refactor(checks): migrate repository check suite to .mts

.agents/skills/nemoclaw-contributor-update-dependencies/SKILL.md

@@ -436,7 +436,7 @@ Use these NemoClaw precedents for durable evidence shape, not as inherited concl
 - `docs/security/openclaw-2026.6.10-dependency-review.md` and
   `test/openclaw-dependency-review.test.ts` for a tracked dependency review with contract tests;
 - `docs/security/openshell-0.0.72-compatibility-review.mdx` for a runtime compatibility boundary;
-- `scripts/checks/dependency-pins.ts` and `test/dependency-pins-check.test.ts` for selector
+- `scripts/checks/dependency-pins.mts` and `test/dependency-pins-check.test.ts` for selector
   coherence; and
 - `scripts/check-installer-hash.sh` and `test/installer-hash-check.test.ts` for independently
   trusted release manifests and consumed artifacts.

.github/actions/ci-cli-coverage-shard/action.yaml

@@ -91,7 +91,7 @@ runs:
             exit 0
             ;;
         esac
-        npx tsx scripts/checks/e2e-mock-parity.ts --base "$base" --head "$head"
+        npx tsx scripts/checks/e2e-mock-parity.mts --base "$base" --head "$head"
 
     - name: Build TypeScript plugin
       shell: bash

.github/workflows/pr.yaml

@@ -339,7 +339,7 @@ jobs:
       # covered without executing a mutable replacement action.
       - name: Validate changed live E2E mock parity (bootstrap)
         if: ${{ steps.trusted-shard-capabilities.outputs.e2e-support != 'true' && matrix.shard == 1 }}
-        run: npx tsx scripts/checks/e2e-mock-parity.ts --base HEAD^1 --head HEAD^2
+        run: npx tsx scripts/checks/e2e-mock-parity.mts --base HEAD^1 --head HEAD^2
 
       - name: Run E2E support shard (bootstrap)
         if: ${{ steps.trusted-shard-capabilities.outputs.e2e-support != 'true' }}

package.json

@@ -35,13 +35,13 @@
     "test:coverage:cli": "npm run clean:cli && npm run build:cli && tsx scripts/check-dist-sourcemaps.ts dist && vitest run --project cli --project integration --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary --coverage.reportsDirectory=coverage/cli --coverage.include=\"bin/**/*.js\" --coverage.include=\"src/**/*.ts\" --coverage.exclude=\"test/**/*.js\" --coverage.exclude=\"test/**/*.ts\" && tsx scripts/check-coverage-ratchet.ts coverage/cli/coverage-summary.json ci/coverage-threshold-cli.json \"CLI coverage\"",
     "test:coverage:plugin": "vitest run --project plugin --coverage --coverage.reporter=text-summary --coverage.reporter=json-summary --coverage.reportsDirectory=coverage/plugin --coverage.include=\"nemoclaw/src/**/*.ts\" --coverage.include=\"nemoclaw/src/**/*.cts\" --coverage.exclude=\"**/*.test.ts\" && tsx scripts/check-coverage-ratchet.ts coverage/plugin/coverage-summary.json ci/coverage-threshold-plugin.json \"Plugin coverage\"",
     "test:live-e2e": "npm run clean:cli && npm run build:cli && NEMOCLAW_RUN_LIVE_E2E=1 vitest run --project e2e-live",
-    "test:imports:check": "tsx scripts/checks/no-test-dist-imports.ts",
-    "test:projects:check": "tsx scripts/checks/vitest-project-overlap.ts",
-    "test:titles:check": "tsx scripts/checks/test-title-style.ts",
+    "test:imports:check": "tsx scripts/checks/no-test-dist-imports.mts",
+    "test:projects:check": "tsx scripts/checks/vitest-project-overlap.mts",
+    "test:titles:check": "tsx scripts/checks/test-title-style.mts",
     "bench": "tsx scripts/bench/run.mts",
     "check": "npx prek run --all-files --stage pre-commit && npx prek run --all-files --stage manual",
     "check:diff": "npx prek run --from-ref origin/main --to-ref HEAD --stage pre-commit && npx commitlint --from origin/main --to HEAD && npx prek run --from-ref origin/main --to-ref HEAD --stage pre-push",
-    "checks": "tsx scripts/checks/run.ts",
+    "checks": "tsx scripts/checks/run.mts",
     "lint": "npx @biomejs/biome lint . && npm run checks",
     "lint:fix": "npx @biomejs/biome lint --write . && npm run checks",
     "lint:ts": "cd nemoclaw && npm run check",

scripts/checks/direct-credential-env.ts → scripts/checks/direct-credential-env.mts

@@ -13,8 +13,8 @@ import { readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import * as ts from "typescript";
-import { SUPPORTED_CREDENTIAL_ENV_NAMES } from "../../src/lib/security/credential-env";
 
