fix(gates): the new-code gates are unrunnable on Windows, so nobody runs them

[LMPrado-DZ23]

newCodeMode.withBaseWorktree lints the merge-base in a throwaway git worktree and links the repo's node_modules into it. That link was a "dir" symlink, which on Windows needs SeCreateSymbolicLinkPrivilege — an elevated shell or Developer Mode. Without it fs.symlinkSync throws EPERM and the gate dies before comparing anything:

Error: EPERM: operation not permitted, symlink '...\node_modules' -> '...'
    at withBaseWorktree (scripts/check/newCodeMode.mjs:79:31)

So check:complexity-ratchets, check:dead-code and check:file-size cannot be run locally at all on a Windows checkout.

Why this is worth a PR of its own

It is not hypothetical. Three separate agents shipped new-code regressions in this release line, each having run the gates locally and believed they passed — the gates had died on EPERM before reaching the comparison. #52 needed a second round for exactly this reason, and its author independently recommended this same fix.

A junction is the same thing for this purpose — a directory reparse point — and needs no privilege. Measured on the affected machine:

symlink dir: FALHA -> EPERM
junction   : OK

The change

The link goes through linkNodeModules, which picks "junction" on win32 and "dir" elsewhere, and turns a failure into a message naming what broke and why it matters instead of a bare errno.

Proof it runs end to end on Windows

Against a base with source files in scope — an earlier run reporting 0 changed files proves nothing, since it short-circuits before linking:

$ node scripts/check/check-complexity-ratchets.mjs --base-ref b581c39cfdcd
[complexity] OK (código novo) — 7 violações nos arquivos tocados (base 7)
[cognitive-complexity] OK (código novo) — 4 violações nos arquivos tocados (base 4)
exit=0

Tests

tests/unit/newcode-gate-node-modules-link.test.ts covers both halves:

• the link resolves on whatever platform runs it — asserted by reading a file through it, because a link that exists but does not resolve leaves the linter blind;
• the failure message is actionable;
• statically, that win32 still picks "junction". That assertion earns its place: CI runs on Linux and could never catch this regression behaviourally.

Gate	Result
tests/unit/newcode-gate-node-modules-link.test.ts	3 pass / 0 fail
eslint --max-warnings=0	exit 0
tsc -p tsconfig.typecheck-core.json	exit 0, 0 errors

Run with isolated DATA_DIR / HOME / USERPROFILE / APPDATA.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 95f5da12-73e7-4ae4-a8c6-79f5adbd0362

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}