@ai-dossier/core 1.14.6-next.616.1 → 1.15.0-next.618.1

package/dist/index.d.ts

@@ -23,6 +23,8 @@ export type { FormatOptions, FormatResult } from './formatter';
 export { formatDossierContent, formatDossierFile } from './formatter';
 export type { LintConfig, LintDiagnostic, LintResult, LintRule, LintRuleContext, LintSeverity, RuleSeverityOverride, } from './linter';
 export { defaultRules, LintRuleRegistry, lintDossier, lintDossierFile, loadLintConfig, } from './linter';
+export type { LocalPathOptions } from './local-path';
+export { anchorFromCommonDir, containsHomePath, isPortablePath, LOCAL_PATH_TOKEN, parseWorktreePorcelain, REPO_PATH_TOKEN, redactHomePaths, resolvePortablePath, toPortablePath, } from './local-path';
 export { parseDossierContent, parseDossierFile, RECOMMENDED_FIELDS, REQUIRED_FIELDS, VALID_RISK_LEVELS, VALID_STATUSES, validateFrontmatter, } from './parser';
 export type { ChecksumStatus, ContentRiskResult, SignatureStatus, VerificationRiskLevel, VerificationRiskResult, } from './risk-assessment';
 export { assessContentRisk, assessVerificationRisk } from './risk-assessment';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvE,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,UAAU,EACV,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,WAAW,IAAI,gBAAgB,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,gBAAgB,EAChB,SAAS,IAAI,cAAc,EAC3B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE3F,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvE,YAAY,EACV,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,UAAU,EACV,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,YAAY,EACV,UAAU,EACV,cAAc,EACd,UAAU,EACV,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,gBAAgB,EAChB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,WAAW,IAAI,gBAAgB,EAC/B,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,YAAY,EACV,gBAAgB,EAChB,SAAS,IAAI,cAAc,EAC3B,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE3F,cAAc,SAAS,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -26,8 +26,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseTrustedKeys = exports.loadTrustedKeys = exports.isKmsKeyIdentifier = exports.findTrustedIdentifier = exports.scanMarkdown = exports.scanDossierFile = exports.scanDossier = exports.SecurityRuleRegistry = exports.defaultSecurityRules = exports.buildReport = exports.runsLogPath = exports.assessVerificationRisk = exports.assessContentRisk = exports.validateFrontmatter = exports.VALID_STATUSES = exports.VALID_RISK_LEVELS = exports.REQUIRED_FIELDS = exports.RECOMMENDED_FIELDS = exports.parseDossierFile = exports.parseDossierContent = exports.loadLintConfig = exports.lintDossierFile = exports.lintDossier = exports.LintRuleRegistry = exports.defaultRules = exports.formatDossierFile = exports.formatDossierContent = exports.validateEvidence = exports.parseEvidence = exports.evidenceMatchesDossier = exports.EVIDENCE_SCHEMA_VERSION = exports.EVIDENCE_MAX_RATIONALE_CHARS = exports.EVIDENCE_MAX_BYTES = exports.createEvidenceRecord = exports.levelForScore = exports.DRY_RUN_SCHEMA_VERSION = exports.DRY_RUN_DISCLAIMER = exports.analyzeDryRun = exports.validateStepCoherence = exports.validateCoherence = exports.verifyIntegrity = exports.calculateChecksum = exports.usageParserFor = exports.SCHED_DISPATCH_EVENT = exports.parseOpenCodeUsage = exports.parseLastToolUse = exports.parseDispatchApiError = exports.parseAnnouncedWait = exports.parseAgentUsage = exports.isOpenCodeUsageStream = void 0;
