[bassilkhilo-ag2]

Summary

• 12 structural tests that fail-build when any src/*.py uses Path.cwd() / os.getcwd() outside workspace_default.py + util_paths.py, or any src/*.ts uses process.cwd() outside workspace_default.ts + util_paths.ts
• Closes lint: ban process.cwd() / Path.cwd() writes outside canonical resolvers #863 — prevents re-introducing the workspace-vs-repo bug class that the 2026-05-18 audit (PRs fix(health-check): resolve notes-dir against WORKSPACE_DIR not REPO_DIR #815–fix(workspace): migrate build_log.md from repo root to $SUTANDO_WORKSPACE #859) closed across ~28 sites
• Comment lines are stripped before checking, so the existing // Old code used process.cwd() here annotation lines in inline-tools.ts, browser-tools.ts, cartesia-tts.ts don't false-positive

How the test works

# Strip line comments, then check for the CWD pattern
code_line = strip_comment(raw_line)
if cwd_pattern.search(code_line):
    violation!

Any new src/ file that writes workspace data via process.cwd() or Path.cwd() directly — instead of routing through resolveWorkspace() / resolve_workspace() — will fail CI immediately.

Test plan

• python3 tests/cwd-lint.test.py — 12/12 passing
• No current violations in src/ (confirms the 2026-05-18 audit is still clean)
• Comment-line false-positive exclusion verified by dedicated tests

[VasiliyRad]

12/12 passing, rule is well-scoped (src/.py and src/.ts only, correct allowlists), comment stripping works. Single-file PR with no unrelated changes. One minor gap: block comments (/* */) in TypeScript aren't stripped, but that's an unlikely false-positive path in practice. Clean.

[VasiliyRad]

12/12 passing, rule is well-scoped (src/.py and src/.ts only, correct allowlists), comment stripping works. Single-file PR with no unrelated changes. One minor gap: block comments (/* */) in TypeScript aren't stripped, but that's an unlikely false-positive path in practice. Clean.