fix(test): close remove-tree lint AST false positives and negatives

[ScriptedAlchemy]

After #823, scripts/check-test-remove-tree.mjs still missed four parser-backed cases Codex flagged.

Fixes

• Shorthand maxRetries: { recursive: true, maxRetries } is accepted (ShorthandPropertyAssignment).
• Shadowed rm: a later local binding after import { rm } from 'node:fs' is not treated as Node-bound.
• promises rebind: import { promises as fs } from 'node:fs' (or 'fs') is a namespace / .rm carrier.
• Option wrappers: unwrap AsExpression, ParenthesizedExpression, and SatisfiesExpression so { recursive: true } as const is still seen as recursive.

The gate stays typescript-5 AST-backed. No regex / text masking.

Tests

packages/agent-bundle/tests/check-test-remove-tree.test.ts now covers both directions:

• shorthand maxRetries is OK
• shadowed local rm is ignored; unshadowed Node rm still fails
• import { promises as fs } from 'node:fs' + recursive rm without maxRetries fails; with maxRetries passes
• { recursive: true } as const without maxRetries fails; with maxRetries passes
• parenthesized / satisfies wrappers without retries still fail

Existing removeTree helper exemption and good-path cases stay in the file.

Notes

• Scripts + tests/** only; no changeset (publishable changedFilePatterns exempts tests/**).

Verification

Ran after pnpm build (rstest dist-freshness):

pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/check-test-remove-tree.test.ts
# pass — 13/13, including the two new regressions

pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/support/remove-tree.test.ts
# pass — 2/2

node scripts/check-test-remove-tree.mjs
# exit 0 — no false positives on the live test trees

Local merge gate (head 7fde282, contains origin/main b0b131b)

Merged origin/main cleanly (no conflicts). Commands and results:

Command	Result
pnpm install --frozen-lockfile	ok
pnpm build	exit 0
pnpm typecheck	exit 0
pnpm lint (rslint . + node scripts/check-test-remove-tree.mjs)	exit 0
pnpm test:unit	exit 0: 4488 passed, 0 failed
rstest ... check-test-remove-tree.test.ts	16/16 pass
node scripts/check-test-remove-tree.mjs	exit 0, no false positives on the live test trees

Follow-up fixes on this branch

• Codex thread: for / for-of / for-in initializer bindings, case/default clause declarations, and named function expressions now count as shadows.
• Independent review (change-risk-reviewer, GPT-5.6) found a blocker: a method parameter hid an imported rm used in that method's computed key or decorator (false negative). Fixed by applying a parameter shadow only when the lookup comes from the function body or parameters. Regression tests were added, and the reviewer confirmed the fix.
• Reviewer should-fix, var hoisting: declined. A var hoisted out of a nested block is treated as block-scoped, so the gate can only produce a false positive here, never a false negative. The limit is documented with a ponytail: comment.
• Reviewer coverage gaps: replaced the invalid duplicate top-level shadow fixture with an inner-scope one. Added for-in, default-clause, <const> assertion, TSX/.mjs file-kind, and retry-positive wrapper cases.
• recursiveRmCalls now passes fileName to removalBindings, so .tsx and .mjs files are parsed with the correct script kind.

No changeset: only root scripts/ (not a package) and tests/** (excluded by .changeset/config.json) change. The Changeset present check is green.

  

Root verification verdict: PASS+NOTES at 7fde282430

Base b0b131bbf7 (current origin/main), head 7fde282430. The verdict pins this head. A new head with a different patch-id voids it.

Independent lanes, none run by the PR owner:

Lane	Model	Result
Gates at head: pnpm install --frozen-lockfile, build, typecheck, lint, test:unit, focused rstest, node scripts/check-test-remove-tree.mjs	Grok 4.7 (commands only)	PASS. test:unit 4488 passed, 0 failed, 6 skipped. Focused 18/18. Lint exit 0.
Live CLI probes, trunk script vs head script, 30 crafted test files	GPT-5.6 Sol	PASS+NOTES. Trunk gives the right verdict on 7/30, head on 23/30. No probe that trunk got right regressed.
Diff and receipts audit	Claude Fable 5.1	PASS+NOTES. Changeset exemption holds (tests/** is package-relative, root package.json is private). The var hoisting decline holds: it can only cause false positives.

Should-fix, not blocking:

• A parameter decorator that calls the imported rm, on a parameter that is itself named rm, is flagged on trunk and missed at head. The parameter shadow is applied to the decorator expression, which JavaScript evaluates in the outer scope. The repro is import { rm } from 'node:fs/promises'; class S { run(@hook(rm(root, { recursive: true })) rm) {} }. recursiveRmCalls returns line 2 on trunk and nothing at head. The input is contrived, so this does not block.
• unwrapExpression skips NonNullExpression, so rm(root, { recursive: true }!) passes. Trunk misses it too. The canonical unwrap in packages/agent-bundle/src/config/state-extract.ts handles it.

Notes:

• The shared false negatives on trunk and head are out of this PR's scope: const { rm } = await import(...), require('node:fs').rm, fs.promises.rm on a default import, maxRetries: 0, recursive passed through a variable, and rmSync.
• The PR body's earlier "13/13" line is stale. The test file has 16 cases, and the gate table's 16/16 matches.

CI at this head was still running when this verdict was written. Merge after it is green.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 75d3300

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@825

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@825

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@825

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@825

commit: 7fde282

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aeb8c3f1c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T05:21:37.432719Z	aeb8c3f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.