fix(scripts): burn 25 of the 35 KNOWN_IMPORT_UNSAFE entry-guard debts down (#10704)

* fix(scripts): guard check-skill-id-lint against running on import

* fix(scripts): guard check-skill-line-ratchet against running on import

* fix(scripts): guard check-label-desc-cap against running on import

* fix(scripts): guard ablation-dist-preflight against running on import

* fix(scripts): guard check-driver-memory-census against running on import

* fix(scripts): guard check-examples-live-imports against running on import

* fix(scripts): guard check-nul-bytes against running on import

* fix(scripts): guard check-ratchet-remedy-authority against running on import

* fix(scripts): guard check-required-contexts against running on import

* fix(scripts): guard check-route-envelope against running on import

* fix(scripts): guard check-runtime-services-index against running on import

* fix(scripts): guard check-shard-attestation against running on import

* fix(scripts): guard check-spec-parsed-alias against running on import

* fix(scripts): guard check-startup-registry-verdict against running on import

* fix(scripts): guard check-workflow-status-functions against running on import

* fix(scripts): guard check-error-code-casing against running on import

* fix(scripts): guard check-dispatcher-error-vocabulary against running on import

* fix(scripts): guard check-engine-split-ratio against running on import

* fix(scripts): guard check-filter-alias-parity against running on import

* fix(scripts): guard check-org-identifier against running on import

* fix(scripts): guard check-quick-reference-counts against running on import

* fix(scripts): guard check-test-completeness against running on import

* fix(scripts): guard measure-test-shard-timings against running on import

* fix(scripts): guard check-tenant-chokepoint against running on import

* fix(scripts): guard check-audit-scope against running on import

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

scripts/ablation-dist-preflight.mjs

@@ -144,6 +144,7 @@ import { join, relative, resolve, extname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const REPO_ROOT = resolve(fileURLToPath(import.meta.url), '..', '..');
 
@@ -394,5 +395,10 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else run(argv);

scripts/check-dispatcher-error-vocabulary.mjs

@@ -152,6 +152,7 @@
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative, dirname, resolve } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = resolve(new URL('..', import.meta.url).pathname);
 const SCAN_ROOT = 'packages';
@@ -1826,4 +1827,7 @@ function main() {
   console.log(bounds);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

scripts/check-driver-memory-census.mjs

@@ -109,6 +109,7 @@ import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const LEDGER_PATH = join(ROOT, 'scripts', 'driver-memory-census.ledger.json');
@@ -683,5 +684,10 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else report({ list: argv.includes('--list') });

scripts/check-engine-split-ratio.mjs

@@ -74,6 +74,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { historyHorizon } from './pm/git-history.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -334,4 +335,7 @@ function selfTest() {
   return failures === 0 ? 0 : 1;
 }
 
-process.exit(process.argv.includes('--self-test') ? selfTest() : main(process.argv.slice(2)));
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  process.exit(process.argv.includes('--self-test') ? selfTest() : main(process.argv.slice(2)));
+}