-exports.createDefaultVerificationResult = exports.scanBodyForUrls = exports.isUrlCoveredByDeclared = exports.isPlaceholderUrl = exports.findUndeclaredUrls = exports.findStaleReferences = exports.collectDeclaredUrls = exports.readFileIfExists = exports.getErrorStack = exports.getErrorMessage = exports.sha256Hex = exports.sha256Hash = exports.TRUSTED_AUTHOR_ASSOCIATIONS = exports.isTrustedAuthorAssociation = exports.VALID_TRACE_STATUSES = exports.createTraceRecorder = exports.resolveTraceConfig = exports.toSpkiPem = exports.signatureCoverage = exports.publicKeysMatch = exports.normalizePublicKey = exports.isSupportedPublicKey = exports.canonicalizeFrontmatter = exports.buildSignedPayload = exports.VerifierRegistry = exports.KmsVerifier = exports.KmsSigner = exports.getVerifierRegistry = exports.Ed25519Verifier = exports.Ed25519Signer = exports.verifyWithKms = exports.verifyWithEd25519 = exports.verifySignature = exports.trustedKeysFromContent = exports.reportTrustedKeyProblems = void 0;
+exports.buildReport = exports.runsLogPath = exports.assessVerificationRisk = exports.assessContentRisk = exports.validateFrontmatter = exports.VALID_STATUSES = exports.VALID_RISK_LEVELS = exports.REQUIRED_FIELDS = exports.RECOMMENDED_FIELDS = exports.parseDossierFile = exports.parseDossierContent = exports.toPortablePath = exports.resolvePortablePath = exports.redactHomePaths = exports.REPO_PATH_TOKEN = exports.parseWorktreePorcelain = exports.LOCAL_PATH_TOKEN = exports.isPortablePath = exports.containsHomePath = exports.anchorFromCommonDir = exports.loadLintConfig = exports.lintDossierFile = exports.lintDossier = exports.LintRuleRegistry = exports.defaultRules = exports.formatDossierFile = exports.formatDossierContent = exports.validateEvidence = exports.parseEvidence = exports.evidenceMatchesDossier = exports.EVIDENCE_SCHEMA_VERSION = exports.EVIDENCE_MAX_RATIONALE_CHARS = exports.EVIDENCE_MAX_BYTES = exports.createEvidenceRecord = exports.levelForScore = exports.DRY_RUN_SCHEMA_VERSION = exports.DRY_RUN_DISCLAIMER = exports.analyzeDryRun = exports.validateStepCoherence = exports.validateCoherence = exports.verifyIntegrity = exports.calculateChecksum = exports.usageParserFor = exports.SCHED_DISPATCH_EVENT = exports.parseOpenCodeUsage = exports.parseLastToolUse = exports.parseDispatchApiError = exports.parseAnnouncedWait = exports.parseAgentUsage = exports.isOpenCodeUsageStream = void 0;
+exports.createDefaultVerificationResult = exports.scanBodyForUrls = exports.isUrlCoveredByDeclared = exports.isPlaceholderUrl = exports.findUndeclaredUrls = exports.findStaleReferences = exports.collectDeclaredUrls = exports.readFileIfExists = exports.getErrorStack = exports.getErrorMessage = exports.sha256Hex = exports.sha256Hash = exports.TRUSTED_AUTHOR_ASSOCIATIONS = exports.isTrustedAuthorAssociation = exports.VALID_TRACE_STATUSES = exports.createTraceRecorder = exports.resolveTraceConfig = exports.toSpkiPem = exports.signatureCoverage = exports.publicKeysMatch = exports.normalizePublicKey = exports.isSupportedPublicKey = exports.canonicalizeFrontmatter = exports.buildSignedPayload = exports.VerifierRegistry = exports.KmsVerifier = exports.KmsSigner = exports.getVerifierRegistry = exports.Ed25519Verifier = exports.Ed25519Signer = exports.verifyWithKms = exports.verifyWithEd25519 = exports.verifySignature = exports.trustedKeysFromContent = exports.reportTrustedKeyProblems = exports.parseTrustedKeys = exports.loadTrustedKeys = exports.isKmsKeyIdentifier = exports.findTrustedIdentifier = exports.scanMarkdown = exports.scanDossierFile = exports.scanDossier = exports.SecurityRuleRegistry = exports.defaultSecurityRules = void 0;
 var agent_usage_1 = require("./agent-usage");
 Object.defineProperty(exports, "isOpenCodeUsageStream", { enumerable: true, get: function () { return agent_usage_1.isOpenCodeUsageStream; } });
 Object.defineProperty(exports, "parseAgentUsage", { enumerable: true, get: function () { return agent_usage_1.parseAgentUsage; } });
@@ -68,6 +68,16 @@ Object.defineProperty(exports, "LintRuleRegistry", { enumerable: true, get: func
 Object.defineProperty(exports, "lintDossier", { enumerable: true, get: function () { return linter_1.lintDossier; } });
