@aperant/framework 0.7.0 → 0.7.3

package/dist/cli/commands/features-audit.mjs

@@ -11,22 +11,167 @@
  *   1. `--diff-files <a,b,c>` explicit CSV (highest priority)
  *   2. `--since <ref>` → runs `git diff --name-only <ref>..HEAD`
  *   3. fallback: `git diff HEAD --name-only` (current WIP)
+ *
+ * BUG-025b worktree-redirect: features-audit historically wrote to the
+ * invoking cwd's `.aperant/features/`, leaking generated `*.json` into
+ * main when the executor invoked it from a worktree-isolated task. The
+ * fix applies a 4-step resolution order (see resolveWriteRoot below):
+ *   (1) cwd IS a worktree root → write there (current behaviour)
+ *   (2) --task-id maps to an active non-terminal worktree task →
+ *       redirect writes to that worktree's `.aperant/features/`
+ *   (3) multiple active worktree-isolated tasks + no --task-id → error
+ *   (4) `--no-worktree-redirect` opt-out preserves layer (1) behaviour
  */
-import { execFileSync } from 'node:child_process';
-import { resolve } from 'node:path';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve, sep } from 'node:path';
 import { loadDocsPolicy, matchSurfaceToPolicy } from '../docs-audit/policy.mjs';
 import { applyStubPatches, auditFeatureRegistry } from '../features/registry-audit.mjs';
 import { parseFlags } from '../util/args.mjs';
 import { err, ok } from '../util/result.mjs';
+const TERMINAL_PHASES = new Set(['completed', 'cancelled', 'closed', 'shipped', 'merged']);
+/**
+ * BUG-025b — resolve where features-audit should write `*.json`.
+ * See module header for the 4-step order. Returns `{ writeRoot, redirect_notice }`
+ * on success or a synthetic error envelope (`{ error: { ... } }`) on the
+ * ambiguous-worktree case.
+ *
+ * @internal — exported for unit testing.
+ *
+ * @param {{projectDir: string, taskId?: string | null, noRedirect?: boolean}} args
+ * @returns {{writeRoot?: string, redirect_notice?: string | null, error?: {kind: string, message: string, active_worktree_tasks: string[]}}}
+ */
+export function resolveWriteRoot({ projectDir, taskId, noRedirect }) {
+    const root = resolve(projectDir);
+    if (noRedirect === true) {
+        return { writeRoot: root, redirect_notice: null };
+    }
+    // Layer (1): cwd IS a worktree root. Worktrees have `git rev-parse
+    // --git-dir` != `git rev-parse --git-common-dir`. Falling through to
+    // the existing behaviour writes to this worktree's .aperant/features.
+    // Fast path: git sets GIT_DIR and GIT_COMMON_DIR in the environment
+    // when running inside a worktree hook context — if both are set and
+    // differ, we are in a worktree. This env-var check is ONLY valid at
+    // Layer (1) where we ask "is this process in a worktree?"; it must
+    // NOT be used to validate an untrusted external path (Layer 2 below).
+    const envDir = process.env.GIT_DIR;
+    const envCommonDir = process.env.GIT_COMMON_DIR;
+    if (envDir && envCommonDir) {
+        if (resolve(envDir) !== resolve(envCommonDir)) {
+            return { writeRoot: root, redirect_notice: null };
+        }
+    }
+    else if (isWorktreeRoot(root)) {
+        return { writeRoot: root, redirect_notice: null };
+    }
+    // Layer (2): --task-id maps to an active non-terminal worktree-isolated
+    // task → redirect.
+    const stateActive = readActiveTasks(root);
+    if (taskId) {
+        const task = stateActive[taskId];
+        if (task &&
+            !TERMINAL_PHASES.has(task.lifecycle_phase) &&
+            typeof task.worktree_path === 'string' &&
+            existsSync(task.worktree_path)) {
+            const resolvedWorktree = resolve(task.worktree_path);
+            const worktreesDir = resolve(root, '.aperant', 'worktrees') + sep;
+            const isUnderProject = resolvedWorktree.startsWith(root + sep) || resolvedWorktree === root;
+            const isUnderWorktrees = resolvedWorktree.startsWith(worktreesDir);
+            // Accept only paths under the project root, under .aperant/worktrees/,
+            // or confirmed as a real git worktree by git itself. Rejects arbitrary
+            // paths injected via a tampered state.json while preserving test
+            // fixtures that use ad-hoc worktree paths outside the project tree.
+            if (!isUnderProject && !isUnderWorktrees && !isWorktreeRoot(resolvedWorktree)) {
+                return { writeRoot: root, redirect_notice: null };
+            }
+            return {
+                writeRoot: resolvedWorktree,
+                redirect_notice: `features-audit redirected writes to worktree ${resolvedWorktree} (--task-id ${taskId})`,
+            };
+        }
+    }
+    // Layer (3): multiple active worktree-isolated tasks AND no --task-id
+    // → actionable error. Single-worktree case is OK to default to root
+    // (the executor will set up the worktree's registry on first scan).
