@aksp/opencrew 1.6.1 → 1.6.3

package/templates/_opencrew/core/best-practices/social-networks-publishing.md

@@ -11,7 +11,7 @@ version: "1.0.0"
 ## Compact Rules
 
 1. Never publish live content without explicit user confirmation.
-2. Always execute and report a successful dry-run before offering the live publish option.
+2. With `instagram-publisher`, execute and report a successful dry-run before offering the live publish option; `blotato` has no dry-run: send nothing to it, not even media, before the user answers with the word `publicar`.
 3. Validate all platform-specific constraints (image format, caption length) before API calls.
 4. Adapt and format content natively for each target platform; do not cross-post raw text.
 5. Report publishing results immediately, including success (with URL) or failure details.
@@ -19,7 +19,7 @@ version: "1.0.0"
 7. Track API usage and proactively warn users if approaching rate limits.
 8. Fall back gracefully if a required publishing skill is missing; list available alternatives.
 9. Inform the user and seek permission before converting image formats (e.g., PNG to JPEG).
-10. Display a structured preview (platform, images, caption, hashtags, validations) before dry-run.
+10. Display a structured preview (platform, images, caption, hashtags, validations) before anything is sent (the `instagram-publisher` dry-run included).
 11. Do not silently truncate captions; ask the user to shorten them if limits are exceeded.
 12. Request user direction (continue or abort) if one platform fails in a multi-platform batch.
 
@@ -29,9 +29,9 @@ version: "1.0.0"
 
 ## Core Principles
 
-1. **Never publish without explicit user confirmation.** This is the cardinal rule. Before any live post, present the full preview (platform, images, caption, hashtags) and wait for the user to confirm. A dry-run is not confirmation. The user must explicitly say "publish" or "go ahead" before any live API call is made.
+1. **Never publish without explicit user confirmation.** This is the cardinal rule. Before any live post, present the full preview (platform, images, caption, hashtags) and wait for the user to confirm. A dry-run is not confirmation. The user must answer with the confirmation word the publishing skill asks for (e.g. `publicar`) before any live API call is made; any other answer means do not publish.
 
-2. **Dry-run first, always.** The first execution of any publishing workflow must be a dry-run (test mode). This validates that credentials are configured, images meet requirements, captions are within limits, and the API connection works. Only after a successful dry-run should the user be offered the option to publish for real.
+2. **Dry-run first, where the skill has one (`instagram-publisher`).** There, the first execution of the publishing workflow must be a dry-run (test mode). This validates that credentials are configured, images meet requirements, captions are within limits, and the API connection works. Only after a successful dry-run should the user be offered the option to publish for real. `blotato` has no dry-run: send nothing to it, not even media, before the user answers with the word `publicar` — its upload is part of the publication.
 
 3. **Validate platform requirements before attempting to publish.** Every platform has specific constraints. Validate all of them before making any API call. If validation fails, report the specific issue and suggest a fix before proceeding.
 
@@ -107,12 +107,12 @@ Every platform has specific constraints that must be validated before making any
    Status: All validations passed
    ```
 
-5. **Execute dry-run.** Run the publishing workflow in test mode:
+5. **Execute dry-run (`instagram-publisher` only).** Run the publishing workflow in test mode:
    - Instagram: `--dry-run` flag on the publish script
-   - Blotato: validate API connection and media upload without posting
-   - Report dry-run results: credentials OK, media uploaded, container created, ready to publish.
+   - Blotato: no dry-run. Skip this step: nothing is uploaded or sent before the confirmation word (step 6)
+   - Report the `instagram-publisher` dry-run results: credentials OK, media uploaded, container created, ready to publish.
 
-6. **Request final confirmation.** Present the dry-run results and ask the user to confirm the live publish. Do not proceed without explicit approval.
+6. **Request final confirmation.** Present the dry-run results (Blotato: the preview) and ask for the skill's confirmation word. Do not proceed without it.
 