 Object.defineProperty(exports, "lintDossierFile", { enumerable: true, get: function () { return linter_1.lintDossierFile; } });
 Object.defineProperty(exports, "loadLintConfig", { enumerable: true, get: function () { return linter_1.loadLintConfig; } });
+var local_path_1 = require("./local-path");
+Object.defineProperty(exports, "anchorFromCommonDir", { enumerable: true, get: function () { return local_path_1.anchorFromCommonDir; } });
+Object.defineProperty(exports, "containsHomePath", { enumerable: true, get: function () { return local_path_1.containsHomePath; } });
+Object.defineProperty(exports, "isPortablePath", { enumerable: true, get: function () { return local_path_1.isPortablePath; } });
+Object.defineProperty(exports, "LOCAL_PATH_TOKEN", { enumerable: true, get: function () { return local_path_1.LOCAL_PATH_TOKEN; } });
+Object.defineProperty(exports, "parseWorktreePorcelain", { enumerable: true, get: function () { return local_path_1.parseWorktreePorcelain; } });
+Object.defineProperty(exports, "REPO_PATH_TOKEN", { enumerable: true, get: function () { return local_path_1.REPO_PATH_TOKEN; } });
+Object.defineProperty(exports, "redactHomePaths", { enumerable: true, get: function () { return local_path_1.redactHomePaths; } });
+Object.defineProperty(exports, "resolvePortablePath", { enumerable: true, get: function () { return local_path_1.resolvePortablePath; } });
+Object.defineProperty(exports, "toPortablePath", { enumerable: true, get: function () { return local_path_1.toPortablePath; } });
 // Parser exports
 var parser_1 = require("./parser");
 Object.defineProperty(exports, "parseDossierContent", { enumerable: true, get: function () { return parser_1.parseDossierContent; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;AAIH,6CASuB;AARrB,oHAAA,qBAAqB,OAAA;AACrB,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,oHAAA,qBAAqB,OAAA;AACrB,+GAAA,gBAAgB,OAAA;AAChB,iHAAA,kBAAkB,OAAA;AAClB,mHAAA,oBAAoB,OAAA;AACpB,6GAAA,cAAc,OAAA;AAEhB,mBAAmB;AACnB,uCAAgE;AAAvD,6GAAA,iBAAiB,OAAA;AAAE,2GAAA,eAAe,OAAA;AAU3C,yCAAuE;AAA9D,8GAAA,iBAAiB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAYjD,qCAKmB;AAJjB,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA;AAClB,iHAAA,sBAAsB,OAAA;AACtB,wGAAA,aAAa,OAAA;AAIf,uCAQoB;AAPlB,gHAAA,oBAAoB,OAAA;AACpB,8GAAA,kBAAkB,OAAA;AAClB,wHAAA,4BAA4B,OAAA;AAC5B,mHAAA,uBAAuB,OAAA;AACvB,kHAAA,sBAAsB,OAAA;AACtB,yGAAA,aAAa,OAAA;AACb,4GAAA,gBAAgB,OAAA;AAGlB,oBAAoB;AACpB,yCAAsE;AAA7D,iHAAA,oBAAoB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAUhD,iBAAiB;AACjB,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,yGAAA,eAAe,OAAA;AACf,wGAAA,cAAc,OAAA;AAEhB,iBAAiB;AACjB,mCAQkB;AAPhB,6GAAA,mBAAmB,OAAA;AACnB,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,wGAAA,cAAc,OAAA;AACd,6GAAA,mBAAmB,OAAA;AASrB,0BAA0B;AAC1B,qDAA8E;AAArE,oHAAA,iBAAiB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAGlD,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AAYpB,uDAO4B;AAN1B,+GAAA,WAAW,OAAA;AACX,wHAAA,oBAAoB,OAAA;AACpB,wHAAA,oBAAoB,OAAA;AACpB,+GAAA,WAAW,OAAA;AACX,mHAAA,eAAe,OAAA;AACf,gHAAA,YAAY,OAAA;AAId,yCAUqB;AATnB,kHAAA,qBAAqB,OAAA;AACrB,+GAAA,kBAAkB,OAAA;AAClB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,qHAAA,wBAAwB,OAAA;AACxB,mHAAA,sBAAsB,OAAA;AACtB,4GAAA,eAAe,OAAA;AACf,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AAEf,iDAAiD;AACjD,qCAWmB;AAVjB,wGAAA,aAAa,OAAA;AACb,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AAIX,2GAAA,gBAAgB,OAAA;AAKlB,qDAQ2B;AAPzB,qHAAA,kBAAkB,OAAA;AAClB,0HAAA,uBAAuB,OAAA;AACvB,uHAAA,oBAAoB,OAAA;AACpB,qHAAA,kBAAkB,OAAA;AAClB,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,4GAAA,SAAS,OAAA;AASX,+CAAoD;AAA3C,kHAAA,kBAAkB,OAAA;AAW3B,mDAA6E;AAApE,qHAAA,mBAAmB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAClD,4EAA4E;AAC5E,mDAA2F;AAAlF,4HAAA,0BAA0B,OAAA;AAAE,6HAAA,2BAA2B,OAAA;AAChE,eAAe;AACf,0CAAwB;AACxB,mBAAmB;AACnB,yCAAuD;AAA9C,