scripts/check-entry-guard.mjs

@@ -435,39 +435,14 @@ export function importUnsafeStatements(source) {
  * names itself, which is what stops this from rotting into an allowlist.
  */
 const KNOWN_IMPORT_UNSAFE = new Set([
-  'scripts/ablation-dist-preflight.mjs',
   'scripts/check-changeset-no-major.mjs',
-  'scripts/check-dispatcher-error-vocabulary.mjs',
-  'scripts/check-driver-memory-census.mjs',
   'scripts/check-empty-changeset.mjs',
-  'scripts/check-engine-split-ratio.mjs',
-  'scripts/check-error-code-casing.mjs',
   'scripts/check-error-status-conformance.mjs',
-  'scripts/check-examples-live-imports.mjs',
-  'scripts/check-filter-alias-parity.mjs',
-  'scripts/check-nul-bytes.mjs',
-  'scripts/check-org-identifier.mjs',
   'scripts/check-query-options-erasure-ratchet.mjs',
-  'scripts/check-quick-reference-counts.mjs',
-  'scripts/check-ratchet-remedy-authority.mjs',
   'scripts/check-release-page-status.mjs',
-  'scripts/check-required-contexts.mjs',
-  'scripts/check-route-envelope.mjs',
-  'scripts/check-runtime-services-index.mjs',
-  'scripts/check-shard-attestation.mjs',
-  'scripts/check-spec-parsed-alias.mjs',
-  'scripts/check-startup-registry-verdict.mjs',
-  'scripts/check-tenant-chokepoint.mjs',
-  'scripts/check-test-completeness.mjs',
-  'scripts/check-workflow-status-functions.mjs',
   'scripts/checklist-select.mjs',
-  'scripts/docs-audit/check-audit-scope.mjs',
-  'scripts/measure-test-shard-timings.mjs',
   'scripts/objectui-range.mjs',
   'scripts/pm/check-governed-prose.mjs',
-  'scripts/pm/check-label-desc-cap.mjs',
-  'scripts/pm/check-skill-id-lint.mjs',
-  'scripts/pm/check-skill-line-ratchet.mjs',
   'scripts/qa/qa-rollup.mjs',
   'scripts/ts-parse.mjs',
 ]);

scripts/check-error-code-casing.mjs

@@ -53,6 +53,7 @@
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { maskComments } from './js-comment-mask.mjs';
 import { join, relative, sep } from 'node:path';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
 const SCAN_ROOTS = ['packages'];
@@ -241,4 +242,7 @@ If this literal is NOT an error.code — a field/param-addressed validator code
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

scripts/check-examples-live-imports.mjs

@@ -122,6 +122,7 @@ import { globToRegExp } from './check-cross-package-test-inputs.mjs';
 import { join, resolve, relative, dirname, sep, posix } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import process from 'node:process';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
@@ -759,7 +760,12 @@ function selfTest() {
 }
 
 const argv = process.argv.slice(2);
-if (argv.includes('--self-test')) selfTest();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (argv.includes('--self-test')) selfTest();
 else if (argv.includes('--list')) list();
 else if (argv.includes('--json')) {
   const { rows, unresolved } = collect();

scripts/check-filter-alias-parity.mjs

@@ -88,6 +88,7 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
@@ -648,4 +649,7 @@ function main() {
     process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}

scripts/check-nul-bytes.mjs

@@ -269,6 +269,7 @@ import { lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, w
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isEntrypoint } from './invoked-as.mjs';
 
 /**
  * The scanned set as a 256-entry lookup: every ASCII control character except
@@ -1155,7 +1156,12 @@ function selfTest() {
   console.log(`✓ check-nul-bytes --self-test: ${checked} assertions over a temp git repo (real scan() path)`);
 }
 
-if (process.argv.includes('--self-test')) {
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+const invokedDirectly = isEntrypoint(import.meta.url);
+
+if (!invokedDirectly) {
+  // imported as a module — expose the exports and do nothing else
+} else if (process.argv.includes('--self-test')) {
   selfTest();
 } else if (process.argv.includes('--list')) {
   const result = scan(repoRoot());

scripts/check-org-identifier.mjs

@@ -271,6 +271,7 @@ import { join } from 'node:path';
 import ts from 'typescript';
 import { parseSourceFile } from './ts-parse.mjs';
 import { maskComments } from './js-comment-mask.mjs';
+import { isEntrypoint } from './invoked-as.mjs';
 
 const ROOTS = ['examples', 'apps', 'packages'];
 const EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.cts', '.mts'];
@@ -785,4 +786,7 @@ cheapest way to silence it while leaving the dead read in place.`);
   process.exit(1);
 }
 
-main();
+// Exports bindings, so an import for those exports alone must run nothing (#10667).
+if (isEntrypoint(import.meta.url)) {
+  main();
+}