specpipe 1.0.0

package/src/lib/installer.js

@@ -0,0 +1,213 @@
+import { copyFile as fsCopyFile, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { chmod } from 'node:fs/promises';
+import { log } from './logger.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Component → file mappings.
+ */
+export const COMPONENTS = {
+  hooks: [
+    '.claude/hooks/file-guard.js',
+    '.claude/hooks/path-guard.sh',
+    '.claude/hooks/comment-guard.js',
+    '.claude/hooks/glob-guard.js',
+    '.claude/hooks/self-review.sh',
+    '.claude/hooks/sensitive-guard.sh',
+  ],
+  skills: [
+    'skills/sp-explore/SKILL.md',
+    'skills/sp-scaffold/SKILL.md',
+    'skills/sp-scaffold/references/ARCHITECTURE.md.tmpl',
+    'skills/sp-scaffold/references/DESIGN.md.tmpl',
+    'skills/sp-scaffold/references/adr/NNNN-template.md',
+    'skills/sp-scaffold/references/stack-profiles/react.md',
+    'skills/sp-plan/SKILL.md',
+    'skills/sp-build/SKILL.md',
+    'skills/sp-challenge/SKILL.md',
+    'skills/sp-investigate/SKILL.md',
+    'skills/sp-fix/SKILL.md',
+    'skills/sp-review/SKILL.md',
+    'skills/sp-commit/SKILL.md',
+    'skills/sp-voices/SKILL.md',
+    'skills/sp-spec-render/SKILL.md',
+    'skills/sp-spec-render/template.html',
+    'skills/sp-spec-render/components.md',
+    'skills/sp-spec-render/examples/user-auth.md',
+    'skills/sp-spec-render/examples/user-auth.html',
+    'skills/sp-md-render/SKILL.md',
+    'skills/sp-md-render/template.html',
+    'skills/sp-md-render/components.md',
+    'skills/sp-humanize/SKILL.md',
+  ],
+  config: [
+    '.claude/settings.json',
+    '.claude/CLAUDE.md',
+  ],
+  docs: [
+    'docs/WORKFLOW.md',
+  ],
+};
+
+/**
+ * Placeholder directories to create.
+ */
+export const PLACEHOLDER_DIRS = [
+  'docs/specs',
+  'docs/test-plans',
+];
+
+/**
+ * Files that need +x permission.
+ */
+export const EXECUTABLE_FILES = [
+  '.claude/hooks/path-guard.sh',
+  '.claude/hooks/self-review.sh',
+  '.claude/hooks/sensitive-guard.sh',
+];
+
+/**
+ * Get path to kit (templates) directory.
+ * Published package: cli/templates/  |  Dev mode: ../kit/
+ */
+export function getTemplateDir() {
+  const bundled = resolve(__dirname, '../../templates');
+  if (existsSync(bundled)) return bundled;
+  return resolve(__dirname, '../../../kit');
+}
+
+/**
+ * Get all files for the given component list.
+ * @param {string[]} components - e.g. ['hooks', 'skills']
+ * @returns {string[]} relative file paths
+ */
+export function getFilesForComponents(components) {
+  const files = [];
+  for (const comp of components) {
+    if (COMPONENTS[comp]) {
+      files.push(...COMPONENTS[comp]);
+    }
+  }
+  return files;
+}
+
+/**
+ * Get all installable files (all components).
+ */
+export function getAllFiles() {
+  return Object.values(COMPONENTS).flat();
+}
+
+/**
+ * Copy a single file from templates to target.
+ * @returns {string} 'copied' | 'skipped' | 'identical'
+ */
+export async function installFile(relativePath, targetDir, { force = false } = {}) {
+  const src = join(getTemplateDir(), relativePath);
+  const dst = join(targetDir, relativePath);
+
+  if (existsSync(dst) && !force) {
+    // Compare content to distinguish: identical, customized, or from another source
+    try {
+      const { hashFile } = await import('./hasher.js');
+      const srcHash = await hashFile(src);