 7. **Publish and report.** Execute the live publish. Report the result immediately:
    - Success: post URL, post ID, platform, timestamp
@@ -130,7 +130,7 @@ Every platform has specific constraints that must be validated before making any
 ## Quality Criteria
 
 - [ ] User confirmation was received before any live publish (not just dry-run)
-- [ ] Dry-run was executed and passed before live publish
+- [ ] Dry-run was executed and passed before live publish (`instagram-publisher`); nothing was sent to Blotato before the confirmation word
 - [ ] All platform-specific validations passed (image format, dimensions, caption length, image count)
 - [ ] Publish preview was presented with complete details (platform, images, caption, validation status)
 - [ ] Successful publishes include post URL/permalink and post ID
@@ -213,7 +213,7 @@ Skill:   blotato (multi-platform)
 
 PLATFORM 1/3: Instagram
   Validation: All checks passed
-  Dry-run:    Passed
+  Preview:    Confirmed with the word "publicar"
   Publish:    Published successfully
   Post URL:   https://www.instagram.com/p/DEF456abc/
   Post ID:    ig_17899506834567890
@@ -221,7 +221,7 @@ PLATFORM 1/3: Instagram
 
 PLATFORM 2/3: LinkedIn
   Validation: All checks passed
-  Dry-run:    Passed
+  Preview:    Confirmed with the word "publicar"
   Publish:    FAILED
   Error:      403 Forbidden — "Publishing permission not granted"
   HTTP Status: 403
@@ -245,7 +245,7 @@ PLATFORM 3/3: X/Twitter
   [User chooses: b, provides short caption]
 
   Validation: All checks passed (short caption: 142 chars)
-  Dry-run:    Passed
+  Preview:    Confirmed with the word "publicar"
   Publish:    Published successfully
   Post URL:   https://x.com/brandname/status/1234567890123456789
   Post ID:    tw_1234567890123456789
@@ -276,7 +276,7 @@ SUMMARY
 
 5. **Never report success without a URL.** "Published successfully" without a post URL is not verifiable. Every successful publish must include the post permalink. If the API does not return a URL, report that as a limitation.
 
-6. **Never assume credentials are valid.** Always verify credentials during the dry-run phase. Tokens expire, permissions get revoked, accounts get disconnected. A credential check is part of every publish workflow.
+6. **Never assume credentials are valid.** Always verify credentials before publishing (the dry-run with `instagram-publisher`; listing the accounts, read-only, with `blotato`). Tokens expire, permissions get revoked, accounts get disconnected. A credential check is part of every publish workflow.
 
 7. **Never publish the same raw caption across all platforms without adaptation.** Instagram, LinkedIn, and X/Twitter have different formatting conventions, character limits, and audience expectations. At minimum, verify the caption fits the platform constraints. Ideally, suggest platform-specific adaptations.
 
@@ -284,7 +284,7 @@ SUMMARY
 
 1. **Present a structured preview before every publish.** Show: platform, account, images (with dimensions and format), caption (with character count), hashtags, and validation status. The user must see exactly what will be published.
 
-2. **Run a dry-run before every live publish.** Test the full workflow without posting. Verify credentials, upload media, create containers, validate everything. Report dry-run results before requesting confirmation.
+2. **Run a dry-run before every live publish with `instagram-publisher`.** Test the full workflow without posting. Verify credentials, upload media, create containers, validate everything. Report dry-run results before requesting confirmation. With `blotato` there is no dry-run: the preview and the confirmation word come before any upload.
 