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAC9B,kBAAkB;AAClB,yCAAgE;AAAvD,yGAAA,eAAe,OAAA;AAAE,uGAAA,aAAa,OAAA;AACvC,wBAAwB;AACxB,iCAA8C;AAArC,sGAAA,gBAAgB,OAAA;AACzB,yBAAyB;AACzB,mDAO6B;AAN3B,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AAEjB,yBAAyB;AACzB,qDAAuE;AAA9D,+HAAA,+BAA+B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;AAIH,6CASuB;AARrB,oHAAA,qBAAqB,OAAA;AACrB,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,oHAAA,qBAAqB,OAAA;AACrB,+GAAA,gBAAgB,OAAA;AAChB,iHAAA,kBAAkB,OAAA;AAClB,mHAAA,oBAAoB,OAAA;AACpB,6GAAA,cAAc,OAAA;AAEhB,mBAAmB;AACnB,uCAAgE;AAAvD,6GAAA,iBAAiB,OAAA;AAAE,2GAAA,eAAe,OAAA;AAU3C,yCAAuE;AAA9D,8GAAA,iBAAiB,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAYjD,qCAKmB;AAJjB,wGAAA,aAAa,OAAA;AACb,6GAAA,kBAAkB,OAAA;AAClB,iHAAA,sBAAsB,OAAA;AACtB,wGAAA,aAAa,OAAA;AAIf,uCAQoB;AAPlB,gHAAA,oBAAoB,OAAA;AACpB,8GAAA,kBAAkB,OAAA;AAClB,wHAAA,4BAA4B,OAAA;AAC5B,mHAAA,uBAAuB,OAAA;AACvB,kHAAA,sBAAsB,OAAA;AACtB,yGAAA,aAAa,OAAA;AACb,4GAAA,gBAAgB,OAAA;AAGlB,oBAAoB;AACpB,yCAAsE;AAA7D,iHAAA,oBAAoB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAUhD,iBAAiB;AACjB,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,yGAAA,eAAe,OAAA;AACf,wGAAA,cAAc,OAAA;AAIhB,2CAUsB;AATpB,iHAAA,mBAAmB,OAAA;AACnB,8GAAA,gBAAgB,OAAA;AAChB,4GAAA,cAAc,OAAA;AACd,8GAAA,gBAAgB,OAAA;AAChB,oHAAA,sBAAsB,OAAA;AACtB,6GAAA,eAAe,OAAA;AACf,6GAAA,eAAe,OAAA;AACf,iHAAA,mBAAmB,OAAA;AACnB,4GAAA,cAAc,OAAA;AAEhB,iBAAiB;AACjB,mCAQkB;AAPhB,6GAAA,mBAAmB,OAAA;AACnB,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,wGAAA,cAAc,OAAA;AACd,6GAAA,mBAAmB,OAAA;AASrB,0BAA0B;AAC1B,qDAA8E;AAArE,oHAAA,iBAAiB,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAGlD,iDAA8C;AAArC,4GAAA,WAAW,OAAA;AAYpB,uDAO4B;AAN1B,+GAAA,WAAW,OAAA;AACX,wHAAA,oBAAoB,OAAA;AACpB,wHAAA,oBAAoB,OAAA;AACpB,+GAAA,WAAW,OAAA;AACX,mHAAA,eAAe,OAAA;AACf,gHAAA,YAAY,OAAA;AAId,yCAUqB;AATnB,kHAAA,qBAAqB,OAAA;AACrB,+GAAA,kBAAkB,OAAA;AAClB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,qHAAA,wBAAwB,OAAA;AACxB,mHAAA,sBAAsB,OAAA;AACtB,4GAAA,eAAe,OAAA;AACf,8GAAA,iBAAiB,OAAA;AACjB,0GAAA,aAAa,OAAA;AAEf,iDAAiD;AACjD,qCAWmB;AAVjB,wGAAA,aAAa,OAAA;AACb,0GAAA,eAAe,OAAA;AACf,8GAAA,mBAAmB,OAAA;AACnB,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AAIX,2GAAA,gBAAgB,OAAA;AAKlB,qDAQ2B;AAPzB,qHAAA,kBAAkB,OAAA;AAClB,0HAAA,uBAAuB,OAAA;AACvB,uHAAA,oBAAoB,OAAA;AACpB,qHAAA,kBAAkB,OAAA;AAClB,kHAAA,eAAe,OAAA;AACf,oHAAA,iBAAiB,OAAA;AACjB,4GAAA,SAAS,OAAA;AASX,+CAAoD;AAA3C,kHAAA,kBAAkB,OAAA;AAW3B,mDAA6E;AAApE,qHAAA,mBAAmB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAClD,4EAA4E;AAC5E,mDAA2F;AAAlF,4HAAA,0BAA0B,OAAA;AAAE,6HAAA,2BAA2B,OAAA;AAChE,eAAe;AACf,0CAAwB;AACxB,mBAAmB;AACnB,yCAAuD;AAA9C,oGAAA,UAAU,OAAA;AAAE,mGAAA,SAAS,OAAA;AAC9B,kBAAkB;AAClB,yCAAgE;AAAvD,yGAAA,eAAe,OAAA;AAAE,uGAAA,aAAa,OAAA;AACvC,wBAAwB;AACxB,iCAA8C;AAArC,sGAAA,gBAAgB,OAAA;AACzB,yBAAyB;AACzB,mDAO6B;AAN3B,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AAEjB,yBAAyB;AACzB,qDAAuE;AAA9D,+HAAA,+BAA+B,OAAA"}

package/dist/local-path.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Keep local filesystem paths out of public GitHub comments (#1085).
+ *
+ * Runstate milestones, plan artifacts and sched alerts are issue comments, and in a public
+ * repository every byte of them is published. An absolute path such as a worktree under the
+ * operator's home directory leaks the user name and directory layout. So every writer
+ * rewrites a local path into a PORTABLE form before posting, and every reader resolves that
+ * form back against the machine it runs on — never against the posted string:
+ *
+ * - `<repo>/<relative>` — inside the repository's main checkout, or in the `worktrees/`
+ *   directory beside it (the `<project>/main` + `<project>/worktrees/<x>` layout gives
+ *   `<repo>/../worktrees/<x>`);
+ * - `<local>/<basename>` — anywhere else; resolvable only by matching a local worktree.