+      const dstHash = await hashFile(dst);
+      if (srcHash === dstHash) {
+        log.same(`${relativePath} (identical)`);
+        return 'identical';
+      }
+    } catch { /* hash failed, treat as conflict */ }
+    log.warn(`${relativePath} (exists with different content — use --force to overwrite)`);
+    return 'skipped';
+  }
+
+  await mkdir(dirname(dst), { recursive: true });
+  await fsCopyFile(src, dst);
+  log.copy(relativePath);
+  return 'copied';
+}
+
+// Per-agent install (emit skills + guardrails) lives in agent-install.js;
+// re-exported here so callers keep importing from installer.js.
+export {
+  installSkillForAgent, installAgentSkills, installAgentRules,
+  mergeAgentsMdGuards, stripAgentsMdGuards,
+  installAgentHooks, removeAgentHooks,
+} from './agent-install.js';
+
+/**
+ * Create a placeholder directory with .gitkeep.
+ */
+export async function ensurePlaceholderDir(dir, targetDir) {
+  const fullPath = join(targetDir, dir);
+  if (existsSync(fullPath)) {
+    log.skip(`${dir}/ (exists)`);
+    return;
+  }
+  await mkdir(fullPath, { recursive: true });
+  await writeFile(join(fullPath, '.gitkeep'), '');
+  log.make(`${dir}/`);
+}
+
+/**
+ * Set executable permissions on relevant files.
+ */
+export async function setPermissions(targetDir) {
+  for (const file of EXECUTABLE_FILES) {
+    const fullPath = join(targetDir, file);
+    try {
+      await chmod(fullPath, 0o755);
+    } catch {
+      // File might not exist if component not installed
+    }
+  }
+}
+
+/**
+ * Fill [CUSTOMIZE] placeholders in CLAUDE.md with detected project info.
+ */
+export async function fillTemplate(targetDir, projectInfo) {
+  if (!projectInfo) return;
+
+  const claudeMdPath = join(targetDir, '.claude/CLAUDE.md');
+  try {
+    let content = await readFile(claudeMdPath, 'utf-8');
+    content = content
+      .replace(/\[CUSTOMIZE\] Language:.*/, `**Language:** ${projectInfo.lang}`)
+      .replace(/\[CUSTOMIZE\] Test framework:.*/, `**Test framework:** ${projectInfo.framework}`)
+      .replace(/\[CUSTOMIZE\] Source directory:.*/, `**Source directory:** ${projectInfo.srcDir}`)
+      .replace(/\[CUSTOMIZE\] Test directory:.*/, `**Test directory:** ${projectInfo.testDir}`)
+      // Also handle the format without [CUSTOMIZE] prefix
+      .replace(/\*\*Language:\*\* \[CUSTOMIZE\]/, `**Language:** ${projectInfo.lang}`)
+      .replace(/\*\*Test framework:\*\* \[CUSTOMIZE\]/, `**Test framework:** ${projectInfo.framework}`)
+      .replace(/\*\*Source directory:\*\* \[CUSTOMIZE\]/, `**Source directory:** ${projectInfo.srcDir}`)
+      .replace(/\*\*Test directory:\*\* \[CUSTOMIZE\]/, `**Test directory:** ${projectInfo.testDir}`);
+    await writeFile(claudeMdPath, content);
+  } catch {
+    // CLAUDE.md might not exist
+  }
+}
+
+/**
+ * Verify settings.json is valid JSON.
+ */
+export async function verifySettingsJson(targetDir) {
+  try {
+    const raw = await readFile(join(targetDir, '.claude/settings.json'), 'utf-8');
+    JSON.parse(raw);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Claude's global install (~/.claude/skills + hooks + settings.json) lives in
+// claude-global.js; re-exported here so callers keep importing from installer.js.
+export {
+  getGlobalSkillsDir, getGlobalHooksDir, installHookGlobal,
+  mergeGlobalSettings, removeGlobalHooksFromSettings, installSkillGlobal,
+} from './claude-global.js';