 3. **Report results immediately after each publish.** Do not batch results. After each platform publish (success or failure), report the outcome with all relevant details before moving to the next platform.
 

package/templates/_opencrew/core/prompts/export.prompt.md

@@ -50,7 +50,7 @@ Transform markdown content into a PDF file using Playwright (already available i
 4. Write the HTML to a temporary file: `crews/{crew-name}/output/{run_id}/export/temp.html`
 5. Use Playwright to render the HTML as PDF:
    ```bash
-   npx playwright open --viewport=1240,1754 crews/{crew-name}/output/{run_id}/export/temp.html
+   npx playwright open --viewport=1240,1754 "crews/{crew-name}/output/{run_id}/export/temp.html"
    ```
    Then use the print-to-PDF functionality.
 6. Save the PDF to the step's `outputFile` path

package/templates/_opencrew/core/prompts/sherlock-shared.md

@@ -111,12 +111,12 @@ Browser sessions are stored as JSON files in `_opencrew/_browser_profile/`:
 
 **Loading a session (Playwright CLI):**
 ```bash
-npx playwright open --load-storage=_opencrew/_browser_profile/{platform}.json {url}
+npx playwright open --load-storage=_opencrew/_browser_profile/{platform}.json "{url}"
 ```
 
 **Saving a session (Playwright CLI):**
 ```bash
-npx playwright open --save-storage=_opencrew/_browser_profile/{platform}.json {url}
+npx playwright open --save-storage=_opencrew/_browser_profile/{platform}.json "{url}"
 ```
 
 When using MCP browser tools or other automation APIs, use these JSON files as the source of truth for session state — load the stored cookies/localStorage at the start of each investigation and save after login when the user consents.
@@ -210,7 +210,7 @@ On the first investigation for a given platform, Sherlock may encounter a login
 
 4. **Step 1 — Open browser for login (NO session saving):**
    ```bash
-   npx playwright open {platform-url}
+   npx playwright open "{platform-url}"
    ```
    Use a **5-minute timeout** on this command. The user needs time to complete login + any verification (email, SMS, 2FA).
 
@@ -220,7 +220,7 @@ On the first investigation for a given platform, Sherlock may encounter a login
    Ask: "Want me to save this session for next time?"
    If yes:
    ```bash
-   npx playwright open --save-storage=_opencrew/_browser_profile/{platform}.json {platform-url}
+   npx playwright open --save-storage=_opencrew/_browser_profile/{platform}.json "{platform-url}"
    ```
    This command completes quickly since the browser already has the authenticated cookies.
 
@@ -231,7 +231,7 @@ On the first investigation for a given platform, Sherlock may encounter a login
 
 After the first login, load the session file at the start of each investigation:
 ```bash
-npx playwright open --load-storage=_opencrew/_browser_profile/{platform}.json {url}
+npx playwright open --load-storage=_opencrew/_browser_profile/{platform}.json "{url}"
 ```
 
 Still check for login walls on each run (platforms may expire sessions) and re-prompt the user if needed.

package/templates/_opencrew/core/runner.pipeline.md

@@ -5,6 +5,23 @@
 
 You are the Pipeline Runner. Your job is to execute a crew's pipeline step by step.
 
+## Safe names in commands (nome seguro)
+
+Applies to EVERY command below and in any prompt or skill. A path of the crew or of the user's
+project goes into a command only between double quotes and only if it is made of letters (accents
+included), digits, space and `. _ - / \ : ( )`. With any other character (`$`, backtick, quote,
+`%`, `!`, `,`, `;`, `&`, `|`, `<`, `>`, line break) do NOT build the command:
+- **Crew folder** → stop: "⚠️ A pasta da crew (`crews/{name}`) tem um caractere que não posso usar
+  em comandos ({caractere}). Renomeie a pasta e rode de novo."
+- **Output file** (`inputFile`, `outputFile`, any file passed to a script) → ask and wait:
+  ```
+  ⚠️ O nome `{caminho}` tem um caractere que não posso usar em comandos ({caractere}). Use só letras, números, espaço, ponto, hífen, sublinhado e parênteses.
+  1. Parar para você renomear (ajuste também o `outputFile` do passo)
+  2. Seguir sem conferir este arquivo
+  ```
+  On 2, run no command with that file (no validation gate, not sent to the checker) and list it at
+  the final approval: `{arquivo} — não verificado: nome com caractere que não vai em comando`.
+
 ## Initialization
 