+ *
+ * {@link redactHomePaths} is the generic backstop: whatever a caller forgot to rewrite, a
+ * home-directory path never reaches a posted body.
+ *
+ * Pure apart from `os.homedir()` as a default: callers run the git commands that find the
+ * anchor (the main checkout root) and the worktree list, so this stays unit-testable.
+ */
+/** Prefix of a path recorded relative to the repository's main checkout. */
+export declare const REPO_PATH_TOKEN = "<repo>";
+/** Prefix of a path outside the repository; only its basename is kept. */
+export declare const LOCAL_PATH_TOKEN = "<local>";
+export interface LocalPathOptions {
+    /**
+     * The repository's main checkout root — `dirname(git rev-parse --git-common-dir)`, the
+     * one directory every worktree of the repo agrees on. `null` when not in a repository.
+     */
+    anchor?: string | null;
+    /** Extra home directories to treat as private (default: the current user's home). */
+    homes?: readonly string[];
+}
+/** True when `text` contains a home-directory path. */
+export declare function containsHomePath(text: string, opts?: LocalPathOptions): boolean;
+/** True for a value already in portable form. */
+export declare function isPortablePath(value: string): boolean;
+/**
+ * Rewrite a local path into its portable, publishable form.
+ *
+ * A relative `value` is resolved against `cwd` first (when given; otherwise it is returned
+ * unchanged — it carries no absolute prefix to leak). An already-portable value is returned
+ * as is. The result never contains a home-directory path.
+ */
+export declare function toPortablePath(value: string, opts?: LocalPathOptions & {
+    cwd?: string;
+}): string;
+/**
+ * Resolve a recorded path (portable or legacy absolute) against THIS machine.
+ *
+ * `<repo>/…` resolves against `anchor`; `<local>/<name>` matches the one local worktree
+ * whose basename is `<name>` (none or several → `null`); a legacy absolute path is returned
+ * normalized; any other relative value resolves against `anchor`. A `<repo>/…` value that
+ * lands outside the checkout and its sibling `worktrees/` directory is refused (`null`) —
+ * the recorded string comes from an issue comment and must not steer a caller anywhere.
+ */
+export declare function resolvePortablePath(value: string, opts?: {
+    anchor?: string | null;
+    worktrees?: readonly string[];
+}): string | null;
+/**
+ * Replace every home-directory path in `text` with its portable form: `<repo>/…` when it is
+ * inside the repository (`opts.anchor`), otherwise `<local>/<basename>`. Trailing sentence
+ * punctuation stays outside the replacement. Idempotent.
+ */
+export declare function redactHomePaths(text: string, opts?: LocalPathOptions): string;
+/**
+ * The `<repo>` anchor from `git rev-parse --path-format=absolute --git-common-dir` output:
+ * the common dir's parent for an ordinary repository, the common dir itself for a bare one.
+ * `null` for a failed or non-absolute answer.
+ */
+export declare function anchorFromCommonDir(stdout: string | null | undefined): string | null;
+/** Worktree paths listed by `git worktree list --porcelain` output (`[]` for none/failure). */
+export declare function parseWorktreePorcelain(stdout: string | null | undefined): string[];
+//# sourceMappingURL=local-path.d.ts.map

package/dist/local-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-path.d.ts","sourceRoot":"","sources":["../src/local-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,4EAA4E;AAC5E,eAAO,MAAM,eAAe,WAAW,CAAC;AACxC,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,YAAY,CAAC;AA0D1C,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED,uDAAuD;AACvD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAEnF;AAsBD,iDAAiD;AACjD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOrD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,gBAAgB,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,MAAM,CA+BR;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACnE,MAAM,GAAG,IAAI,CAoBf;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,MAAM,CAcjF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIpF;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAKlF"}

package/dist/local-path.js

@@ -0,0 +1,260 @@
+"use strict";
+/**
+ * Keep local filesystem paths out of public GitHub comments (#1085).
+ *
+ * Runstate milestones, plan artifacts and sched alerts are issue comments, and in a public
+ * repository every byte of them is published. An absolute path such as a worktree under the
+ * operator's home directory leaks the user name and directory layout. So every writer
+ * rewrites a local path into a PORTABLE form before posting, and every reader resolves that
+ * form back against the machine it runs on — never against the posted string:
+ *
+ * - `<repo>/<relative>` — inside the repository's main checkout, or in the `worktrees/`
+ *   directory beside it (the `<project>/main` + `<project>/worktrees/<x>` layout gives
+ *   `<repo>/../worktrees/<x>`);
+ * - `<local>/<basename>` — anywhere else; resolvable only by matching a local worktree.
+ *
+ * {@link redactHomePaths} is the generic backstop: whatever a caller forgot to rewrite, a
+ * home-directory path never reaches a posted body.