package/src/lib/logger.js

@@ -0,0 +1,16 @@
+import chalk from 'chalk';
+
+export const log = {
+  info:  (msg) => console.log(chalk.blue('[INFO]'), msg),
+  pass:  (msg) => console.log(chalk.green('[PASS]'), msg),
+  fail:  (msg) => console.log(chalk.red('[FAIL]'), msg),
+  warn:  (msg) => console.log(chalk.yellow('[WARN]'), msg),
+  skip:  (msg) => console.log(chalk.gray('[SKIP]'), msg),
+  copy:  (msg) => console.log(chalk.cyan('[COPY]'), msg),
+  del:   (msg) => console.log(chalk.red('[DEL]'), ' ', msg),
+  keep:  (msg) => console.log(chalk.green('[KEEP]'), msg),
+  make:  (msg) => console.log(chalk.cyan('[MAKE]'), msg),
+  adopt: (msg) => console.log(chalk.magenta('[ADOPT]'), msg),
+  same:  (msg) => console.log(chalk.gray('[SAME]'), msg),
+  blank: ()    => console.log(),
+};

package/src/lib/manifest.js

@@ -0,0 +1,102 @@
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { hashFile } from './hasher.js';
+
+// Neutral, agent-agnostic location. Older installs used .claude/ — still read
+// as a fallback so existing projects migrate on their next write.
+export const MANIFEST_FILE = '.specpipe/manifest.json';
+export const LEGACY_MANIFEST_FILE = '.claude/.devkit-manifest.json';
+
+/**
+ * Read manifest from target directory (new location, then legacy fallback).
+ * @returns {object|null}
+ */
+export async function readManifest(targetDir) {
+  for (const rel of [MANIFEST_FILE, LEGACY_MANIFEST_FILE]) {
+    try {
+      return JSON.parse(await readFile(join(targetDir, rel), 'utf-8'));
+    } catch { /* try next */ }
+  }
+  return null;
+}
+
+/**
+ * Write manifest to target directory (always to the new neutral location).
+ */
+export async function writeManifest(targetDir, manifest) {
+  const filePath = join(targetDir, MANIFEST_FILE);
+  await mkdir(dirname(filePath), { recursive: true });
+  await writeFile(filePath, JSON.stringify(manifest, null, 2) + '\n');
+}
+
+/** Agents recorded in a manifest, defaulting to Claude for legacy installs. */
+export function getAgents(manifest) {
+  return manifest?.agents?.length ? manifest.agents : ['claude'];
+}
+
+/** Union of already-installed agents (from manifest) with newly requested ones, order-stable. */
+export function mergeAgents(existing, requested) {
+  const seen = new Set();
+  const out = [];
+  for (const a of [...(existing || []), ...requested]) {
+    if (!seen.has(a)) { seen.add(a); out.push(a); }
+  }
+  return out;
+}
+
+/**
+ * Create a new empty manifest.
+ */
+export function createManifest(version, projectType, components) {
+  const now = new Date().toISOString();
+  return {
+    version,
+    installedAt: now,
+    updatedAt: now,
+    projectType: projectType || null,
+    components: components || ['hooks', 'skills', 'scripts', 'docs'],
+    agents: ['claude'],
+    files: {},
+  };
+}
+
+/**
+ * Add or update a file entry in the manifest.
+ * `installedPath` is the on-disk key. `agent`/`templateRel` let lifecycle
+ * commands reproduce the file's desired content (default: Claude, verbatim).
+ */
+export function setFileEntry(manifest, installedPath, kitHash, installedHash, { agent = 'claude', templateRel } = {}) {
+  manifest.files[installedPath] = {
+    agent,
+    templateRel: templateRel || installedPath,
+    kitHash,
+    installedHash: installedHash || kitHash,
+    customized: installedHash ? installedHash !== kitHash : false,
+  };
+}
+
+/**
+ * Check if a file has been customized by the user.
+ */
+export function isCustomized(manifest, relativePath) {
+  const entry = manifest?.files?.[relativePath];
+  if (!entry) return false;
+  return entry.customized;
+}
+
+/**
+ * Refresh customization status by re-hashing installed files.
+ */
+export async function refreshCustomizationStatus(targetDir, manifest) {
+  for (const [relativePath, entry] of Object.entries(manifest.files)) {
+    try {
+      const currentHash = await hashFile(join(targetDir, relativePath));
+      entry.installedHash = currentHash;
+      entry.customized = currentHash !== entry.kitHash;
+    } catch {
+      // File was deleted
+      entry.installedHash = null;
+      entry.customized = true;
+    }
+  }
+}