+    const activeWorktreeTasks = Object.entries(stateActive).filter(([_id, t]) => {
+        return (t &&
+            !TERMINAL_PHASES.has(t.lifecycle_phase) &&
+            typeof t.worktree_path === 'string' &&
+            existsSync(t.worktree_path));
+    });
+    if (!taskId && activeWorktreeTasks.length > 1) {
+        return {
+            error: {
+                kind: 'ambiguous-worktree-context',
+                message: 'ambiguous worktree context; pass --task-id <id> or --no-worktree-redirect',
+                active_worktree_tasks: activeWorktreeTasks.map(([id]) => id),
+            },
+        };
+    }
+    // Default: current behaviour (write into cwd).
+    return { writeRoot: root, redirect_notice: null };
+}
+function isWorktreeRoot(projectDir) {
+    try {
+        const dirRes = spawnSync('git', ['rev-parse', '--git-dir'], {
+            cwd: projectDir,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const commonRes = spawnSync('git', ['rev-parse', '--git-common-dir'], {
+            cwd: projectDir,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        if (dirRes.status !== 0 || commonRes.status !== 0)
+            return false;
+        return (dirRes.stdout || '').trim() !== (commonRes.stdout || '').trim();
+    }
+    catch {
+        return false;
+    }
+}
+function readActiveTasks(projectDir) {
+    const statePath = join(projectDir, '.aperant', 'state.json');
+    if (!existsSync(statePath))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(statePath, 'utf-8'));
+        return parsed?.active_tasks ?? {};
+    }
+    catch {
+        return {};
+    }
+}
 export function cmdFeaturesAudit(projectDir, extraArgs) {
     if (!projectDir)
         return err('Usage: apt-tools features-audit <project-dir> [flags]');
     const root = resolve(projectDir);
     const flags = parseFlags(extraArgs);
+    // BUG-025b: redirect writes to the active task's worktree when the
+    // caller is in a non-worktree cwd. See resolveWriteRoot for the
+    // 4-step resolution order.
+    const taskIdFlag = flags.get('task-id');
+    const taskId = typeof taskIdFlag === 'string' && taskIdFlag.trim() ? taskIdFlag.trim() : null;
+    const noRedirect = flags.get('no-worktree-redirect') === true;
+    const writeRootResult = resolveWriteRoot({ projectDir: root, taskId, noRedirect });
+    if (writeRootResult.error) {
+        return err(writeRootResult.error.message, 1, {
+            kind: writeRootResult.error.kind,
+            active_worktree_tasks: writeRootResult.error.active_worktree_tasks,
+        });
+    }
+    const writeRoot = writeRootResult.writeRoot;
+    const redirectNotice = writeRootResult.redirect_notice;
+    if (redirectNotice) {
+        // Surface the redirect once on stderr so the executor's log carries
+        // the audit trail without polluting stdout JSON.
+        process.stderr.write(`[features-audit] ${redirectNotice}\n`);
+    }
     const diffFiles = resolveDiffFiles(root, flags);
     const applyStubs = flags.has('apply-stubs');
     const format = (flags.get('format') || 'json').toLowerCase();
-    const result = auditFeatureRegistry({ projectDir: root, diffFiles });
+    const result = auditFeatureRegistry({ projectDir: writeRoot, diffFiles });
     // Honor `.aperant/config.json.docs_policy`: only apply stubs for targets
     // whose resolved policy is `auto-update`. This closes the skill-vs-code
     // gap where `apt-execute` §3e-features promised `--apply-stubs` would
@@ -49,7 +194,9 @@ export function cmdFeaturesAudit(projectDir, extraArgs) {
             }
         }
         if (eligible.length > 0) {
-            applied_patches = applyStubPatches(root, eligible);
+            // BUG-025b: stubs are written to the resolved `writeRoot` (which
+            // may be the active task's worktree) rather than the invoking cwd.