+ *
+ * Pure apart from `os.homedir()` as a default: callers run the git commands that find the
+ * anchor (the main checkout root) and the worktree list, so this stays unit-testable.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCAL_PATH_TOKEN = exports.REPO_PATH_TOKEN = void 0;
+exports.containsHomePath = containsHomePath;
+exports.isPortablePath = isPortablePath;
+exports.toPortablePath = toPortablePath;
+exports.resolvePortablePath = resolvePortablePath;
+exports.redactHomePaths = redactHomePaths;
+exports.anchorFromCommonDir = anchorFromCommonDir;
+exports.parseWorktreePorcelain = parseWorktreePorcelain;
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+/** Prefix of a path recorded relative to the repository's main checkout. */
+exports.REPO_PATH_TOKEN = '<repo>';
+/** Prefix of a path outside the repository; only its basename is kept. */
+exports.LOCAL_PATH_TOKEN = '<local>';
+/** Characters that may appear in a path embedded in free text (stops at quotes, brackets, `,`, `;`). */
+const PATH_CHAR = String.raw `[^\s'"\x60<>()\[\]{}|,;]`;
+/** A path segment (no separator). */
+const SEGMENT = String.raw `[^\s'"\x60<>()\[\]{}|,;/\\]`;
+/**
+ * Home-directory paths matched on any machine. Each pattern captures (group 1, when it has
+ * one) the rest of the path after the user name:
+ * - `/home/<user>`, `/Users/<user>`, plus the WSL / git-bash / ostree spellings
+ *   `/mnt/c/Users/<user>`, `/c/Users/<user>`, `/var/home/<user>`;
+ * - `C:\Users\<user>` (either slash);
+ * - a UNC path whose share contains `home\<user>` or `Users\<user>` (`\\wsl.localhost\…`);
+ * - a dash-encoded directory name carrying the path, `-home-<user>-…` (agent tools name
+ *   per-project directories that way). It has no group: the whole name becomes `<local>`,
+ *   since where the user name ends inside it is unknowable.
+ *
+ * The lookbehinds keep a URL (`example.com/home/x`) and an already-portable value
+ * (`<repo>/home/x`) from matching, which is what makes redaction idempotent.
+ */
+const HOME_PATTERNS = [
+    String.raw `(?<![\w.~>-])(?:/mnt/[A-Za-z]|/[A-Za-z]|/var)?/(?:home|Users)/${SEGMENT}+((?:/${PATH_CHAR}*)?)`,
+    String.raw `(?<![\w])[A-Za-z]:[\\/]+[Uu]sers[\\/]+${SEGMENT}+((?:[\\/]${PATH_CHAR}*)?)`,
+    String.raw `(?<![\w])\\\\[^\\\s'"]+\\(?:[^\\\s'"]+\\)*?(?:home|[Uu]sers)\\${SEGMENT}+((?:\\${PATH_CHAR}*)?)`,
+    String.raw `(?<![\w.])-(?:home|Users)-${SEGMENT}+`,
+];
+/** The directory beside the main checkout that holds its worktrees (`<project>/worktrees`). */
+const SIBLING_WORKTREES_DIR = 'worktrees';
+/** Directories whose children are user names. */
+const HOME_ROOTS = new Set(['/home', '/Users']);
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** The current user's home, when it is a real directory path worth matching. */
+function defaultHomes() {
+    try {
+        const home = os.homedir();
+        return home && home !== '/' && home.length > 1 ? [home] : [];
+    }
+    catch {
+        return [];
+    }
+}
+function homeRegex(homes) {
+    const extra = homes
+        .filter((h) => h.length > 1 && h !== '/')
+        .map((h) => String.raw `(?<![\w./-])${escapeRegExp(h.replace(/[\\/]+$/, ''))}((?:[\\/]${PATH_CHAR}*)?)(?=$|[^\w.-])`);
+    return new RegExp([...HOME_PATTERNS, ...extra].join('|'), 'g');
+}
+/** True when `text` contains a home-directory path. */
+function containsHomePath(text, opts = {}) {
+    return homeRegex(opts.homes ?? defaultHomes()).test(text);
+}
+function lastSegment(rest) {
+    const parts = rest.split(/[\\/]+/).filter((p) => p.length > 0);
+    return parts.length > 0 ? parts[parts.length - 1] : '';
+}
+function localToken(rest) {
+    const name = lastSegment(rest);
+    return name ? `${exports.LOCAL_PATH_TOKEN}/${name}` : exports.LOCAL_PATH_TOKEN;
+}
+/** Whether `p` is `dir` or below it. */
+function isWithin(dir, p) {
+    const rel = path.relative(dir, p);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+function toPosix(rel) {
+    return rel.split(path.sep).join('/');
+}
+/** True for a value already in portable form. */
+function isPortablePath(value) {
+    return (value === exports.REPO_PATH_TOKEN ||
+        value.startsWith(`${exports.REPO_PATH_TOKEN}/`) ||
+        value === exports.LOCAL_PATH_TOKEN ||
+        value.startsWith(`${exports.LOCAL_PATH_TOKEN}/`));
+}
+/**
+ * Rewrite a local path into its portable, publishable form.