package/src/lib/reconcile.js

@@ -0,0 +1,56 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { hashContent } from './hasher.js';
+import { getAllFiles, COMPONENTS, getTemplateDir } from './installer.js';
+import { emitFile, emitRules } from './agents.js';
+
+export const GUARDS_TEMPLATE_REL = 'rules/specpipe-guards.md';
+
+/**
+ * Template files a given agent receives. Claude gets the full kit
+ * (hooks + config + docs + skills); every other agent gets skills only —
+ * their guardrails are emitted separately from kit/rules (see emitRules), since
+ * hooks are Claude-specific.
+ */
+export function templateFilesForAgent(agentId) {
+  return agentId === 'claude' ? getAllFiles() : COMPONENTS.skills;
+}
+
+/**
+ * Compute the desired installed state for a set of agents.
+ * @param {string[]} agents
+ * @returns {Promise<Map<string, {agent, templateRel, content, kitHash}>>}
+ *          keyed by installed (on-disk) relative path.
+ */
+export async function computeDesired(agents) {
+  const dir = getTemplateDir();
+  const desired = new Map();
+  const guardsBody = await readFile(join(dir, GUARDS_TEMPLATE_REL), 'utf-8');
+
+  for (const agent of agents) {
+    for (const templateRel of templateFilesForAgent(agent)) {
+      const content = await readFile(join(dir, templateRel), 'utf-8');
+      const emitted = emitFile(agent, templateRel, content);
+      desired.set(emitted.path, {
+        agent,
+        templateRel,
+        content: emitted.content,
+        kitHash: hashContent(emitted.content),
+      });
+    }
+
+    // Owned guardrails files (Cursor .mdc, Antigravity rule, OpenClaw/Hermes doc)
+    // are reconciled like any other file. Codex's AGENTS.md is shared, not owned
+    // here — it's merged/stripped separately.
+    const rules = emitRules(agent, guardsBody);
+    if (rules && rules.mode !== 'agents-md') {
+      desired.set(rules.path, {
+        agent,
+        templateRel: GUARDS_TEMPLATE_REL,
+        content: rules.content,
+        kitHash: hashContent(rules.content),
+      });
+    }
+  }
+  return desired;
+}