+            applied_patches = applyStubPatches(writeRoot, eligible);
         }
         if (skipped.length > 0) {
             skipped_patches = skipped;
@@ -61,6 +208,8 @@ export function cmdFeaturesAudit(projectDir, extraArgs) {
             command: 'features-audit',
             format: 'md',
             markdown: renderMarkdown(result, applied_patches, skipped_patches),
+            write_root: writeRoot,
+            ...(redirectNotice ? { redirect_notice: redirectNotice } : {}),
             ...result,
             ...(applied_patches ? { applied_patches } : {}),
             ...(skipped_patches ? { skipped_patches } : {}),
@@ -69,6 +218,8 @@ export function cmdFeaturesAudit(projectDir, extraArgs) {
     return ok({
         status: 'ok',
         command: 'features-audit',
+        write_root: writeRoot,
+        ...(redirectNotice ? { redirect_notice: redirectNotice } : {}),
         ...result,
         ...(applied_patches ? { applied_patches } : {}),
         ...(skipped_patches ? { skipped_patches } : {}),
@@ -82,7 +233,10 @@ function resolveDiffFiles(root, flags) {
             .map((s) => s.trim())
             .filter(Boolean);
     }
-    const since = flags.get('since');
+    const sinceRaw = flags.get('since');
+    const since = typeof sinceRaw === 'string' && /^[A-Za-z0-9/_.-]+$/.test(sinceRaw) && !sinceRaw.startsWith('-')
+        ? sinceRaw
+        : null;
     try {
         const args = since ? ['diff', '--name-only', `${since}..HEAD`] : ['diff', 'HEAD', '--name-only'];
         const out = execFileSync('git', args, {

package/dist/cli/commands/features-audit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"features-audit.mjs","sourceRoot":"","sources":["../../../src/cli/commands/features-audit.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAA;AAE5C,MAAM,UAAU,gBAAgB,CAAC,UAAU,EAAE,SAAS;IACrD,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,uDAAuD,CAAC,CAAA;IACpF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IAEnC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;IAE5D,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAEpE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,yBAAyB;IACzB,IAAI,eAAe,GAAG,IAAI,CAAA;IAC1B,IAAI,eAAe,GAAG,IAAI,CAAA;IAC1B,IAAI,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,EAAE,CAAA;QACnB,MAAM,OAAO,GAAG,EAAE,CAAA;QAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC9D,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YAC5D,CAAC;QACF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,eAAe,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,eAAe,GAAG,OAAO,CAAA;QAC1B,CAAC;IACF,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;YACT,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,eAAe,CAAC;YAClE,GAAG,MAAM;YACT,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAA;IACH,CAAC;IAED,OAAO,EAAE,CAAC;QACT,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,gBAAgB;QACzB,GAAG,MAAM;QACT,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAI,EAAE,KAAK;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACxC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,QAAQ;aACb,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAA;QAChG,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACrC,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAA;QACF,OAAO,GAAG;aACR,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,CAAC;IAAC,MAAM,CAAC;QACR,sDAAsD;QACtD,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO;IAC/C,MAAM,KAAK,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;IACxC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;IACzD,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QACjC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAA;QACzE,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAA;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,KAAK,CAAC,CAAA;QACpD,CAAC;IACF,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAA;QACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC9E,CAAC;IACF,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,uCAAuC,CAAC,CAAA;QACvD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,MAAM,IAAI,WAAW,IAAI,CAAC,CAAA;QACrE,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC"}
+{"version":3,"file":"features-audit.mjs","sourceRoot":"","sources":["../../../src/cli/commands/features-audit.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAA;AAE5C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE1F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAChC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAA;IAClD,CAAC;IACD,mEAAmE;IACnE,qEAAqE;IACrE,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAA;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAC/C,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAA;QAClD,CAAC;IACF,CAAC;SAAM,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAA;IAClD,CAAC;IACD,wEAAwE;IACxE,mBAAmB;IACnB,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAChC,IACC,IAAI;YACJ,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC;YAC1C,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YACtC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAC7B,CAAC;YACF,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YACpD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,GAAG,CAAA;YACjE,MAAM,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,gBAAgB,KAAK,IAAI,CAAA;YAC3F,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;YACjE,oEAAoE;YACpE,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC/E,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAA;YAClD,CAAC;YACD,OAAO;gBACN,SAAS,EAAE,gBAAgB;gBAC3B,eAAe,EAAE,gDAAgD,gBAAgB,eAAe,MAAM,GAAG;aACzG,CAAA;QACF,CAAC;IACF,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3E,OAAO,CACN,CAAC;YACD,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;YACvC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;YACnC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAC3B,CAAA;IACF,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO;YACN,KAAK,EAAE;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,2EAA2E;gBACpF,qBAAqB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;aAC5D;SACD,CAAA;IACF,CAAC;IACD,+CAA+C;IAC/C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAA;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,UAAU;IACjC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;YAC3D,GAAG,EAAE,UAAU;YACf,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE;YACrE,GAAG,EAAE,UAAU;YACf,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/D,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACxE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,UAAU;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;IAC5D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3D,OAAO,MAAM,EAAE,YAAY,IAAI,EAAE,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAU,EAAE,SAAS;IACrD,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,uDAAuD,CAAC,CAAA;IACpF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IAEnC,mEAAmE;IACnE,gEAAgE;IAChE,2BAA2B;IAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7F,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,IAAI,CAAA;IAC7D,MAAM,eAAe,GAAG,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IAClF,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE;YAC5C,