Restore eval CLI coverage and drop the content-pin lint rule

Unique CLI and web-brand contracts were deleted because they sat
outside the suite path list. Membership owns that, not deletion.
AGENTS.md owns the behavioral bar; an error-level shape-match
lint rule does not. test:paths now requires paths so a zero-arg
run cannot scan vendor/.

Author: TheGreatAxios

.github/workflows/ci.yml

@@ -31,15 +31,10 @@ jobs:
         uses: actions/cache@v4
         with:
           path: node_modules
-          # The exact key keeps hits honest: only a cache built from this
-          # bun.lock restores. restore-keys falls back to the newest cache
-          # when the lockfile changed, so a dependency bump reinstalls the
-          # delta instead of cold-installing on every job at once. bun
-          # install --frozen-lockfile reconciles a stale tree to the new
-          # lockfile, so a partial hit never leaves wrong deps behind.
+          # Exact-key-only: a restore-keys prefix of bun- would hydrate
+          # node_modules from a different lockfile. bun install then has to
+          # reconcile a stale tree; missing that step leaves wrong deps.
           key: bun-${{ hashFiles('bun.lock') }}
-          restore-keys: |
-            bun-
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -77,8 +72,6 @@ jobs:
         with:
           path: node_modules
           key: bun-${{ hashFiles('bun.lock') }}
-          restore-keys: |
-            bun-
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -89,7 +82,7 @@ jobs:
   # The suite is sharded so the slowest slice, not the whole suite, sets the
   # wall clock. Every shard still goes through check:projects-dir-guard: the
   # guard forwards these path filters to the suite it wraps, and the union of
-  # the shards' filters is exactly ./src ./tests ./evals, so the gate covers
+  # the shards' filters is exactly ./src ./tests ./evals ./scripts, so the gate covers
   # the same tests as before, all of them sandboxed.
   test:
     runs-on: ubuntu-latest
@@ -100,8 +93,8 @@ jobs:
         shard:
           - name: src
             paths: ./src
-          - name: tests-and-evals
-            paths: ./tests ./evals
+          - name: tests-evals-and-scripts
+            paths: ./tests ./evals ./scripts
     name: test (${{ matrix.shard.name }})
     steps:
       - name: Checkout
@@ -127,8 +120,6 @@ jobs:
         with:
           path: node_modules
           key: bun-${{ hashFiles('bun.lock') }}
-          restore-keys: |
-            bun-
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

AGENTS.md

@@ -33,9 +33,9 @@ When refactoring replaces an old path, delete the old one. No back-compat shims,
 - Add or update tests with every behavior change.
 - Bug fixes start with a failing test that reproduces the bug. Do not start by patching.
 - `tests/unit/` shared unit tests and helpers · co-located `src/**/*.test.ts` for module logic · `tests/fixtures/` fixture repos · `tests/integration/` reactor/permission harness. Planned: `tests/e2e/` (fixture-repo runs).
-- A test must not depend on another file having run, or on the default file order. It must pass under `bun test ./src ./tests ./evals --randomize`. If a test mutates module-level state or calls `mock.module`, it must restore that state itself (`afterEach`/`afterAll`), not rely on the process happening to reset it. When capturing a module's real exports to restore later, shallow-copy them (`{ ...moduleNamespace }`) at capture time, whether the namespace came from `await import(path)` or a static `import * as ns from "path"` — Bun mutates the live namespace object in place when the module is mocked, so holding a bare reference to it (either form) silently turns into the mocked exports.
+- A test must not depend on another file having run, or on the default file order. It must pass under `bun test ./src ./tests ./evals ./scripts --randomize`. If a test mutates module-level state or calls `mock.module`, it must restore that state itself (`afterEach`/`afterAll`), not rely on the process happening to reset it. When capturing a module's real exports to restore later, shallow-copy them (`{ ...moduleNamespace }`) at capture time, whether the namespace came from `await import(path)` or a static `import * as ns from "path"` — Bun mutates the live namespace object in place when the module is mocked, so holding a bare reference to it (either form) silently turns into the mocked exports.
 - Never call `mock.module` directly. Bun runs every test file in one process, so a `mock.module` call without its own teardown stays installed for the rest of the run and silently replaces the real module for other files — producing failures in files the change never touched, with no obvious link to the cause and no signal from `tsc` or a per-file run (CL-6967). Use `withMockedModule`/`withMockedModuleDuring` from `tests/helpers/mock-module.ts`, which capture the real module and register their own restore. An eslint rule (`no-restricted-syntax` in `eslint.config.js`) rejects bare `mock.module` calls in `*.test.ts` files.
-- A test earns its place only if a real behavior change can fail it. Document copy, brand colors, marketing assets, and splash text are not behavior: assertions that pin an asset's literal wording, an exact palette hex/ANSI value, or rendered copy fail on copy/design edits and catch no regressions — assert the contract instead (parsing, formatting, ranges, aliases, invariants). Tests are code too: pinning a source file's own text is the same trap. An eslint rule (`corbits/no-content-pin-tests`, defined in `scripts/eslint-rules/no-content-pin-tests.ts`) rejects the known shapes in `*.test.ts` files; it is a heuristic shape match, not a semantic check, and its header documents what it does not catch.
+- A test earns its place only if a real behavior change can fail it. Document copy, brand colors, marketing assets, and splash text are not behavior: assertions that pin an asset's literal wording, an exact palette hex/ANSI value, or rendered copy fail on copy/design edits and catch no regressions — assert the contract instead (parsing, formatting, ranges, aliases, invariants). Tests are code too: pinning a source file's own text is the same trap. This bar is a review and authorship rule, not an eslint shape match.
 