package/templates/.claude/CLAUDE.md

@@ -0,0 +1,79 @@
+# Project Rules
+
+## Spec-First Development
+
+Every change follows this cycle: **SPEC (with acceptance scenarios) → CODE + TESTS → BUILD PASS**.
+
+- Business logic specs live in `docs/specs/<feature>/<feature>.md`
+- Acceptance scenarios (Given/When/Then) are embedded in the spec under `## Stories`
+- Never write code before the spec exists. Never auto-modify specs from code.
+- Specs are the source of truth. If code contradicts the spec, the code is wrong.
+
+## Workflow Quick Reference
+
+| Trigger | Commands | Details |
+|---------|----------|---------|
+| New project (no codebase yet) | `/sp-explore` (greenfield) → `/sp-scaffold` → `/sp-plan` → `/sp-build` | Scaffolds a runnable skeleton + ARCHITECTURE/ADRs before the first spec; `/sp-build` Foundation Gate blocks the TDD loop until a runnable harness exists |
+| Feature unclear / complex | `/sp-explore` → `/sp-plan` | Clarify requirements before writing spec |
+| New feature | `/sp-plan` → `/sp-challenge` (optional) → code in chunks → `/sp-build` each chunk | Start with spec or description |
+| Update feature | `/sp-plan <spec-path> "changes"` → code → `/sp-build` | Do NOT manually edit spec before /sp-plan |
+| Bug (complex/outage) | `/sp-investigate "description"` → `/sp-fix <investigation-file>` | OPTIONAL: diagnose root cause + blast radius before fixing |
+| Bug fix | `/sp-fix "description"` | Test-first: write failing test → fix → green |
+| Remove feature | `/sp-plan <spec-path> "remove stories"` → delete code + tests → build pass | /sp-plan handles snapshot before removal |
+| Pre-merge check | `/sp-review` | Diff-based quality gate |
+| Commit changes | `/sp-commit` | Secret scan + conventional commit |
+| Render spec HTML | `/sp-spec-render <feature>` | Generates scannable `<feature>.html` (sidebar TOC, story cards). Run after `/sp-plan` if you want the HTML view, or to refresh a stale one |
+| Render any markdown HTML | `/sp-md-render <file.md>` | Generic counterpart to `/sp-spec-render` for non-spec markdown (investigation, explore, RFC, retro, README). Callouts, step cards, Mermaid, dark/light theme |
+| Multi-LLM review | `/sp-voices [target]` | Send material to 2–3 LLMs, synthesize consensus + disagreements |
+| Rephrase to human voice | `/sp-humanize [text]` | Turn plan/notes/AI output into natural, send-ready text. Infers format + audience + tone, strips AI tone. Not part of the dev cycle |
+
+For detailed workflow steps, templates, and decision trees, see `docs/WORKFLOW.md`.
+
+## Testing
+
+- **Run tests:** use the project's native test command (e.g. `npx vitest run`, `swift test`, `python3 -m pytest`, `cargo test`, `go test ./...`). `/sp-build` and `/sp-fix` auto-detect it from project markers.
+- **Compile/typecheck BEFORE running tests.** Catch syntax errors early.
+- **Max 3 fix loops** for test failures. If tests still fail after 3 attempts, stop and report.
+- **NEVER fix production code** to make a test pass — ask the user first.
+- **No mocks, fakes, stubs, or cheats** to pass builds. Real implementations only.
+  Test doubles are acceptable only when they replace external services (APIs, databases)
+  that cannot run locally.
+
+## Project Info
+
+> Fill these in when setting up the project (or let `setup.sh` do it automatically).
+
+- **Language:** [CUSTOMIZE]
+- **Test framework:** [CUSTOMIZE]
+- **Source directory:** [CUSTOMIZE]
+- **Test directory:** [CUSTOMIZE]
+
+## Conventions
+
+- **Commits:** Conventional format — `type(scope): description`
+  Types: `feat`, `fix`, `docs`, `refactor`, `test`, `chore`, `perf`, `build`, `ci`
+- **File naming:** Descriptive enough that AI tools understand the purpose from the path alone.
+  Prefer kebab-case for new files (e.g., `user-authentication-service.ts`).
+- **Dates in filenames:** Use `$(date +%Y-%m-%d)` — never guess dates.
+- **Spec naming:**
+  - kebab-case, lowercase: `user-auth/user-auth.md`, `file-sync/file-sync.md`
+  - Feature name, not module name: `user-auth/` not `AuthService/`
+  - Each feature gets its own directory: `docs/specs/<feature>/<feature>.md`
+  - Short (2-3 words): `payment-flow/` not `payment-processing-with-stripe-integration/`
+  - No prefix/suffix: `user-auth.md` not `spec-user-auth.md`
+
+## Forbidden
+
+These patterns are never acceptable in this project:
+
+- `any` / `Any` type without explicit justification in a comment
+- Force unwrap (`!`) or force cast (`as!`) without a preceding guard
+- Hardcoded secrets, API keys, tokens, or credentials in source files
+- Mocks or fake data used solely to make tests pass
+- `git push --force` to main or master branches
+- Editing generated files, vendor directories, or lock files
+- Committing `.env` files, certificates, or private keys
+- Ignoring compiler/linter warnings without documented reason
+- Replacing real code with placeholder comments like `// ... existing code ...`
+- Renaming parameters to `_param` instead of actually fixing unused parameter issues
+- Reading or writing `.env`, `.pem`, `.key`, or other sensitive files (use `.env.example` for templates)

