProvenance = false, pluginRoot = null }) {
   function collectRuleFiles(absDir) {
     const files = [];
     for (const entry of readdirSync(absDir, { withFileTypes: true })) {
@@ -420,9 +622,12 @@ export function validateRulesDir({ dir, targetRoot = null, requireProvenance = f
   const entries = collectRuleFiles(dir).sort();
 
   const files = [];
+  const sanitizer = [];
   let errorCount = 0;
   let warnCount = 0;
 
+  const manifestBasenames = pluginRoot ? readManifestBasenames(pluginRoot) : null;
+
   for (const name of entries) {
     const filePath = join(dir, name);
     const content = readFileSync(filePath, 'utf8');
@@ -432,9 +637,15 @@ export function validateRulesDir({ dir, targetRoot = null, requireProvenance = f
       else if (v.severity === 'warn') warnCount++;
     }
     files.push({ file: name, violations });
+
+    if (pluginRoot) {
+      sanitizer.push(
+        ...scanVendoringLeaks({ content, relPath: name, pluginRoot, manifestBasenames }),
+      );
+    }
   }
 
-  return { ok: errorCount === 0, files, errorCount, warnCount };
+  return { ok: errorCount === 0, files, errorCount, warnCount, sanitizer };
 }
 
 // ── CLI ───────────────────────────────────────────────────────────────────────
@@ -480,13 +691,17 @@ if (isMain) {
 
   if (args.includes('--help') || args.includes('-h')) {
     process.stdout.write(
-      'Usage: validate-vendored-rules.mjs --dir <rulesDir> [--target-root <repo>] [--require-provenance] [--json] [--mode hard|warn]\n',
+      'Usage: validate-vendored-rules.mjs --dir <rulesDir> [--target-root <repo>] [--plugin-root <dir>] [--require-provenance] [--json] [--mode hard|warn]\n',
     );
     process.exit(0);
   }
 
   const dirArg = getArg('--dir');
   const targetRoot = getArg('--target-root') ?? null;
+  // Enables the report-only vendoring sanitizer (#1098). Never affects the
+  // exit code — findings are surfaced, the operator decides.
+  const pluginRootArg = getArg('--plugin-root');
+  const pluginRoot = pluginRootArg ? resolve(pluginRootArg) : null;
   const requireProvenance = args.includes('--require-provenance');
   const jsonOutput = args.includes('--json');
   const mode = getArg('--mode') ?? 'hard';
@@ -510,16 +725,23 @@ if (isMain) {
 
   let result;
   try {
-    result = validateRulesDir({ dir, targetRoot, requireProvenance });
+    result = validateRulesDir({ dir, targetRoot, requireProvenance, pluginRoot });
   } catch (err) {
     process.stderr.write(`validate-vendored-rules: error: failed to read --dir ${dir}: ${err.message}\n`);
     process.exit(2);
   }
 
   if (jsonOutput) {
-    process.stdout.write(JSON.stringify({ mode, dir, targetRoot, requireProvenance, ...result }, null, 2) + '\n');
+    process.stdout.write(
+      JSON.stringify({ mode, dir, targetRoot, pluginRoot, requireProvenance, ...result }, null, 2) + '\n',
+    );
   } else {
     process.stdout.write(formatSummary(result, dir) + '\n');
+    for (const f of result.sanitizer) {
+      process.stderr.write(
+        `validate-vendored-rules: sanitizer ${f.kind} ${f.file}:${f.line} — ${f.text}\n`,
+      );
+    }
   }
 
   const exitCode = result.errorCount > 0 && mode === 'hard' ? 1 : 0;