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI;YAChC,qBAAqB,EAAE,eAAe,CAAC,KAAK,CAAC,qBAAqB;SAClE,CAAC,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAA;IAC3C,MAAM,cAAc,GAAG,eAAe,CAAC,eAAe,CAAA;IACtD,IAAI,cAAc,EAAE,CAAC;QACpB,oEAAoE;QACpE,iDAAiD;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,cAAc,IAAI,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;IAE5D,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;IAEzE,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,yBAAyB;IACzB,IAAI,eAAe,GAAG,IAAI,CAAA;IAC1B,IAAI,eAAe,GAAG,IAAI,CAAA;IAC1B,IAAI,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,EAAE,CAAA;QACnB,MAAM,OAAO,GAAG,EAAE,CAAA;QAClB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC9D,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YAC5D,CAAC;QACF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,iEAAiE;YACjE,mEAAmE;YACnE,eAAe,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,eAAe,GAAG,OAAO,CAAA;QAC1B,CAAC;IACF,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;YACT,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,eAAe,CAAC;YAClE,UAAU,EAAE,SAAS;YACrB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,MAAM;YACT,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAA;IACH,CAAC;IAED,OAAO,EAAE,CAAC;QACT,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,gBAAgB;QACzB,UAAU,EAAE,SAAS;QACrB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,MAAM;QACT,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAI,EAAE,KAAK;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACxC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,QAAQ;aACb,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnC,MAAM,KAAK,GACV,OAAO,QAAQ,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAC/F,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAA;QAChG,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACrC,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAA;QACF,OAAO,GAAG;aACR,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,CAAC;IAAC,MAAM,CAAC;QACR,sDAAsD;QACtD,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO;IAC/C,MAAM,KAAK,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;IACxC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;IACzD,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QACjC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAA;QACzE,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAA;QACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,KAAK,CAAC,CAAA;QACpD,CAAC;IACF,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAA;QACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC9E,CAAC;IACF,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,uCAAuC,CAAC,CAAA;QACvD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,MAAM,IAAI,WAAW,IAAI,CAAC,CAAA;QACrE,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACxB,CAAC"}

package/dist/cli/commands/health-check.d.mts

@@ -1,2 +1,18 @@
+/**
+ * SECURITY: validate a component path string from `.aperant/features/*.json`
+ * before passing it to git. The registry is on-disk JSON authored by
+ * features-audit; pre-fix the orphan walker spliced this string into a
+ * shell command (`execSync(\`git rev-parse HEAD:${comp} 2>/dev/null\`)`),
+ * making a malicious entry like `foo.ts; rm -rf $HOME` a command-injection
+ * vector against any user who ran `apt-tools health-check`. The fix
+ * combines `execFileSync` (argv-form, no shell) with a strict path
+ * whitelist: relative posix paths only, no NUL / control bytes / shell
+ * metacharacters / leading `/` / `..` segments.
+ *
+ * @internal — exported for unit testing.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isSafeComponentPath(value: unknown): boolean;
 export function cmdHealthCheck(projectDir: any): import("../util/result.mjs").CommandResult;
 //# sourceMappingURL=health-check.d.mts.map

package/dist/cli/commands/health-check.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"health-check.d.mts","sourceRoot":"","sources":["../../../src/cli/commands/health-check.mjs"],"names":[],"mappings":"AAeA,4FAsJC"}
+{"version":3,"file":"health-check.d.mts","sourceRoot":"","sources":["../../../src/cli/commands/health-check.mjs"],"names":[],"mappings":"AAeA;;;;;;;;;;;;;;GAcG;AACH,2CAHW,OAAO,GACL,OAAO,CAYnB;AAED,4FA4OC"}

package/dist/cli/commands/health-check.mjs

@@ -1,7 +1,7 @@
 /**
  * commands/health-check.mjs — health-check command (C29).
  */
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -10,6 +10,37 @@ import { err, ok } from '../util/result.mjs';
 import { readSkillInstallState } from '../util/skill-installs.mjs';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
+/**
+ * SECURITY: validate a component path string from `.aperant/features/*.json`
+ * before passing it to git. The registry is on-disk JSON authored by
+ * features-audit; pre-fix the orphan walker spliced this string into a
+ * shell command (`execSync(\`git rev-parse HEAD:${comp} 2>/dev/null\`)`),
+ * making a malicious entry like `foo.ts; rm -rf $HOME` a command-injection
+ * vector against any user who ran `apt-tools health-check`. The fix
+ * combines `execFileSync` (argv-form, no shell) with a strict path
+ * whitelist: relative posix paths only, no NUL / control bytes / shell
+ * metacharacters / leading `/` / `..` segments.
+ *
+ * @internal — exported for unit testing.
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isSafeComponentPath(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 512)
+        return false;
+    // Reject NUL, control bytes, and shell metacharacters that could escape
+    // argv interpretation if a downstream caller ever reverts to shell mode.
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: rejecting control bytes IS the security guard — see isSafeComponentPath docstring + test.
+    if (/[\x00-\x1f;&|`$<>"\\]/.test(value))
+        return false;
+    if (value.startsWith('/'))
+        return false;
+    if (value.startsWith('-'))
+        return false; // would be parsed as a flag
+    if (value.split('/').some((seg) => seg === '..' || seg === '.' || seg === ''))
+        return false;
+    return true;
+}
 export function cmdHealthCheck(projectDir) {
     if (!projectDir)
         return err('Usage: apt-tools health-check <project-dir>');
@@ -19,9 +50,10 @@ export function cmdHealthCheck(projectDir) {
     // 1. Check for uncommitted changes in working tree
     let dirtyFiles = [];
     try {
-        const status = execSync('git status --porcelain 2>/dev/null', {
+        const status = execFileSync('git', ['status', '--porcelain'], {
             cwd: targetDir,
             encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
         }).trim();
         if (status) {
             dirtyFiles = status.split('\n').filter(Boolean);
@@ -150,6 +182,90 @@ export function cmdHealthCheck(projectDir) {
             });
         }
     }
+    // 6. BUG-025b — orphaned-feature-component warning. Walk
+    // `.aperant/features/*.json`; for each cited component path, verify
+    // `git rev-parse HEAD:<path>` succeeds on the main repo's HEAD. A path
+    // that resolves on a worktree branch but is missing on main is a
+    // candidate orphan (the registry entry leaked from a worktree-isolated
+    // task and was never followed by the actual component landing on main).