+ *
+ * A relative `value` is resolved against `cwd` first (when given; otherwise it is returned
+ * unchanged — it carries no absolute prefix to leak). An already-portable value is returned
+ * as is. The result never contains a home-directory path.
+ */
+function toPortablePath(value, opts = {}) {
+    if (isPortablePath(value))
+        return value;
+    if (!path.isAbsolute(value)) {
+        if (opts.cwd === undefined)
+            return value;
+        value = path.resolve(opts.cwd, value);
+    }
+    const abs = path.resolve(value);
+    const homes = opts.homes ?? defaultHomes();
+    const anchor = opts.anchor ? path.resolve(opts.anchor) : null;
+    if (anchor !== null) {
+        let candidate = null;
+        if (isWithin(anchor, abs)) {
+            const rel = path.relative(anchor, abs);
+            candidate = rel === '' ? exports.REPO_PATH_TOKEN : `${exports.REPO_PATH_TOKEN}/${toPosix(rel)}`;
+        }
+        else {
+            // Only the sibling `worktrees/` directory (the layout `isSafeWorktree` in sched also
+            // accepts): any other neighbour of the checkout would publish that folder's name.
+            const siblings = path.join(path.dirname(anchor), SIBLING_WORKTREES_DIR);
+            if (isWithin(siblings, abs)) {
+                candidate = `${exports.REPO_PATH_TOKEN}/../${toPosix(path.relative(path.dirname(anchor), abs))}`;
+            }
+        }
+        if (candidate !== null && !containsHomePath(candidate, { homes }))
+            return candidate;
+    }
+    // Outside the repository: keep only the basename — and never a user name, which is
+    // what the basename of a home directory itself would be.
+    for (const home of homes) {
+        if (abs === path.resolve(home))
+            return exports.LOCAL_PATH_TOKEN;
+    }
+    if (HOME_ROOTS.has(path.dirname(abs)))
+        return exports.LOCAL_PATH_TOKEN;
+    return localToken(abs);
+}
+/**
+ * Resolve a recorded path (portable or legacy absolute) against THIS machine.
+ *
+ * `<repo>/…` resolves against `anchor`; `<local>/<name>` matches the one local worktree
+ * whose basename is `<name>` (none or several → `null`); a legacy absolute path is returned
+ * normalized; any other relative value resolves against `anchor`. A `<repo>/…` value that
+ * lands outside the checkout and its sibling `worktrees/` directory is refused (`null`) —
+ * the recorded string comes from an issue comment and must not steer a caller anywhere.
+ */
+function resolvePortablePath(value, opts = {}) {
+    if (value.length === 0 || value.includes('\0'))
+        return null;
+    const anchor = opts.anchor ? path.resolve(opts.anchor) : null;
+    if (value === exports.LOCAL_PATH_TOKEN || value.startsWith(`${exports.LOCAL_PATH_TOKEN}/`)) {
+        const name = value.slice(exports.LOCAL_PATH_TOKEN.length + 1);
+        if (!name || /[\\/]/.test(name) || name === '.' || name === '..')
+            return null;
+        const matches = (opts.worktrees ?? []).filter((w) => path.basename(w) === name);
+        return matches.length === 1 ? path.resolve(matches[0]) : null;
+    }
+    if (path.isAbsolute(value))
+        return path.resolve(value);
+    if (anchor === null)
+        return null;
+    const rel = value === exports.REPO_PATH_TOKEN
+        ? ''
+        : value.startsWith(`${exports.REPO_PATH_TOKEN}/`)
+            ? value.slice(exports.REPO_PATH_TOKEN.length + 1)
+            : value;
+    const resolved = path.resolve(anchor, rel);
+    const siblings = path.join(path.dirname(anchor), SIBLING_WORKTREES_DIR);
+    return isWithin(anchor, resolved) || isWithin(siblings, resolved) ? resolved : null;
+}
+/**
+ * Replace every home-directory path in `text` with its portable form: `<repo>/…` when it is
+ * inside the repository (`opts.anchor`), otherwise `<local>/<basename>`. Trailing sentence
+ * punctuation stays outside the replacement. Idempotent.
+ */
+function redactHomePaths(text, opts = {}) {
+    const homes = opts.homes ?? defaultHomes();
+    return text.replace(homeRegex(homes), (match, ...groups) => {
+        const trail = /[.:!?]+$/.exec(match)?.[0] ?? '';
+        const core = trail ? match.slice(0, -trail.length) : match;
+        // `groups` is the capture groups, then the offset and the whole input (no named groups
+        // are used). At most one alternative matched, so the first string group is its rest.