+const { SUPPORTED_CREDENTIAL_ENV_NAMES } = await import("../../src/lib/security/credential-env");
 const CREDENTIAL_ENV_KEYS = SUPPORTED_CREDENTIAL_ENV_NAMES;
 
 const MESSAGE =
@@ -251,7 +251,7 @@ function scriptKindForPath(filePath: string): ts.ScriptKind {
 function main(): void {
   const filePaths = process.argv.slice(2).filter((arg) => arg !== "--");
   if (filePaths.length === 0) {
-    console.error("Usage: tsx scripts/checks/direct-credential-env.ts FILE...");
+    console.error("Usage: tsx scripts/checks/direct-credential-env.mts FILE...");
     process.exitCode = 2;
     return;
   }

scripts/checks/hermes-light-skin-boundary.ts → scripts/checks/hermes-light-skin-boundary.mts

@@ -5,7 +5,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { NEMOCLAW_HERMES_LIGHT_SKIN_REVIEWED_HERMES_VERSIONS } from "../../src/lib/domain/sandbox/connect-env";
+const { NEMOCLAW_HERMES_LIGHT_SKIN_REVIEWED_HERMES_VERSIONS } = await import(
+  "../../src/lib/domain/sandbox/connect-env"
+);
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 const HERMES_DOCKERFILE_BASE = "agents/hermes/Dockerfile.base";

scripts/checks/run.ts → scripts/checks/run.mts

@@ -32,7 +32,7 @@ export const CHECKS: readonly CheckCommand[] = [
     name: "direct-credential-env",
     command: TSX,
     args: [
-      "scripts/checks/direct-credential-env.ts",
+      "scripts/checks/direct-credential-env.mts",
       "src/lib/onboard.ts",
       "src/lib/onboard/provider-key-bridge.ts",
       "src/lib/onboard/providers.ts",
@@ -41,57 +41,57 @@ export const CHECKS: readonly CheckCommand[] = [
   {
     name: "local-credential-helper-pin",
     command: TSX,
-    args: ["scripts/checks/local-credential-helper-pin.ts"],
+    args: ["scripts/checks/local-credential-helper-pin.mts"],
   },
   {
     name: "hermes-light-skin-boundary",
     command: TSX,
-    args: ["scripts/checks/hermes-light-skin-boundary.ts"],
+    args: ["scripts/checks/hermes-light-skin-boundary.mts"],
   },
   {
     name: "dependency-pins",
     command: TSX,
-    args: ["scripts/checks/dependency-pins.ts"],
+    args: ["scripts/checks/dependency-pins.mts"],
   },
   {
     name: "no-coverage-ignore",
     command: TSX,
-    args: ["scripts/checks/no-coverage-ignore.ts"],
+    args: ["scripts/checks/no-coverage-ignore.mts"],
   },
   {
     name: "openshell-policy-mutation-read",
     command: TSX,
-    args: ["scripts/checks/openshell-policy-mutation-read.ts"],
+    args: ["scripts/checks/openshell-policy-mutation-read.mts"],
   },
   {
     name: "layer-import-boundaries",
     command: TSX,
-    args: ["scripts/checks/layer-import-boundaries.ts"],
+    args: ["scripts/checks/layer-import-boundaries.mts"],
   },
   {
     name: "no-test-dist-imports",
     command: TSX,
-    args: ["scripts/checks/no-test-dist-imports.ts"],
+    args: ["scripts/checks/no-test-dist-imports.mts"],
   },
   {
     name: "test-create-require-budget",
     command: TSX,
-    args: ["scripts/checks/test-create-require-budget.ts"],
+    args: ["scripts/checks/test-create-require-budget.mts"],
   },
   {
     name: "vitest-project-overlap",
     command: TSX,
-    args: ["scripts/checks/vitest-project-overlap.ts"],
+    args: ["scripts/checks/vitest-project-overlap.mts"],
   },
   {
     name: "test-title-style",
     command: TSX,
-    args: ["scripts/checks/test-title-style.ts"],
+    args: ["scripts/checks/test-title-style.mts"],
   },
   {
     name: "no-unit-blocks-in-live-e2e",
     command: TSX,
-    args: ["scripts/checks/no-unit-blocks-in-live-e2e.ts"],
+    args: ["scripts/checks/no-unit-blocks-in-live-e2e.mts"],
   },
 ];
 

src/lib/messaging/manifest/types.test.ts

@@ -292,6 +292,6 @@ describe("messaging manifest type contracts", () => {
   });
 