 ## Build & Validation
 
@@ -49,10 +49,15 @@ the projects-dir sandbox guard — in that order, matching CI.
 
 Run the full suite before declaring any task complete. Do not substitute individual targets. If a failure is pre-existing and unrelated to your change, say so explicitly.
 
-`bun run test` runs `bun test ./src ./tests ./evals --randomize --seed 424242` —
-the same suite CI runs. A bare `bun test` also
-scans `vendor/`, adding hundreds of unrelated results and making pass/fail
-counts meaningless to compare across branches — always use `bun run test`.
+`bun run test` runs `bun test ./src ./tests ./evals ./scripts --randomize --seed 424242`
+as a single process. CI shards the same path union via `test:paths`
+(`.github/workflows/ci.yml`) for wall clock. Path-union is not the same
+isolation domain: a `mock.module` leak across `./src` vs `./tests` fails
+locally in the one-process suite but not in a CI shard (CL-6967). A bare
+`bun test` also scans `vendor/`, adding hundreds of unrelated results and
+making pass/fail counts meaningless to compare across branches — always use
+`bun run test`. `test:paths` with no path filters refuses to run for the
+same reason.
 
 ## Commits, pull requests, and issue tracking
 

CONTRIBUTING.md

@@ -30,7 +30,9 @@ bun run build
 bun run test
 ```
 
-These match the CI workflow in `.github/workflows/ci.yml`. Run `bun run check`
+These match the local development loop. CI shards the same path union via
+`test:paths` rather than running the one-process `bun run test` suite.
+Run `bun run check`
 (lint, typecheck, build, and the guarded test suite) before opening a PR —
 `bun run test` alone skips the projects-dir sandbox guard, which only runs
 under `bun run check` and CI. Do

eslint.config.js

@@ -1,6 +1,5 @@
 import js from "@eslint/js";
 import tseslint from "typescript-eslint";
-import noContentPinTests from "./scripts/eslint-rules/no-content-pin-tests.ts";
 
 export default tseslint.config(
   {
@@ -78,17 +77,4 @@ export default tseslint.config(
       ],
     },
   },
-  {
-    // Content-pin tests — assertions that pin literal document wording, brand
-    // hex values, or palette indexes — fail on copy/design edits and catch no
-    // behavior regression. The rule is a heuristic shape match; see its header
-    // for what it covers and what it deliberately does not.
-    files: ["**/*.test.ts"],
-    plugins: {
-      corbits: { rules: { "no-content-pin-tests": noContentPinTests } },
-    },
-    rules: {
-      "corbits/no-content-pin-tests": "error",
-    },
-  },
 );

package.json

@@ -32,8 +32,8 @@
     "build": "bun build ./src/index.ts --outdir ./dist --target bun --external '@opentui/core-*' && bun scripts/copy-repo-plugins.ts",
     "build:bin": "bun build ./src/index.ts --compile --minify --define process.env.NODE_ENV='\"production\"' --outfile ./dist/corbits && bun scripts/copy-repo-plugins.ts",
     "typecheck": "tsc --noEmit",
-    "test": "bun test ./src ./tests ./evals --randomize --seed 424242",
-    "test:paths": "bun test --randomize --seed 424242",
+    "test": "bun test ./src ./tests ./evals ./scripts --randomize --seed 424242",
+    "test:paths": "bun scripts/test-paths.ts",
     "lint": "prettier --check --cache . && eslint --cache .",
     "check:projects-dir-guard": "bun scripts/guard-real-projects-dir.ts",
     "check": "bun run lint && bun run typecheck && bun run build && bun run check:projects-dir-guard",