fix(audits): resolve import specifiers to module files only; tighten review-flagged guidance

Author: waleedlatif1

.agents/skills/add-connector/SKILL.md

@@ -541,7 +541,7 @@ If `ExternalDocument.sourceUrl` is set, the sync engine stores it on the documen
 
 If `listDocuments` can ever return **less than the full source set** on a non-incremental sync — a `maxItems`/`maxDocuments`-style cap, or a transient per-item error that drops a still-existing document from the listing — it MUST set `syncContext.listingCapped = true` when that happens.
 
-The engine reconciles deletions only when the listing is marked safe (`checkpoint.unsafe` in `lib/knowledge/connectors/listing-checkpoint.ts`): `syncContext.listingCapped`, `ExternalDocumentList.reconciliationSafe: false` (required for offset/unstable pagination), or a non-null `listingFailures` marks it unsafe. Anything absent from a safe listing is tombstoned on that sync and hard-deleted when the next sync still does not see it — so a truncated listing without this flag eventually removes every real document beyond the cap.
+The engine reconciles deletions only when the listing is marked safe (`checkpoint.unsafe` in `lib/knowledge/connectors/listing-checkpoint.ts`): `syncContext.listingCapped`, `syncContext.listingTruncated`, `syncContext.reconciliationUnsafe`, `ExternalDocumentList.reconciliationSafe: false` (required for offset/unstable pagination), or a non-null `listingFailures` marks it unsafe. Anything absent from a safe listing is tombstoned on that sync and hard-deleted when the next sync still does not see it — so a truncated listing without this flag eventually removes every real document beyond the cap.
 
 ```typescript
 if (hitLimit && syncContext) {

.agents/skills/add-permission-group-item/SKILL.md

@@ -41,7 +41,7 @@ Allowlist when the safe posture is "only what the admin named" and the member se
 | `'executor'` | Read per block/tool/model at run time by `assertPermissionsAllowed` in `ee/access-control/utils/permission-check.ts`. Governs what a *run* may do, which no operation gate can express (one API call executes fifty blocks). Only `allowedIntegrations`, `allowedModelProviders`, `deniedModels`, `deniedTools` live here. The matching primitives these four keys are compared with live in `lib/permission-groups/` — `block-access.ts` (exemptions, superseded-version resolution), `operation-access.ts` (`createToolAccessGate`), `model-access.ts` (`createModelAccessGate`), `integration-allowlist.ts` — shared so the run-time gate and the editor/Copilot projections cannot drift. `allowedIntegrations` alone is also asserted outside a run, by `assertSelectorIntegrationAllowed` (`lib/selectors/server/integration-access.ts`) ahead of the provider call in `selectors.execute`, against the selector's own `resourceServiceId` / `integrationBlockTypes` rather than the credentials it accepts — reaching a provider API is a use of the integration, so a key here can still need a non-run enforcement site |
 | `'ui-only'` | Hides a surface without withholding it. **Almost never right** — nothing ships as `ui-only`. Justify in the `enforcement` comment why a determined caller reaching the data is acceptable, and expect review to question it |
 
-**Is it per-operation at all?** `personal_api_key.use` and `oauth_apps.use` are principal-wide (`PRINCIPAL_WIDE_CAPABILITIES` in `lib/core/application/operation.ts`): they withhold a principal kind across every operation, checked in the funnel's `personal_api_key` / `oauth_access_token` branches (`workspace-authorization.ts`) and in `app/api/v1/middleware.ts`. Declaring one on an operation throws at definition time, so its absence from every `capability:` field is correct.
+**Is it per-operation at all?** `personal_api_key.use` and `oauth_apps.use` are principal-wide (`PRINCIPAL_WIDE_CAPABILITIES` in `lib/core/application/operation.ts`): they withhold a principal kind across every operation, checked in the funnel's `personal_api_key` / `oauth_access_token` branches (`workspace-authorization.ts`); `app/api/v1/middleware.ts` repeats only the `personal_api_key.use` check, since v1 accepts API keys, not OAuth tokens. Declaring one on an operation throws at definition time, so its absence from every `capability:` field is correct.
 
 **Is the decision knowable from the config alone?** A rule needing a request value (an auth mode, a connector id) is *parameterized* and cannot be declared on an operation — see Step 3.
 

.agents/skills/babysit/SKILL.md

@@ -88,9 +88,9 @@ conditions freshly after every push.
    across all pages has `isResolved: true`, and every check has finished and passed, stop —
    report the outcome (see "Reporting" below) and skip the rest of this list.
 
-2. **If the PR has a merge conflict**, merge `origin/staging`, resolve the conflicts, then
-   follow steps 6–8 on the merge result: the full sync check plus `/ship` steps 4–6, push, and
-   re-trigger review.
+2. **If the PR has a merge conflict**, resolve it with step 6 (its rebase-based sync flow and
+   the `/ship` gates; a merge commit would be discarded by that rebase), then steps 7–8: push
+   with `--force-with-lease` and re-trigger review.
 
 3. **If no review has run yet** (fresh PR, no bot comments): both run automatically on PR open —