+    // Severity `warn` — the registry is best-effort metadata, not a build
+    // blocker. Only fires on the main repo (skipped when health-check is
+    // invoked from a worktree).
+    try {
+        const featuresDir = join(aperantDir, 'features');
+        if (existsSync(featuresDir)) {
+            // SECURITY: argv-form (no shell) — see isSafeComponentPath comment.
+            const dirRes = execFileSync('git', ['rev-parse', '--git-dir'], {
+                cwd: targetDir,
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+            const commonRes = execFileSync('git', ['rev-parse', '--git-common-dir'], {
+                cwd: targetDir,
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            }).trim();
+            if (dirRes === commonRes) {
+                const orphans = [];
+                // PRF-001: one subprocess total instead of one per component.
+                // Build a Set of all tracked paths from a single ls-tree call.
+                const lsOut = execFileSync('git', ['ls-tree', '-r', 'HEAD', '--name-only'], {
+                    cwd: targetDir,
+                    encoding: 'utf-8',
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                }).trim();
+                const trackedPaths = new Set(lsOut
+                    .split('\n')
+                    .map((s) => s.trim())
+                    .filter(Boolean));
+                const files = readdirSync(featuresDir).filter((f) => f.endsWith('.json') && f !== 'REGISTRY.md');
+                // QUA-006: cap total component iterations to guard against
+                // adversarially large or malformed registry files.
+                const MAX_ORPHAN_ITERATIONS = 10_000;
+                let iterCount = 0;
+                let cappedAt = null;
+                outer: for (const f of files) {
+                    let area;
+                    try {
+                        area = JSON.parse(readFileSync(join(featuresDir, f), 'utf-8'));
+                    }
+                    catch {
+                        continue;
+                    }
+                    const components = Array.isArray(area?.components) ? area.components : [];
+                    for (const comp of components) {
+                        if (iterCount >= MAX_ORPHAN_ITERATIONS) {
+                            cappedAt = f;
+                            break outer;
+                        }
+                        iterCount++;
+                        // SECURITY: reject obviously-unsafe component strings.
+                        if (!isSafeComponentPath(comp))
+                            continue;
+                        if (!trackedPaths.has(comp))
+                            orphans.push({ area_file: f, component: comp });
+                    }
+                }
+                if (cappedAt !== null) {
+                    orphans.push({
+                        area_file: cappedAt,
+                        component: `(orphan scan capped at ${MAX_ORPHAN_ITERATIONS} entries — remaining components skipped)`,
+                    });
+                }
+                if (orphans.length > 0) {
+                    issues.push({
+                        type: 'orphan-feature-components',
+                        severity: 'warning',
+                        detail: `${orphans.length} feature component(s) cited in .aperant/features/*.json are missing on HEAD — candidates leaked from worktree-isolated tasks`,
+                        orphans: orphans.slice(0, 20),
+                    });
+                }
+            }
+        }
+    }
+    catch {
+        /* git not available or worktree — skip silently */
+    }
     return ok({
         status: 'ok',
         command: 'health-check',

package/dist/cli/commands/health-check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"health-check.mjs","sourceRoot":"","sources":["../../../src/cli/commands/health-check.mjs"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;AAErC,MAAM,UAAU,cAAc,CAAC,UAAU;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,6CAA6C,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,EAAE,CAAA;IAEjB,mDAAmD;IACnD,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,oCAAoC,EAAE;YAC7D,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,OAAO;SACjB,CAAC,CAAC,IAAI,EAAE,CAAA;QACT,IAAI,MAAM,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,sCAAsC;oBAClE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBAC9B,CAAC,CAAA;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IAChD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;YAC1D,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;gBAClD,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAA;gBAClE,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,gBAAgB,KAAK,CAAC,WAAW,CAAC,WAAW,iBAAiB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO;wBACrG,IAAI,EAAE,KAAK,CAAC,WAAW;qBACvB,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qBAAqB;QACtB,CAAC;IACF,CAAC;IAED,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YAC1E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;gBACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;gBAC5D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;gBAC9C,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAA;gBAE1D,IAAI,QAAQ,GAAG,KAAK,CAAA;gBACpB,IAAI,CAAC;oBACJ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;oBACpC,QAAQ,GAAG,IAAI,CAAA;gBAChB,CAAC;gBAAC,MAAM,CAAC;oBACR,QAAQ,GAAG,KAAK,CAAA;gBACjB,CAAC;gBAED,IAAI,QAAQ,GAAG,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClD,MAAM,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,YAAY;wBAClB,QAAQ,EAAE,OAAO;wBACjB,MAAM,EAAE,eAAe,QAAQ,SAAS,QAAQ,CAAC,UAAU,oBAAoB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;wBAC3G,SAAS,EAAE,QAAQ;wBACnB,SAAS,EAAE,QAAQ;qBACnB,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,kBAAkB;QACnB,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC;iBACvC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAClC,IAAI,EAAE,CAAA;YACR,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,CAAA;YACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAA;YAE1B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;gBACpE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;gBACjE,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;oBAClE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC7B,CAAC;YAED,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,YAAY,OAAO,kBAAkB,SAAS,iCAAiC;wBACvF,OAAO;qBACP,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,eAAe;QAChB,CAAC;IACF,CAAC;IAED,0DAA0D;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;IACpE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QAC3E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACjE,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,4EAA4E;gBACpF,gBAAgB,EAAE,QAAQ;aAC1B,CAAC,CAAA;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