 Before starting execution:
@@ -49,7 +66,7 @@ Before starting execution:
 
 1b. **Memory format migration** — After loading `memories.md`, check whether it uses the new format by scanning for the `## Estilo de Escrita` section header:
    ```bash
-   [ -f crews/{name}/_memory/memories.md ] && grep -q "## Estilo de Escrita" crews/{name}/_memory/memories.md && echo "NEW_FORMAT" || echo "OLD_FORMAT"
+   [ -f "crews/{name}/_memory/memories.md" ] && grep -q "## Estilo de Escrita" "crews/{name}/_memory/memories.md" && echo "NEW_FORMAT" || echo "OLD_FORMAT"
    ```
    - If `NEW_FORMAT` → proceed normally.
    - If `OLD_FORMAT` (or file is empty / does not exist) → migrate before proceeding:
@@ -74,7 +91,7 @@ Before starting execution:
         (Use the crew's display name for `{crew-name}`, and the crew code for `{name}` in file paths — they refer to the same crew.)
      b. Check if `crews/{name}/_memory/runs.md` exists:
         ```bash
-        test -f crews/{name}/_memory/runs.md && echo "EXISTS" || echo "MISSING"
+        test -f "crews/{name}/_memory/runs.md" && echo "EXISTS" || echo "MISSING"
         ```
         If `MISSING`, create it with:
         ```markdown
@@ -102,9 +119,10 @@ Before starting execution:
     On 1, run the same command with `--corrigir`, show the new result and re-read `crew.yaml` and
     any agent file already loaded (it may have changed them); 1d then loads the sources from the
     corrected paths. If the new result still ends in `FONTES:PENDENTE`, ask again with options 2 and
-    3 only. Not-portable alerts (absolute paths) are mentioned once, without stopping. If the script
-    did not run (no Node, an error, or no `FONTES:` status line), tell the user "⚠️ A conferência de
-    fontes não rodou: {motivo}" and continue; the final approval repeats the warning.
+    3 only. Alerts — not portable (absolute paths) or "não conferido" (a network path or a site
+    address: the script never accesses the network) — are mentioned once, without stopping. If the
+    script did not run (no Node, an error, or no `FONTES:` status line), tell the user "⚠️ A
+    conferência de fontes não rodou: {motivo}" and continue; the final approval repeats the warning.
 
 1d. **Project sources (`fontes:`)** — if `crew.yaml` has a `fontes:` list (files or folders of
     the user's project, paths relative to the project root), read them now: a file in full up to
@@ -224,7 +242,7 @@ Before starting execution:
    - Format: `YYYY-MM-DD-HHmmss` using the current timestamp (e.g. `2026-03-03-143022`)
    - Check if `crews/{name}/output/{run_id}/` already exists
      - If it does (sub-second collision), append `-2`, `-3`, etc. until the folder does not exist
-   - Create the folder using Bash: `mkdir -p crews/{name}/output/{run_id}`
+   - Create the folder using Bash: `mkdir -p "crews/{name}/output/{run_id}"`
    - Store `run_id` in working memory for this run — it will be used for ALL output paths
 6. **Initialize state.json** (only if `dashboard_enabled` — see step 1a; otherwise skip this entire step, including all sub-steps below):
    - **IMPORTANT**: When enabled, write to `crews/{name}/state.json` before every step and after every handoff, as described throughout this document. When `dashboard_enabled` is false, never create, write, or delete this file.
@@ -307,13 +325,14 @@ Before executing any step that references an agent:
       ```
    If the step has no `format:` field, skip this step entirely (backward compatible).
 6. **Inject skill context (Two-Tier)**:
-    a. Build a Tier 1 skill index from each declared skill's frontmatter `name` and `description` (~30 tokens per skill)
-    b. Append the index after format injection:
+    a. Build a Tier 1 skill index from each declared skill's frontmatter `name`, `description` and `side_effects` (~30 tokens per skill)
+    b. Append the index after format injection (the second form is for every skill with `side_effects: irreversible`):
        ```
        --- AVAILABLE SKILLS ---
        - {skill-id}: {description} (type: {type})
+       - {skill-id}: {description} (type: {type}) — irreversível: carregue as instruções desta skill e peça a confirmação antes de usar
        ```
-    c. If the step's frontmatter contains `skills_needed: [...]`, load Tier 2 (full SKILL.md body) for those skills immediately
+    c. If the step's frontmatter contains `skills_needed: [...]`, load Tier 2 (full SKILL.md body) for those skills immediately; for a skill with `side_effects: irreversible`, always load Tier 2 before its first use
     d. Otherwise, Tier 2 is loaded on-demand when the agent invokes a skill during execution
     e. See `_opencrew/core/skills.engine.md` Operation 6 for full details
 