    confirm via `gh pr checks <n>` (look for `Greptile Review` and `cubic · AI code reviewer`) and

.claude/rules/sim-architecture.md

@@ -10,7 +10,7 @@ Repository layout, package boundaries, the application operation boundary, namin
 
 ## The `'use client'` server boundary
 
-Server-evaluated code (RSC pages/layouts, `prefetch.ts`, route handlers, block definitions, triggers) can render an export of a `'use client'` module but never call it; the call throws at runtime and `next build` does not catch it. Keep anything a server module calls (key factories, fetchers, mappers, constants) in a non-`'use client'` module. Detail and the escape hatch: `.claude/rules/sim-queries.md`. `bun run check:client-boundary` enforces it for `prefetch*.ts`, API route handlers, triggers, and blocks; nothing checks pages and layouts.
+Server-evaluated code (RSC pages/layouts, `prefetch.ts`, route handlers, block definitions, triggers) can render an export of a `'use client'` module but never call it; the call throws at runtime and `next build` does not catch it. Keep anything a server module calls (key factories, fetchers, mappers, constants) in a non-`'use client'` module. Detail and the escape hatch: `.claude/rules/sim-queries.md`. `bun run check:client-boundary` checks the direct imports of `prefetch*.ts`, API route handlers, triggers, and blocks; it does not follow transitive imports, and nothing checks pages and layouts.
 
 ## The app/worker runtime boundary
 

.cursor/rules/sim-architecture.mdc

@@ -11,7 +11,7 @@ Repository layout, package boundaries, the application operation boundary, namin
 
 ## The `'use client'` server boundary
 
-Server-evaluated code (RSC pages/layouts, `prefetch.ts`, route handlers, block definitions, triggers) can render an export of a `'use client'` module but never call it; the call throws at runtime and `next build` does not catch it. Keep anything a server module calls (key factories, fetchers, mappers, constants) in a non-`'use client'` module. Detail and the escape hatch: `.claude/rules/sim-queries.md`. `bun run check:client-boundary` enforces it for `prefetch*.ts`, API route handlers, triggers, and blocks; nothing checks pages and layouts.
+Server-evaluated code (RSC pages/layouts, `prefetch.ts`, route handlers, block definitions, triggers) can render an export of a `'use client'` module but never call it; the call throws at runtime and `next build` does not catch it. Keep anything a server module calls (key factories, fetchers, mappers, constants) in a non-`'use client'` module. Detail and the escape hatch: `.claude/rules/sim-queries.md`. `bun run check:client-boundary` checks the direct imports of `prefetch*.ts`, API route handlers, triggers, and blocks; it does not follow transitive imports, and nothing checks pages and layouts.
 
 ## The app/worker runtime boundary
 

scripts/check-guidance-refs.ts

@@ -20,7 +20,7 @@
  * Run: `bun run check:guidance-refs`
  */
 import { execFileSync } from 'node:child_process'
-import { existsSync, readFileSync, realpathSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs'
 import path from 'node:path'
 import { parseRule } from './sync-skills'
 
@@ -124,6 +124,26 @@ function resolvesFrom(base: string, ref: string): boolean {
   return SOURCE_EXTENSIONS.some((ext) => existsSync(path.join(base, `${ref}${ext}`)))
 }
 
+const MODULE_CANDIDATES = [
+  '',
+  '.ts',
+  '.tsx',
+  '.js',
+  '.mjs',
+  '.json',
+  '/index.ts',
+  '/index.tsx',
+  '/index.js',
+]
+
+/** An import specifier resolves only to a module file, never to a bare directory. */
+function moduleResolves(base: string, ref: string): boolean {
+  return MODULE_CANDIDATES.some((suffix) => {
+    const candidate = path.join(base, `${ref}${suffix}`)
+    return existsSync(candidate) && statSync(candidate).isFile()
+  })
+}
+
 const PATH_PREFIXES = ['apps/', 'packages/', 'scripts/', '.claude/', '.agents/', '.github/']
 
 /**
@@ -151,16 +171,12 @@ function importResolves(spec: string, packages: Map<string, WorkspacePackage>):
   const clean = spec.replace(/\/$/, '')
   if (clean === '@' || clean === '@sim') return true
   if (clean.startsWith('@/')) {
-    const rel = clean.slice(2)
-    return (
-      resolvesFrom(APP_ROOT, rel) ||
-      ['/index.ts', '/index.tsx'].some((index) => existsSync(path.join(APP_ROOT, `${rel}${index}`)))
-    )
+    return moduleResolves(APP_ROOT, clean.slice(2))
   }
   const [scope, name, ...rest] = clean.split('/')
   const pkg = packages.get(`${scope}/${name}`)
   if (!pkg) return false
-  if (!pkg.exports) return rest.length === 0 || resolvesFrom(pkg.dir, rest.join('/'))
+  if (!pkg.exports) return rest.length === 0 || moduleResolves(pkg.dir, rest.join('/'))
   const subpath = rest.length === 0 ? '.' : `./${rest.join('/')}`
   return Object.entries(pkg.exports).some(([key, value]) => {
     const [head, tail] = key.split('*')
@@ -169,7 +185,7 @@ function importResolves(spec: string, packages: Map<string, WorkspacePackage>):
     // A wildcard export only proves the pattern; the file it maps to must also exist.
     const target = exportTarget(value)
     const matched = subpath.slice(head.length, subpath.length - tail.length)
-    return target !== null && resolvesFrom(pkg.dir, target.replace('*', matched))
+    return target !== null && moduleResolves(pkg.dir, target.replace('*', matched))
   })
 }