* feat(#2982): extend no-source-grep lint to catch var-binding readFileSync.includes()
The base lint (scripts/lint-no-source-grep.cjs) only catches
readFileSync(...).<text-method>() chained directly. The much more
common var-binding form escapes it:
const src = fs.readFileSync(p, 'utf8');
// 50 lines later
if (src.includes('foo')) {} // ← still grep, lint missed it
Scan of the test suite found ~141 files using this pattern.
Implementation built TDD per #2982 with structured-IR assertions:
scripts/lint-no-source-grep-extras.cjs
- detectVarBindingViolations(src) — pure detector, two passes:
pass 1 collects vars bound from readFileSync, pass 2 finds any
<var>.<includes|startsWith|endsWith|match|search>( on those vars.
- detectWrappedAssertOkMatch(src) — flags
assert.ok(<expr>.match(...)) which escapes the assert.match rule.
- VIOLATION enum exposes stable codes for tests to assert on.
scripts/lint-no-source-grep.cjs
- Wires the new detectors into the existing per-file check; one
additional violation row per file with the first 3 sample tokens.
tests/bug-2982-lint-var-binding.test.cjs
- 13 tests, all assertions on typed VIOLATION enum / structured
records. Covers all 5 text-match methods, multi-var, no-bind,
string literal (must NOT trigger), wrapped assert.ok(.match),
and assert.match (must NOT double-flag).
Migration backlog (#2974 expanded scope):
- 42 files annotated `// allow-test-rule: source-text-is-the-product`
(legitimate — they read .md/.json/.yml files whose deployed text
IS the product)
- 3 files annotated `// allow-test-rule: pending-migration-to-typed-ir [#2974]`
(read .cjs/.js source — clear migration debt)
- 95 files annotated `pending-migration-to-typed-ir [#2974]` with
`Per-file review may reclassify as source-text-is-the-product
during migration` (mixed — manual review under #2974)
After this lands the lint reports 0 violations on main; new
violations in PRs surface immediately.
Closes#2982
Refs #2974
* test(#2982): fix truncated test name per CR
The label ended with a bare '(' from a copy-paste mishap. Now reads
'does NOT flag .matchAll(...) — matchAll is not match, so
assert.ok(.matchAll(...)) is not flagged'.
* chore(#2982): add changeset fragment for PR #2985
* chore(#2982): add changeset fragment for PR #2985
Running git clean inside a worktree treats files committed on the feature
branch as untracked — from the worktree's perspective they were never staged.
The executor deletes them, then commits only its own deliverables; when the
worktree branch merges back the deletions land on the main branch, destroying
prior-wave work (documented across 8 incidents, including commit c6f4753
"Wave 2 executor incorrectly ran git-clean on the worktree").
- Add <destructive_git_prohibition> block to gsd-executor.md explaining
exactly why git clean is unsafe in worktree context and what to use instead
- Add regression tests (bug-2075-worktree-deletion-safeguards.test.cjs)
covering Failure Mode B (git clean prohibition), Failure Mode A
(worktree_branch_check presence audit across all worktree-spawning
workflows), and both defense-in-depth deletion checks from #1977
Failure Mode A and defense-in-depth checks (post-commit --diff-filter=D in
gsd-executor.md, pre-merge --diff-filter=D in execute-phase.md) were already
implemented — tests confirm they remain in place.
Fixes#2075
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