,2CAA2C,gBAAgB,QAAQ,aAAa;qBACtF,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBAC9B,IAAI,CAAC,IAAI,CAAC,EAAE;gBACd,gBAAgB,EAAE,aAAa;aAC/B,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,CAAC;QACT,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC5B,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,MAAM;KACN,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"health-check.mjs","sourceRoot":"","sources":["../../../src/cli/commands/health-check.mjs"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;AAErC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAK;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAA;IACvF,wEAAwE;IACxE,yEAAyE;IACzE,qJAAqJ;IACrJ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,4BAA4B;IACpE,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3F,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAU;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC,6CAA6C,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,EAAE,CAAA;IAEjB,mDAAmD;IACnD,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE;YAC7D,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,IAAI,EAAE,CAAA;QACT,IAAI,MAAM,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,SAAS;oBACnB,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,sCAAsC;oBAClE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBAC9B,CAAC,CAAA;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;IAED,+CAA+C;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IAChD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;YAC1D,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;gBAClD,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAA;gBAClE,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,gBAAgB,KAAK,CAAC,WAAW,CAAC,WAAW,iBAAiB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO;wBACrG,IAAI,EAAE,KAAK,CAAC,WAAW;qBACvB,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qBAAqB;QACtB,CAAC;IACF,CAAC;IAED,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YAC1E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;gBACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;gBAC5D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;gBAC9C,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAA;gBAE1D,IAAI,QAAQ,GAAG,KAAK,CAAA;gBACpB,IAAI,CAAC;oBACJ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;oBACpC,QAAQ,GAAG,IAAI,CAAA;gBAChB,CAAC;gBAAC,MAAM,CAAC;oBACR,QAAQ,GAAG,KAAK,CAAA;gBACjB,CAAC;gBAED,IAAI,QAAQ,GAAG,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClD,MAAM,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,YAAY;wBAClB,QAAQ,EAAE,OAAO;wBACjB,MAAM,EAAE,eAAe,QAAQ,SAAS,QAAQ,CAAC,UAAU,oBAAoB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;wBAC3G,SAAS,EAAE,QAAQ;wBACnB,SAAS,EAAE,QAAQ;qBACnB,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,kBAAkB;QACnB,CAAC;IACF,CAAC;IAED,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC;iBACvC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAClC,IAAI,EAAE,CAAA;YACR,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,CAAA;YACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAA;YAE1B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;gBACpE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;gBACjE,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;oBAClE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC7B,CAAC;YAED,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,YAAY,OAAO,kBAAkB,SAAS,iCAAiC;wBACvF,OAAO;qBACP,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,eAAe;QAChB,CAAC;IACF,CAAC;IAED,0DAA0D;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAA;IACpE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QAC3E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACjE,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,4EAA4E;gBACpF,gBAAgB,EAAE,QAAQ;aAC1B,CAAC,CAAA;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,2CAA2C,gBAAgB,QAAQ,aAAa;qBACtF,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;qBAC9B,IAAI,CAAC,IAAI,CAAC,EAAE;gBACd,gBAAgB,EAAE,aAAa;aAC/B,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IAED,yDAAyD;IACzD,oEAAoE;IACpE,uEAAuE;IACvE,iEAAiE;IACjE,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,4BAA4B;IAC5B,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QAChD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,oEAAoE;YACpE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;gBAC9D,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACnC,CAAC,CAAC,IAAI,EAAE,CAAA;YACT,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE;gBACxE,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACnC,CAAC,CAAC,IAAI,EAAE,CAAA;YACT,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,EAAE,CAAA;gBAClB,8DAA8D;gBAC9D,+DAA+D;gBAC/D,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE;oBAC3E,GAAG,EAAE,SAAS;oBACd,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;iBACnC,CAAC,CAAC,IAAI,EAAE,CAAA;gBACT,MAAM,YAAY,GAAG,IAAI,GAAG,CAC3B,KAAK;qBACH,KAAK,CAAC,IAAI,CAAC;qBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CACjB,CAAA;gBACD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,aAAa,CACjD,CAAA;gBACD,2DAA2D;gBAC3D,mDAAmD;gBACnD,MAAM,qBAAqB,GAAG,MAAM,CAAA;gBACpC,IAAI,SAAS,GAAG,CAAC,CAAA;gBACjB,IAAI,QAAQ,GAAG,IAAI,CAAA;gBACnB,KAAK,EAAE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBAC9B,IAAI,IAAI,CAAA;oBACR,IAAI,CAAC;wBACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;oBAC/D,CAAC;oBAAC,MAAM,CAAC;wBACR,SAAQ;oBACT,CAAC;oBACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA;oBACzE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;wBAC/B,IAAI,SAAS,IAAI,qBAAqB,EAAE,CAAC;4BACxC,QAAQ,GAAG,CAAC,CAAA;4BACZ,MAAM,KAAK,CAAA;wBACZ,CAAC;wBACD,SAAS,EAAE,CAAA;wBACX,uDAAuD;wBACvD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;4BAAE,SAAQ;wBACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;4BAAE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;oBAC7E,CAAC;gBACF,CAAC;gBACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC;wBACZ,SAAS,EAAE,QAAQ;wBACnB,SAAS,EAAE,0BAA0B,qBAAqB,0CAA0C;qBACpG,CAAC,CAAA;gBACH,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,2BAA2B;wBACjC,QAAQ,EAAE,SAAS;wBACnB,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,8HAA8H;wBACvJ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;qBAC7B,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,mDAAmD;IACpD,CAAC;IAED,OAAO,EAAE,CAAC;QACT,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC5B,WAAW,EAAE,MAAM,CAAC,MAAM;QAC1B,MAAM;KACN,CAAC,CAAA;AACH,CAAC"}

package/dist/cli/commands/init.d.mts

@@ -45,6 +45,15 @@ export function parseInstallFlags(args: string[]): {
     forceOverwriteCatalog: boolean;
     keepLegacy: boolean;
 };
+/**
+ * Patch the template config in place with the interview answers. Leaves
+ * every key the user did NOT touch at its template default so the shape
+ * matches `/apt:setup`'s review-mode expectations.