   // Import-layer isolation for the production manifest modules is enforced by
-  // scripts/checks/layer-import-boundaries.ts. Keep this unit test focused on
+  // scripts/checks/layer-import-boundaries.mts. Keep this unit test focused on
   // manifest serialization and type contracts rather than walking source files.
 });

src/lib/security/credential-env.ts

@@ -8,7 +8,7 @@
 // separator-free provider parameters such as `clientSecret`, browser/session
 // material such as cookies, and connection strings cannot slip past the
 // validator. The standalone local credential helper and browser form embed this
-// literal pattern; scripts/checks/local-credential-helper-pin.ts enforces exact
+// literal pattern; scripts/checks/local-credential-helper-pin.mts enforces exact
 // parity because those reviewed artifacts cannot import this module at runtime.
 export const CREDENTIAL_SHAPED_NAME_PATTERN =
   /(?:^|[_-])(?:api[_-]?key|access[_-]?key|secret[_-]?key|auth[_-]?token|refresh[_-]?token|access[_-]?token|client[_-]?secret|private[_-]?key|pass[_-]?code|personal[_-]?access[_-]?token|connection[_-]?string|webhook(?:[_-]?url)?|key|secret|token|password|passwd|passcode|auth|authorization|credential|credentials|bearer|bearer[_-]?token|cookie|cookies|pat|private|privatekey|pin|webhookurl|dsn|connectionstring)(?:$|[_-])/i;

test/checks-runner.test.ts

@@ -4,12 +4,12 @@
 import type { SpawnSyncOptions } from "node:child_process";
 import { describe, expect, it, vi } from "vitest";
 
-import { buildCheckSpawnInvocation, runChecks } from "../scripts/checks/run";
+import { buildCheckSpawnInvocation, runChecks } from "../scripts/checks/run.mts";
 
 const sampleCheck = {
   name: "sample",
   command: "tsx.cmd",
-  args: ["scripts/checks/sample.ts"],
+  args: ["scripts/checks/sample.mts"],
 };
 
 function successfulSpawn(): { status: number | null } {
@@ -24,7 +24,7 @@ describe("checks runner", () => {
       }),
     ).toEqual({
       command: "C:\\Windows\\System32\\cmd.exe",
-      args: ["/d", "/s", "/c", "tsx.cmd", "scripts/checks/sample.ts"],
+      args: ["/d", "/s", "/c", "tsx.cmd", "scripts/checks/sample.mts"],
     });
   });
 
@@ -37,7 +37,7 @@ describe("checks runner", () => {
   it("keeps POSIX runner execution direct", () => {
     expect(buildCheckSpawnInvocation(sampleCheck, "linux")).toEqual({
       command: "tsx.cmd",
-      args: ["scripts/checks/sample.ts"],
+      args: ["scripts/checks/sample.mts"],
     });
   });
 
@@ -57,7 +57,7 @@ describe("checks runner", () => {
 
     expect(spawn).toHaveBeenCalledWith(
       "C:\\Windows\\System32\\cmd.exe",
-      ["/d", "/s", "/c", "tsx.cmd", "scripts/checks/sample.ts"],
+      ["/d", "/s", "/c", "tsx.cmd", "scripts/checks/sample.mts"],
       expect.objectContaining({ stdio: "inherit" }),
     );
     expect(calls[0]?.shell).toBeUndefined();
@@ -72,7 +72,7 @@ describe("checks runner", () => {
 
     expect(spawn).toHaveBeenCalledWith(
       "tsx.cmd",
-      ["scripts/checks/sample.ts"],
+      ["scripts/checks/sample.mts"],
       expect.objectContaining({ stdio: "inherit" }),
     );
   });

test/dependency-pins-check.test.ts

@@ -7,7 +7,7 @@ import path from "node:path";
 
 import { describe, expect, it } from "vitest";
 
-import { verifyDependencyPins } from "../scripts/checks/dependency-pins";
+import { verifyDependencyPins } from "../scripts/checks/dependency-pins.mts";
 
 const OPENSHELL_MIN = "1.2.3";
 const OPENSHELL_MAX = "1.2.4";

test/e2e-mock-parity.test.ts

@@ -6,7 +6,7 @@ import {
   isMockParityRelevantSourceChange,
   type MockParityManifest,
   validateMockParity,
-} from "../scripts/checks/e2e-mock-parity";
+} from "../scripts/checks/e2e-mock-parity.mts";
 
 const live = "test/e2e/live/example.test.ts";
 const fast = "test/e2e/support/example.test.ts";

test/layer-import-boundaries.test.ts

@@ -6,7 +6,7 @@ import path from "node:path";
 
 import { describe, expect, it } from "vitest";
 