@@ -464,7 +483,7 @@ Apply to every path that was transformed in Step 1:
 
 2. Detect existing versions for this group using Bash:
    ```bash
-   ls -1 crews/{name}/output/{run_id}/{relative-group}/ 2>/dev/null | grep -E '^v[0-9]+$' | sort -V | tail -1
+   ls -1 "crews/{name}/output/{run_id}/{relative-group}/" 2>/dev/null | grep -E '^v[0-9]+$' | sort -V | tail -1
    ```
    - If the command returns a version (e.g. `v2`) → use `v3`
    (Always increment the highest version found, even if lower versions have gaps — e.g. if `v1` and `v3` exist, use `v4`)
@@ -732,7 +751,8 @@ When a step has `on_reject: {step-id}` (a review step):
    of alerts and the {Z} items not measured or not verified (the `Não medido` and `Não verificado`
    lines under each file, not the "não é texto" line of **Notas**), one per line as
    `{arquivo} — {motivo}`, then the lines under `**Notas:**` in that report, as they are written,
-   and repeat every "não rodou" warning of this run (checker and source check). If the approved
+   and repeat every "não rodou" warning of this run (checker and source check) and the line of
+   every file left unchecked by the safe-name rule. If the approved
    text still contains `[PREENCHER: …]`, ask the user for each missing piece of real information
    and write it into the text before approving.
 
@@ -801,7 +821,7 @@ After writing the final "completed" state to `crews/{name}/state.json`:
 1. Add the `completedAt` field (or `failedAt` if status is `failed`) with the current ISO timestamp
 2. Copy `state.json` to the run output folder for permanent history:
    ```bash
-   cp crews/{name}/state.json crews/{name}/output/{run_id}/state.json
+   cp "crews/{name}/state.json" "crews/{name}/output/{run_id}/state.json"
    ```
 3. Leave the working copy of `crews/{name}/state.json` in place — do not delete it and
    do not add an artificial delay. A dashboard watching the file already sees the

package/templates/_opencrew/core/scripts/comum.mjs

@@ -1,6 +1,7 @@
 // Validações e mensagens de erro de uso comuns aos scripts do runtime (verificar,
 // conferir-fontes…). Node puro, sem dependências.
-// Spec: specs/fase-r1-reparos-1-6-1.md, regra 13 (repositório do OpenCrew).
+// Specs: specs/fase-r1-reparos-1-6-1.md, regra 13, e specs/fase-r2-update-e-envio-seguros.md,
+// regra 23 (repositório do OpenCrew).
 import { existsSync, realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -12,12 +13,56 @@ export const MSG = {
   crewNaoEncontrada: (crew) => `Crew não encontrada: ${crew}`,
 };
 
