fix(test): flag recursive rm in a parameter decorator of a same-named parameter

[ScriptedAlchemy]

Follow-up to #825, covering the two should-fix gaps from its independent verification of the scripts/check-test-remove-tree.mjs lint gate.

Parameter decorator false negative: reproduced and fixed

On origin/main, an imported rm called inside a parameter decorator was missed when the parameter itself was named rm:

import { rm } from 'node:fs/promises';
class Suite { run(@hook(rm(root, { recursive: true })) rm) {} }

The same miss happened with constructor parameters and with namespace imports (fs.rm with a parameter named fs). The shadow walk climbed out through the Parameter node, so functionLikeDeclares counted the parameter's own name. JavaScript evaluates parameter decorators in the scope around the method. The fix makes the walk skip the method's parameter and body scopes when it leaves a parameter decorator. The new test cases failed on main ([] instead of lines 3 and 4) and pass with the fix.

var hoisting: no false negative, tests only

The gate treats a var as block-scoped. It only counts a var as hiding the import when the var statement sits in a block that encloses the call. A var's real scope is the nearest function, static block, or module, and that scope always contains the declaring block. So any call the gate treats as hidden really is hidden, and a var can only cause extra flags. The ponytail: comment is accurate. A new test pins the cases that must still be flagged: a nested-block var in a sibling function, in the body of a function whose parameter default calls rm, and in a class static block.

Checks

Run on a tree that contains origin/main ff7421ba8b (tree 89ba465606, identical to this PR's head):

• pnpm build: exit 0
• pnpm typecheck: exit 0
• pnpm lint (includes the gate): exit 0
• pnpm test:unit: 4432 passed, 0 failed, 6 skipped
• rstest packages/agent-bundle/tests/check-test-remove-tree.test.ts: 17/17

Independent review by change-risk-reviewer (Claude Opus 5.5) found no material findings. It confirmed the jump can only remove shadowing, so it can't create a new miss, and found no var counterexample.

No changeset: only root scripts/ and packages/agent-bundle/tests/** change, and both are exempt per .changeset/README.md.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4ca5370

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T02:45:48.201082Z	4ca5370	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.