+ *
+ * @param {Record<string, any>} config
+ * @param {InstallAnswers} answers
+ */
+export function applyInterviewAnswers(config: Record<string, any>, answers: InstallAnswers, targetDir?: null): void;
 /**
  * Main entry — invoked from bin/apt-tools.mjs.
  *

package/dist/cli/commands/init.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.mts","sourceRoot":"","sources":["../../../src/cli/commands/init.mjs"],"names":[],"mappings":"AAqEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wCAHW,MAAM,EAAE,GACN;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,GAAC,CAAC,GAAC,CAAC,GAAC,CAAC,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CA8D1S;AA23BD;;;;;;GAMG;AACH,oCAJW,MAAM,cACN,MAAM,EAAE,GACN,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgM3D;;;;;cA5jCa,MAAM,EAAE;;;;qBACR,CAAC,GAAC,CAAC,GAAC,CAAC,GAAC,CAAC;;;;gBACP,MAAM,GAAC,MAAM;;;;4BACb,MAAM,EAAE;;;;aACR,OAAO;;;;mBACP,OAAO;eACP,OAAO,0BAA0B,EAAE,eAAe;;;;;;;;;aAErC,MAAM;eAAS,OAAO;cAAQ,MAAM;iBAAW,MAAM;;;;;;aAErD,MAAM;eAAS,OAAO;gBAAU,MAAM;;;;;;kBAEvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;0BAAoB,OAAO,EAAE;2BAAqB,OAAO,EAAE;oBAAc,OAAO,EAAE"}
+{"version":3,"file":"init.d.mts","sourceRoot":"","sources":["../../../src/cli/commands/init.mjs"],"names":[],"mappings":"AA0EA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wCAHW,MAAM,EAAE,GACN;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,iBAAiB,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,GAAC,CAAC,GAAC,CAAC,GAAC,CAAC,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAmE1S;AA+wBD;;;;;;;GAOG;AACH,8CAHW,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WACnB,cAAc,0BAoDxB;AAoED;;;;;;GAMG;AACH,oCAJW,MAAM,cACN,MAAM,EAAE,GACN,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgM3D;;;;;cA9kCa,MAAM,EAAE;;;;qBACR,CAAC,GAAC,CAAC,GAAC,CAAC,GAAC,CAAC;;;;gBACP,MAAM,GAAC,MAAM;;;;4BACb,MAAM,EAAE;;;;aACR,OAAO;;;;mBACP,OAAO;eACP,OAAO,0BAA0B,EAAE,eAAe;;;;;;;;;aAErC,MAAM;eAAS,OAAO;cAAQ,MAAM;iBAAW,MAAM;;;;;;aAErD,MAAM;eAAS,OAAO;gBAAU,MAAM;;;;;;kBAEvC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;0BAAoB,OAAO,EAAE;2BAAqB,OAAO,EAAE;oBAAc,OAAO,EAAE"}

package/dist/cli/commands/init.mjs

@@ -21,6 +21,7 @@ import { fileURLToPath } from 'node:url';
 import { detectMode } from '../bootstrap/detect-mode.mjs';
 import { deriveSidecar } from '../bootstrap/product-context-sidecar.mjs';
 import { assertConfigWriteAllowed } from '../config/guard.mjs';
+import { AUDIT_001_LOCAL_FIELDS, migrateDeferredFieldsToLocalConfig, writeLocalConfigField, } from '../config/load.mjs';
 import { migrateConfigSchema, setAt } from '../config/schema-migrate.mjs';
 import { resolveSharePolicy } from '../config/share-policy.mjs';
 import { buildAperantGitignoreTemplate } from '../config/upgrade-gitignore.mjs';
@@ -79,6 +80,11 @@ const TRANSFORM_LOADERS = new Map(RUNTIMES.map((r) => [r.id, () => import(`../in
  * @returns {{ runtimes: string[], runtimes_explicit: boolean, target: string|null, interactive: boolean, skipBootstrap: boolean, visibility?: 'solo'|'team', autonomy?: 0|1|2|3, accept_new_defaults: boolean, yes: boolean, forceRuntimes: boolean, forceOverwriteCatalog: boolean, keepLegacy: boolean }}
  */
 export function parseInstallFlags(args) {
+    // C58 (0.7.2): `--kilocode` is a deprecated alias of `--kilo`. Matches
+    // the upstream package + app branding so users typing what they see on
+    // kilocode.ai get the same install as the canonical `--kilo` flag.