-/** O caminho (relativo à raiz ou absoluto) fica dentro da raiz do projeto? */
-export function dentroDoProjeto(raiz, caminho) {
-  const rel = path.relative(raiz, path.resolve(raiz, caminho));
+/** Caminho de rede: começa por duas barras (`\\` ou `//`), em qualquer sistema. Nunca vai ao disco. */
+export const ehDeRede = (caminho) => /^[\\/]{2}/.test(caminho);
+
+/** Pelo texto: `alvo` é a `pasta` ou fica dentro dela? */
+function contem(pasta, alvo) {
+  const rel = path.relative(pasta, alvo);
   return !(rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel));
 }
 
+/**
+ * Lugar real de um caminho: link, junção e nome curto resolvidos. O trecho que ainda não existe é
+ * juntado, como foi escrito, à pasta mais funda que existe. Caminho de rede não é consultado: vale
+ * o texto.
+ */
+export function lugarReal(caminho) {
+  const abs = path.resolve(caminho);
+  if (ehDeRede(caminho) || ehDeRede(abs)) return abs;
+  try {
+    return realpathSync.native(abs);
+  } catch {
+    const pai = path.dirname(abs);
+    return pai === abs ? abs : path.join(lugarReal(pai), path.basename(abs));
+  }
+}
+
+/** Pelo lugar real: `caminho` é a `pasta` ou fica dentro dela? */
+export const realDentroDe = (pasta, caminho) => contem(lugarReal(pasta), lugarReal(caminho));
+
+/**
+ * O caminho (relativo à raiz ou absoluto) fica dentro do projeto? Sim quando o texto ou o lugar
+ * real diz "dentro"; não, só quando os dois dizem "fora" (regra 23). Raiz e caminho são resolvidos
+ * pela mesma função, e o lugar real só é consultado quando o texto diz "fora". Caminho de rede só
+ * vale pelo texto, com o projeto também na rede: o disco não é tocado, em nenhum sistema.
+ */
+export function dentroDoProjeto(raiz, caminho) {
+  const alvo = path.resolve(raiz, caminho);
+  if (ehDeRede(caminho)) return ehDeRede(raiz) && contem(raiz, alvo);
+  return contem(raiz, alvo) || realDentroDe(raiz, alvo);
+}
+
+/**
+ * Caminho de dentro do projeto, relativo à raiz e com `/`: pelo texto quando o texto já fica
+ * dentro; senão, pelo lugar real (link, junção ou nome curto que leva ao projeto).
+ */
+export function relativoAoProjeto(raiz, caminho) {
+  const alvo = path.resolve(raiz, caminho);
+  const [de, para] = contem(raiz, alvo) ? [raiz, alvo] : [lugarReal(raiz), lugarReal(alvo)];
+  return path.relative(de, para).split(path.sep).join('/');
+}
+
 /**
  * O script foi chamado direto (`node …/script.mjs`)? Compara os caminhos reais: com o projeto
  * aberto por uma junção ou um link de pasta, o Node resolve o link em `import.meta.url` e não em

package/templates/_opencrew/core/scripts/conferir-fontes/busca.mjs

@@ -1,10 +1,12 @@
 // Busca da conferência de fontes: onde está cada caminho citado (crew → raiz do projeto →
 // absoluto → ao lado do agente ou da task que cita) e, quando ele sumiu, o que existe no projeto
-// com o mesmo nome. Só testa existência e lista nomes; nunca lê conteúdo.
-// Spec: specs/fase-r1-reparos-1-6-1.md, regra 17 (repositório do OpenCrew).
+// com o mesmo nome. Só testa existência e lista nomes; nunca lê conteúdo nem acessa a rede.
+// Specs: specs/fase-r1-reparos-1-6-1.md, regra 17, e specs/fase-r2-update-e-envio-seguros.md,
+// regra 25 (repositório do OpenCrew).
 import { readdir } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { ehDeRede } from '../comum.mjs';
 
 export const LIMITE_DA_BUSCA = 20000;
 const IGNORAR = new Set(['node_modules', 'output', '_opencrew', '_build']);
@@ -13,6 +15,7 @@ export const barra = (p) => p.split(path.sep).join('/');
 export const ehAbsoluto = (p) => /^[A-Za-z]:[\\/]/.test(p) || p.startsWith('/');
 export const temBarraFinal = (ref) => /[\\/]$/.test(ref);
 const semBarraFinal = (ref) => ref.replace(/[\\/]+$/, '');
+const ehPasta = (p) => Boolean(p) && Boolean(statSync(p, { throwIfNoEntry: false })?.isDirectory());
 
 const SUFIXO_DE_AGENTE = '.agent.md';
 