+        const rest = groups.slice(0, -2).find((g) => typeof g === 'string') ?? '';
+        const restCore = trail && rest.endsWith(trail) ? rest.slice(0, -trail.length) : rest;
+        if (core.startsWith('/') && opts.anchor) {
+            return toPortablePath(core, { anchor: opts.anchor, homes }) + trail;
+        }
+        return localToken(restCore) + trail;
+    });
+}
+/**
+ * The `<repo>` anchor from `git rev-parse --path-format=absolute --git-common-dir` output:
+ * the common dir's parent for an ordinary repository, the common dir itself for a bare one.
+ * `null` for a failed or non-absolute answer.
+ */
+function anchorFromCommonDir(stdout) {
+    const common = stdout?.trim() ?? '';
+    if (!path.isAbsolute(common))
+        return null;
+    return path.basename(common) === '.git' ? path.dirname(common) : common;
+}
+/** Worktree paths listed by `git worktree list --porcelain` output (`[]` for none/failure). */
+function parseWorktreePorcelain(stdout) {
+    return (stdout ?? '')
+        .split('\n')
+        .filter((line) => line.startsWith('worktree '))
+        .map((line) => line.slice('worktree '.length));
+}
+//# sourceMappingURL=local-path.js.map

package/dist/local-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-path.js","sourceRoot":"","sources":["../src/local-path.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6EH,4CAEC;AAuBD,wCAOC;AASD,wCAkCC;AAWD,kDAuBC;AAOD,0CAcC;AAOD,kDAIC;AAGD,wDAKC;AAhOD,4CAA8B;AAC9B,gDAAkC;AAElC,4EAA4E;AAC/D,QAAA,eAAe,GAAG,QAAQ,CAAC;AACxC,0EAA0E;AAC7D,QAAA,gBAAgB,GAAG,SAAS,CAAC;AAE1C,wGAAwG;AACxG,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAA,0BAA0B,CAAC;AACvD,qCAAqC;AACrC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAA,6BAA6B,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,MAAM,aAAa,GAAsB;IACvC,MAAM,CAAC,GAAG,CAAA,iEAAiE,OAAO,SAAS,SAAS,MAAM;IAC1G,MAAM,CAAC,GAAG,CAAA,yCAAyC,OAAO,aAAa,SAAS,MAAM;IACtF,MAAM,CAAC,GAAG,CAAA,iEAAiE,OAAO,UAAU,SAAS,MAAM;IAC3G,MAAM,CAAC,GAAG,CAAA,6BAA6B,OAAO,GAAG;CAClD,CAAC;AAEF,+FAA+F;AAC/F,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAE1C,iDAAiD;AACjD,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErE,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAwB;IACzC,MAAM,KAAK,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;SACxC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,MAAM,CAAC,GAAG,CAAA,eAAe,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,YAAY,SAAS,mBAAmB,CAC1G,CAAC;IACJ,OAAO,IAAI,MAAM,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAYD,uDAAuD;AACvD,SAAgB,gBAAgB,CAAC,IAAY,EAAE,OAAyB,EAAE;IACxE,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,wBAAgB,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,wBAAgB,CAAC;AACjE,CAAC;AAED,wCAAwC;AACxC,SAAS,QAAQ,CAAC,GAAW,EAAE,CAAS;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,iDAAiD;AACjD,SAAgB,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,KAAK,KAAK,uBAAe;QACzB,KAAK,CAAC,UAAU,CAAC,GAAG,uBAAe,GAAG,CAAC;QACvC,KAAK,KAAK,wBAAgB;QAC1B,KAAK,CAAC,UAAU,CAAC,GAAG,wBAAgB,GAAG,CAAC,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,KAAa,EACb,OAA4C,EAAE;IAE9C,IAAI,cAAc,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACzC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvC,SAAS,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,uBAAe,CAAC,CAAC,CAAC,GAAG,uBAAe,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,qFAAqF;YACrF,kFAAkF;YAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAAC;YACxE,IAAI,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,GAAG,uBAAe,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;IACtF,CAAC;IACD,mFAAmF;IACnF,yDAAyD;IACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,wBAAgB,CAAC;IAC1D,CAAC;IACD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,wBAAgB,CAAC;IAC/D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CACjC,KAAa,EACb,OAAkE,EAAE;IAEpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IAAI,KAAK,KAAK,wBAAgB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,wBAAgB,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9E,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GACP,KAAK,KAAK,uBAAe;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,uBAAe,GAAG,CAAC;YACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAe,CAAC,MAAM,GAAG,CAAC,CAAC;YACzC,CAAC,CAAC,KAAK,CAAC;IACd,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAY,EAAE,OAAyB,EAAE;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAa,EAAE,GAAG,MAAiB,EAAE,EAAE;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,uFAAuF;QACvF,qFAAqF;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,cAAc,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACtE,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,MAAiC;IACnE,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1E,CAAC;AAED,+FAA+F;AAC/F,SAAgB,sBAAsB,CAAC,MAAiC;IACtE,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-dossier/core",
-  "version": "1.14.6-next.616.1",
+  "version": "1.15.0-next.618.1",
   "description": "TypeScript library for parsing, signing, and verifying signed, versioned agent skills used in model-driven orchestration.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",