+    // Internal runtime id stays `kilo` (no migration — per spec ID-01).
+    args = args.map((a) => (a === '--kilocode' ? '--kilo' : a));
     const flagSet = new Set(args.filter((a) => a.startsWith('--')));
     let target = null;
     for (let i = 0; i < args.length; i++) {
@@ -659,7 +665,11 @@ async function interactiveInterview(targetDir, version, canonicalRoot, archetype
                 suggested.add('claude');
             const sel = await clack.multiselect({
                 message: 'Pick the runtimes to install Aperant into',
-                options: RUNTIMES.map((r) => ({ value: r.id, label: r.id, hint: r.flag })),
+                options: RUNTIMES.map((r) => ({
+                    value: r.id,
+                    label: r.displayLabel ?? r.id,
+                    hint: r.flag,
+                })),
                 initialValues: [...suggested],
                 required: true,
             });
@@ -869,7 +879,7 @@ async function interactiveInterview(targetDir, version, canonicalRoot, archetype
  * @param {Record<string, any>} config
  * @param {InstallAnswers} answers
  */
-function applyInterviewAnswers(config, answers) {
+export function applyInterviewAnswers(config, answers, targetDir = null) {
     if (config.autonomy) {
         config.autonomy.default = answers.autonomyDefault;
     }
@@ -885,8 +895,23 @@ function applyInterviewAnswers(config, answers) {
     }
     if (config.multi_model?.cross_verification) {
         const xverify = answers.crossVerificationTools;
+        // `enabled` is project policy (is cross-verification on for this
+        // project?) — stays in shared `config.json`.
         config.multi_model.cross_verification.enabled = xverify.length > 0;
-        config.multi_model.cross_verification.tools = xverify;
+        // AUDIT-001 (0.7.2 S1) — `tools` is per-device (which CLIs are installed
+        // HERE) and MUST land in `config.local.json`, NOT shared. Strip from
+        // the template to keep the shared file clean. When `targetDir` is null
+        // (legacy callers / tests that don't go through finishInit), we leave
+        // the tools array on the shared template — backward-compatible fallback
+        // — but the writer path always passes targetDir so production lands
+        // the value in local.
+        if (targetDir) {
+            delete config.multi_model.cross_verification.tools;
+            writeLocalConfigField(targetDir, 'multi_model.cross_verification.tools', xverify);
+        }
+        else {
+            config.multi_model.cross_verification.tools = xverify;
+        }
     }
     config.project_type =
         answers.archetype.type === 'brownfield' ? 'unknown' : config.project_type || 'unknown';
@@ -1333,7 +1358,11 @@ function finishInit(targetDir, installTarget, canonicalRoot, version, chosenIds,
         withFileLock(configLockPath, () => {
             if (!existsSync(configDest)) {
                 const template = JSON.parse(readFileSync(configTemplate, 'utf-8'));
-                applyInterviewAnswers(template, answers);
+                // AUDIT-001 (0.7.2 S1) — pass targetDir so the cross_verification.tools
+                // per-device field lands in `config.local.json`, not the shared
+                // `config.json`. Matches the upgrade-path migrator which already
+                // moves the same field via migrateDeferredFieldsToLocalConfig.
+                applyInterviewAnswers(template, answers, targetDir);
                 atomicWriteJson(configDest, template);
                 configCreated = true;
             }
@@ -1353,6 +1382,22 @@ function finishInit(targetDir, installTarget, canonicalRoot, version, chosenIds,
             configMigrated = true;
         }, { projectRoot: targetDir });
     }
+    // AUDIT-001 — UPGRADE-only migrator. Moves the 5 deferred fields out
+    // of `config.json` into `config.local.json` on real upgrade paths
+    // (configMigrated === true), NOT on fresh seeds — the freshly-seeded
+    // template config.json IS the post-migration state, so the migrator
+    // would just round-trip with no observable benefit AND would trip
+    // the next init invocation's no-drift detection. Idempotent on
+    // re-run. Per-field independence per ID-08 — one failure does NOT
+    // block the others.
+    if (configMigrated && existsSync(configDest)) {
+        try {
+            migrateDeferredFieldsToLocalConfig(targetDir, AUDIT_001_LOCAL_FIELDS);
+        }
+        catch {
+            /* never block init on telemetry-only migrator */
+        }
+    }
     const stateTemplate = resolve(canonicalRoot, 'templates', 'state.json');
     const stateDest = join(aperantDir, 'state.json');
     let stateCreated = false;