@@ -33,8 +36,10 @@ function pastasDeQuemCita(raiz, crew, citadoEm) {
 /**
  * Caminho real do que foi citado, ou null quando não existe. Ordem: pasta da crew → raiz do
  * projeto → absoluto → pastas ao lado dos arquivos de agente ou de task que citam (`citadoEm`).
+ * Citação de duas barras (caminho de rede) nunca chega ao disco: sai como "não existe".
  */
 export function resolver(raiz, crew, ref, citadoEm = []) {
+  if (ehDeRede(ref)) return null;
   if (ehAbsoluto(ref)) return existsSync(ref) ? path.resolve(ref) : null;
   for (const base of [path.resolve(raiz, crew), raiz, ...pastasDeQuemCita(raiz, crew, citadoEm)]) {
     const p = path.resolve(base, ref);
@@ -43,6 +48,40 @@ export function resolver(raiz, crew, ref, citadoEm = []) {
   return null;
 }
 
+/**
+ * O primeiro segmento de `exemplo.com/blog/`, quando tem cara de domínio: um ponto que não é o
+ * início e, depois do último ponto, 2 a 24 letras. Nome sem barra (`briefing.md`) é arquivo: null.
+ */
+function dominioNoInicio(ref) {
+  const corte = ref.search(/[\\/]/);
+  const primeiro = ref.slice(0, Math.max(corte, 0));
+  const ponto = primeiro.lastIndexOf('.');
+  return ponto > 0 && /^[A-Za-z]{2,24}$/.test(primeiro.slice(ponto + 1)) ? primeiro : null;
+}
+
+/**
+ * Citação que a conferência não testa (regra 25 da fase R2): caminho de rede (começa por duas
+ * barras) ou endereço de site — tem `://` (menos `http(s)://`, que fica como sempre foi), começa
+ * por `mailto:` ou `www.`. Caminho de disco (letra de unidade ou uma barra no início) nunca é
+ * endereço. Não consulta o disco nem a rede.
+ */
+export function ehRedeOuSite(ref) {
+  if (ehDeRede(ref)) return true;
+  if (ehAbsoluto(ref) || /^https?:\/\//i.test(ref)) return false;
+  return ref.includes('://') || /^(?:mailto:|www\.)/i.test(ref);
+}
+
+/**
+ * Citação que só parece endereço de site pela forma: o primeiro segmento tem cara de domínio e
+ * não há pasta com esse nome no projeto. Quem chama confere antes se o projeto tem arquivo com o
+ * mesmo nome: pasta com ponto que foi movida continua pendência, com sugestão.
+ */
+export function pareceSite({ raiz, crew }, { ref, citadoEm }) {
+  if (ehAbsoluto(ref) || /^https?:\/\//i.test(ref)) return false;
+  const dominio = dominioNoInicio(ref);
+  return dominio != null && !ehPasta(resolver(raiz, crew, dominio, citadoEm));
+}
+
 /**
  * Índice nome → caminhos relativos à raiz (pasta termina em `/`), sem saídas, dependências e
  * pastas ocultas. Para ao passar de `limite` itens: aí `parcial` é true.

