The binary in bin/ is what ships — the plugin, the MCP bundle and the
Codex and Cursor variants all carry it, never the Go source — and
nothing compared the two. A Go edit whose binary was never rebuilt
shipped the old tool with every check green: the args.go parity check
compares copies, the MCP coverage check confirms presence, and the Go
test step reads the source.
New static check, so it runs on `npm test` and on every commit through
the pre-commit hook. It leads with content — a compiled source changed
while the binary's bytes still match HEAD means the rebuild never
happened, which a `touch` on the binary cannot fake — and falls back to
the existing mtime-plus-dirtiness rule for a binary rebuilt once and
then left behind by a further edit. Source staged without the rebuilt
binary is its own failure, because the working tree can look right while
the commit ships the old binary. Deletions count too: a removed file
cannot appear in a directory walk.
It excludes what `go build` excludes — `_test.go`, `testdata/`,
underscore- and dot-prefixed files, other platforms' GOOS suffixes — so
a flagged binary is always one a rebuild fixes, and it exempts library
modules that ship no binary at all. The walk is guarded: a dangling
symlink used to throw out of Phase 1, skipping every later check and
reporting a crash in the same words as a finding.
`git status` now lists untracked files individually, so a brand-new
package directory is visible to this check and to the bundle and Codex
staleness checks, which a collapsed directory entry hid from all three.
Also ignore xclog's build artifacts, which the rebuild instruction left
untracked in the tree.
Charles Wiltgen