package/templates/.claude/hooks/comment-guard.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+// comment-guard.js — PreToolUse hook for Claude Code
+//
+// Detects when an Edit would replace real code with placeholder comments like
+// "// ... existing code ..." or "// rest of implementation". This is a
+// common LLM failure mode where the model gets lazy and drops code.
+//
+// Blocking: Yes — exits 2 to reject the edit BEFORE it is applied.
+// Event: PreToolUse on Edit|MultiEdit
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+// Patterns that indicate lazy placeholder comments (case-insensitive)
+const PLACEHOLDER_PATTERNS = [
+  /\/\/\s*\.{2,}\s*(existing|remaining|rest|previous|other|same|original)/i,
+  /\/\/\s*\.{2,}\s*(code|implementation|logic|methods|functions|properties)/i,
+  /\/\/\s*\[.*(?:remains?|unchanged|omitted|removed|truncated|collapsed).*\]/i,
+  /\/\/\s*(?:unchanged|omitted|keep|stays?)\s*(?:as\s*(?:is|before))?/i,
+  /\/\*\s*\.{2,}\s*\*\//,                          // /* ... */
+  /#\s*\.{2,}\s*(existing|remaining|rest|previous)/i,  // Python: # ... existing
+  /\/\/\s*TODO:?\s*implement/i,                     // // TODO: implement
+  /\/\/\s*(?:add|put|insert)\s+.*\s+here/i,         // // add code here
+  /\/\/\s*<\s*(?:your|actual)\s+/i,                 // // <your code>
+  /pass\s*#\s*(?:TODO|placeholder|implement)/i,     // Python: pass # TODO
+];
+
+function isCommentLine(line) {
+  const trimmed = line.trim();
+  if (trimmed === "") return true; // blank lines are neutral
+  if (trimmed.startsWith("//")) return true;
+  if (trimmed.startsWith("#") && !trimmed.startsWith("#!")) return true;
+  if (trimmed.startsWith("/*") || trimmed.startsWith("*") || trimmed.endsWith("*/")) return true;
+  if (trimmed.startsWith("<!--")) return true;
+  if (trimmed === "pass" || /^pass\s*#/.test(trimmed)) return true; // Python pass / pass # comment
+  return false;
+}
+
+function getCodeLineCount(text) {
+  if (!text) return 0;
+  return text.split("\n").filter((line) => !isCommentLine(line)).length;
+}
+
+function hasPlaceholderPattern(text) {
+  return PLACEHOLDER_PATTERNS.some((pattern) => pattern.test(text));
+}
+
+function main() {
+  let input;
+  try {
+    input = fs.readFileSync(0, "utf-8").trim();
+  } catch {
+    process.exit(0);
+  }
+
+  if (!input) process.exit(0);
+
+  let payload;
+  try {
+    payload = JSON.parse(input);
+  } catch {
+    process.exit(0);
+  }
+
+  // Skip files outside the project directory (e.g. ~/.claude/plans/)
+  const filePath = payload.tool_input?.file_path;
+  if (filePath) {
+    const projectDir = process.cwd() + path.sep;
+    const resolved = path.resolve(filePath);
+    if (!resolved.startsWith(projectDir) && resolved !== process.cwd()) process.exit(0);
+  }
+
+  const oldStr = payload.tool_input?.old_string;
+  const newStr = payload.tool_input?.new_string;
+
+  // Only applies to Edit (not Write — Write creates new content)
+  if (!oldStr || !newStr) process.exit(0);
+
+  // If old content was already all comments, this is just editing comments — allow
+  const oldCodeLines = getCodeLineCount(oldStr);
+  if (oldCodeLines === 0) process.exit(0);
+
+  // If new content has real code, allow (even if it also has comments)
+  const newCodeLines = getCodeLineCount(newStr);
+  if (newCodeLines > 0) process.exit(0);
+
+  // At this point: old had code, new is all comments/blanks
+  // Check if the new content contains placeholder patterns
+  if (hasPlaceholderPattern(newStr)) {
+    process.stderr.write(
+      "Blocked: real code was replaced with placeholder comments. " +
+      "Preserve the original code and make targeted changes instead.\n"
+    );
+    process.exit(2);
+  }
+
+  // New is all comments but no placeholder pattern — could be intentional
+  // (e.g., replacing a code block with documentation comments)
+  // Allow but only if the replacement is not drastically shorter
+  const oldLines = oldStr.split("\n").length;
+  const newLines = newStr.split("\n").length;
+
+  // Allow 1-2 line replacements: a brief deletion note ("// Removed in v2") is
+  // intentional removal, not truncation. Only multi-line comment blocks that are
+  // still much shorter than the original suggest lazy placeholder replacement.
+  if (newLines > 2 && newLines < oldLines * 0.3) {
+    // Suspiciously shorter and all comments — likely lazy replacement
+    process.stderr.write(
+      "Blocked: code block was replaced with a much shorter comment-only block. " +
+      "This looks like an accidental truncation. Preserve the original code.\n"
+    );
+    process.exit(2);
+  }
+
+  // Seems intentional
+  process.exit(0);
+}
+
+try {
+  main();
+} catch {
+  // Never crash — allow on error
+  process.exit(0);
+}