-import { findLayerImportBoundaryViolations } from "../scripts/checks/layer-import-boundaries";
+import { findLayerImportBoundaryViolations } from "../scripts/checks/layer-import-boundaries.mts";
 
 const REPO_ROOT = path.join(import.meta.dirname, "..");
 let fixtureCounter = 0;

test/local-credential-helper-pin.test.ts

@@ -9,7 +9,7 @@ import {
   extractProcessControlRules,
   extractStringSet,
   verifyFieldSafetySourceParity,
-} from "../scripts/checks/local-credential-helper-pin";
+} from "../scripts/checks/local-credential-helper-pin.mts";
 
 const FUNCTION_NAME = "isBlocked";
 const SET_NAME = "BLOCKED_NAMES";

test/no-coverage-ignore.test.ts

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { describe, expect, it } from "vitest";
-import { findCoverageIgnoreDirectives } from "../scripts/checks/no-coverage-ignore";
+import { findCoverageIgnoreDirectives } from "../scripts/checks/no-coverage-ignore.mts";
 
 const forbiddenDirective = ["v8", "ignore"].join(" ");
 

test/no-direct-credential-env.test.ts

@@ -14,7 +14,7 @@
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
-import { findDirectCredentialEnvReads } from "../scripts/checks/direct-credential-env";
+import { findDirectCredentialEnvReads } from "../scripts/checks/direct-credential-env.mts";
 
 describe("direct credential env guard", () => {
   it.each([
@@ -96,7 +96,7 @@ describe("direct credential env guard", () => {
       "npx",
       [
         "tsx",
-        "scripts/checks/direct-credential-env.ts",
+        "scripts/checks/direct-credential-env.mts",
         "src/lib/onboard.ts",
         "src/lib/onboard/provider-key-bridge.ts",
         "src/lib/onboard/providers.ts",

test/no-unit-blocks-in-live-e2e.test.ts

@@ -3,7 +3,10 @@
 
 import { describe, expect, it } from "vitest";
 
-import { findLiveUnitBlocks, formatViolations } from "../scripts/checks/no-unit-blocks-in-live-e2e";
+import {
+  findLiveUnitBlocks,
+  formatViolations,
+} from "../scripts/checks/no-unit-blocks-in-live-e2e.mts";
 
 const FILE = "test/e2e/live/example.test.ts";
 

test/policy-mutation-read-discovery.test.ts

@@ -10,7 +10,7 @@ import { describe, expect, it } from "vitest";
 import {
   auditOpenShellPolicyMutationReads,
   discoverPolicyReadSites,
-} from "../scripts/checks/openshell-policy-mutation-read";
+} from "../scripts/checks/openshell-policy-mutation-read.mts";
 
 describe("OpenShell policy mutation read discovery", () => {
   it("discovers builder and direct policy reads in new production files", () => {

test/pr-workflow-contract.test.ts

@@ -923,7 +923,7 @@ describe("pull request and main workflow contracts", () => {
     expect(parityStep.run).toContain("head=HEAD^2");
     expect(parityStep.run).toContain('base="$PUSH_BASE_SHA"');
     expect(parityStep.run).toContain(
-      'npx tsx scripts/checks/e2e-mock-parity.ts --base "$base" --head "$head"',
+      'npx tsx scripts/checks/e2e-mock-parity.mts --base "$base" --head "$head"',
     );
 
     const trustedCapabilityProbe = requiredWorkflowStep(

test/test-boundary-guards.test.ts

@@ -12,7 +12,7 @@ import {
   findFastProjectTransitiveViolations,
   isFastProjectTestPath,
   isScannedTestPath,
-} from "../scripts/checks/no-test-dist-imports";
+} from "../scripts/checks/no-test-dist-imports.mts";
 import {
   discoverVitestCandidates,
   EXPECTED_VITEST_PROJECTS,
@@ -22,7 +22,7 @@ import {
   parseProjectListing,
   parseProjectRoster,
   resolveVitestInvocation,
-} from "../scripts/checks/vitest-project-overlap";
+} from "../scripts/checks/vitest-project-overlap.mts";
 
 const REPO_ROOT = path.join(import.meta.dirname, "..");
 const SOURCE_RUNTIME = path.join(REPO_ROOT, "test", "helpers", "onboard-script-mocks.cjs");

test/test-create-require-budget.test.ts

@@ -12,7 +12,7 @@ import {
   collectTestSupportCreateRequireSources,
   containsCreateRequireIdentifier,
   createRequireBudgetFailure,
-} from "../scripts/checks/test-create-require-budget";
+} from "../scripts/checks/test-create-require-budget.mts";
 
 const tempDirs = new Set<string>();
 

test/test-title-style.test.ts

@@ -3,7 +3,7 @@
 
 import { describe, expect, it } from "vitest";
 
-import { scanTestTitleStyle } from "../scripts/checks/test-title-style";
+import { scanTestTitleStyle } from "../scripts/checks/test-title-style.mts";
 
 function rulesFor(source: string): string[] {
   return scanTestTitleStyle("test/virtual-title-style.test.ts", source).map(