package/templates/_opencrew/core/scripts/conferir-fontes/relatorio.mjs

@@ -1,7 +1,7 @@
 // Relatório da conferência de fontes e as mensagens ao usuário (PT-BR).
-// Spec: specs/fase-r1-reparos-1-6-1.md, regra 17 e seção 6 (repositório do OpenCrew).
-import path from 'node:path';
-import { barra } from './busca.mjs';
+// Specs: specs/fase-r1-reparos-1-6-1.md, regra 17 e seção 6, e
+// specs/fase-r2-update-e-envio-seguros.md, regras 24 a 26 e seção 6 (repositório do OpenCrew).
+import { relativoAoProjeto } from '../comum.mjs';
 
 const plural = (n, um, varios) => `${n} ${n === 1 ? um : varios}`;
 
@@ -10,6 +10,9 @@ export const MSG = {
   corrigidos: (n) => `${plural(n, 'caminho corrigido', 'caminhos corrigidos')} (cópia .bak ao lado de cada arquivo alterado).\n`,
   semCorrecaoAutomatica: (n) => `Não há correção automática para ${n} pendência(s): escolha um candidato ou corrija o caminho na crew.`,
   buscaParcial: (limite) => `Procurei só nos primeiros ${limite} itens do projeto; pode existir um arquivo com esse nome que eu não vi.`,
+  linkParaFora: (arquivo) => `Não corrigi \`${arquivo}\`: é um link que aponta para fora da crew. O caminho citado nele continua como estava.`,
+  crewLigadaParaFora: (crew) => `Não corrigi nada: a pasta \`${crew}\` é um link que aponta para fora do projeto.`,
+  naoConferi: (motivo) => `Não consegui conferir: ${motivo}`,
 };
 
 const MAX_NOMES = 20;
@@ -37,16 +40,25 @@ function linhaDoAlerta(i, onde) {
   return `- ⚠️ \`${i.ref}\` é um caminho absoluto (não é portátil — quebra em outro computador).${sugestao} (${onde})`;
 }
 
+/** Caminho de rede ou endereço de site: a citação aparece, e o relatório diz que não foi testada. */
+function linhaDoNaoConferido(i, onde) {
+  return `- ⚠️ \`${i.ref}\` é um caminho de rede ou um endereço de site: não conferi se existe (a conferência não acessa a rede). (${onde})`;
+}
+
+// Os dois estados de alerta (não mudam o status); qualquer outro estado apontado é pendência.
+const LINHA_DO_ALERTA = { 'nao-portatil': linhaDoAlerta, 'nao-conferido': linhaDoNaoConferido };
+
 export function formatar(r) {
   const aviso = r.buscaParcial ? MSG.buscaParcial(r.limite) : '';
   const contar = (estado) => r.refs.filter((i) => i.estado === estado).length;
   const apontados = r.refs.filter((x) => x.estado !== 'ok');
   const linhas = [`## Conferência de fontes — ${r.crew}`, ''];
   for (const i of apontados) {
-    const onde = `citado em ${i.citadoEm.map((a) => barra(path.relative(r.raiz, a))).join(', ')}`;
-    linhas.push(i.estado === 'nao-portatil' ? linhaDoAlerta(i, onde) : linhaDaPendencia(i, onde, aviso));
+    const onde = `citado em ${i.citadoEm.map((a) => relativoAoProjeto(r.raiz, a)).join(', ')}`;
+    linhas.push((LINHA_DO_ALERTA[i.estado] ?? linhaDaPendencia)(i, onde, aviso));
   }
   if (apontados.length) linhas.push(''); // sem pendência nem alerta, uma linha em branco só
-  linhas.push(`**Resumo: ${r.refs.length} fontes — ${contar('ok')} ok, ${contar('faltando')} pendentes, ${contar('nao-portatil')} alertas**`, '');
+  const alertas = contar('nao-portatil') + contar('nao-conferido');
+  linhas.push(`**Resumo: ${r.refs.length} fontes — ${contar('ok')} ok, ${contar('faltando')} pendentes, ${alertas} alertas**`, '');
   return linhas.join('\n');
 }