fix(scripts): sanity check self-exclusion on POSIX

[PythonLuvr]

Summary

Fixes a cross-platform bug in scripts/check-sanity.mjs that has been silently breaking Mac and Ubuntu CI for several releases.

The script's self-exclusion logic used new URL(import.meta.url).pathname.replace(/^\//, ""), which works on Windows but breaks on POSIX. The wrong path means SELF never matches the actual file during the walk, the script scans itself, hits its own personal-token regex definition at line 40, and reports 9 false-positive "leaks" all pointing at scripts/check-sanity.mjs:40.

Why CI looked passing

Windows CI (Node 20.x and 22.x) passed because the self-exclusion happens to work there. Mac and Ubuntu have been red on the same job since the script landed. Net effect: the sanity check has not actually been running on POSIX CI. A real personal-data leak in any shipped file would never have surfaced through POSIX, because the script self-fails before scanning anything else.

Fix

Use fileURLToPath(import.meta.url) instead of manual pathname manipulation. It returns a correct absolute path on every platform.

-import { join, relative } from "node:path";
+import { join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
 
 const ROOT = process.cwd();
 const TARGETS = [".md", ".ts", ".mts", ".cts", ".mjs", ".json", ".yml", ".yaml"];
 const SKIP = new Set(["node_modules", "dist", ".git", ".openwar", "coverage"]);
-const SELF = relative(ROOT, new URL(import.meta.url).pathname.replace(/^\//, ""));
+const SELF = relative(ROOT, fileURLToPath(import.meta.url));

Test plan

• npm run lint passes locally on Windows (regression check)
• CI passes on Ubuntu 20.x / 22.x
• CI passes on macOS 20.x / 22.x

🤖 Generated with Claude Code