From 34dde2c620cf13701eac1f2ce5eee19e66c46f8b Mon Sep 17 00:00:00 2001
From: Galin Iliev <5711535+galiniliev@users.noreply.github.com>
Date: Mon, 15 Jun 2026 02:58:46 +0000
Subject: [PATCH] fix(scripts): tighten legacy migration guard

---
 scripts/check-database-first-legacy-stores.mjs       |  3 +--
 .../check-database-first-legacy-stores.test.ts       | 12 ++++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/scripts/check-database-first-legacy-stores.mjs b/scripts/check-database-first-legacy-stores.mjs
index 1503bf46f2a3..84a7fd69b1f9 100644
--- a/scripts/check-database-first-legacy-stores.mjs
+++ b/scripts/check-database-first-legacy-stores.mjs
@@ -169,8 +169,7 @@ function isAllowedLegacyOwnerPath(relativePath) {
     allowedRuntimeMigrationPaths.some((allowed) => relativePath.startsWith(allowed)) ||
     /^extensions\/[^/]+\/(?:doctor-contract-api|legacy-state-migrations-api)\.ts$/u.test(
       relativePath,
-    ) ||
-    /^extensions\/[^/]+\/.*migrations?(?:[./-][^/]*)?\.ts$/u.test(relativePath)
+    )
   );
 }
 
diff --git a/test/scripts/check-database-first-legacy-stores.test.ts b/test/scripts/check-database-first-legacy-stores.test.ts
index a35770c1398b..302d2dd7a6b0 100644
--- a/test/scripts/check-database-first-legacy-stores.test.ts
+++ b/test/scripts/check-database-first-legacy-stores.test.ts
@@ -8431,6 +8431,18 @@ describe("check-database-first-legacy-stores", () => {
     expect(violations).toEqual([]);
   });
 
+  it("flags extension runtime writes under migration-like directories", () => {
+    const violations = collectDatabaseFirstLegacyStoreViolations(
+      `
+        import { promises as fs } from "node:fs";
+        await fs.writeFile("sessions.json", "{}\\n", "utf8");
+      `,
+      "extensions/example/src/migrations/runtime.ts",
+    );
+
+    expect(violations).toEqual([{ kind: "legacy store filesystem write", line: 3 }]);
+  });
+
   it("allows exact QA fixture owners to materialize legacy files", () => {
     const violations = collectDatabaseFirstLegacyStoreViolations(
       `