@fro.bot/systematic 3.16.2 → 3.16.3

package/dist/cli.js

@@ -2085,6 +2085,23 @@ function isLegacyReviewArtifact(value) {
 function hasParentDirectoryTraversal(input) {
   return input.split(/[\\/]+/).some((segment) => segment === "..");
 }
+var ALLOW_OUTSIDE_ARTIFACT_ROOT_FLAG = "--allow-outside-artifact-root";
+var VALIDATE_REVIEW_ARTIFACT_USAGE = "Usage: systematic validate-review-artifact <path> [--allow-outside-artifact-root]";
+function parseValidateReviewArtifactArguments(argv) {
+  const allowOutsideArtifactRoot = argv.includes(ALLOW_OUTSIDE_ARTIFACT_ROOT_FLAG);
+  const positional = argv.filter((arg) => arg !== ALLOW_OUTSIDE_ARTIFACT_ROOT_FLAG);
+  if (positional.length !== 1)
+    return;
+  const path = positional[0];
+  if (path === undefined)
+    return;
+  return { allowOutsideArtifactRoot, path };
+}
+var REVIEW_ARTIFACT_VALID_MESSAGE = "Review artifact is valid";
+var REVIEW_ARTIFACT_VALID_EXTERNAL_MESSAGE = "Review artifact is valid (validated outside the run directory; not evidence for this run)";
+function formatReviewArtifactSuccessMessage(allowOutsideArtifactRoot) {
+  return allowOutsideArtifactRoot ? REVIEW_ARTIFACT_VALID_EXTERNAL_MESSAGE : REVIEW_ARTIFACT_VALID_MESSAGE;
+}
 function pathContainsSymlink(candidate) {
   let current = path3.parse(candidate).root;
   const relative = path3.relative(current, candidate);
@@ -2105,30 +2122,33 @@ function isWithinDirectory(candidate, directory) {
   const relative = path3.relative(directory, candidate);
   return relative !== "" && relative !== ".." && !relative.startsWith(`..${path3.sep}`) && !path3.isAbsolute(relative);
 }
-function resolveReviewArtifactPath(input, cwd) {
+function resolveReviewArtifactPath(input, cwd, options = {}) {
+  const allowOutsideArtifactRoot = options.allowOutsideArtifactRoot ?? false;
   if (hasParentDirectoryTraversal(input)) {
     return {
       message: "Review artifact path must not contain parent-directory traversal",
       ok: false
     };
   }
-  const artifactRoot = path3.resolve(cwd, ".context", "systematic", "ce-review");
   let canonicalRoot;
-  try {
-    canonicalRoot = fs4.realpathSync(artifactRoot);
-    if (!fs4.statSync(canonicalRoot).isDirectory()) {
-      return {
-        message: "Review artifact directory is not a directory",
-        ok: false
-      };
+  if (!allowOutsideArtifactRoot) {
+    const artifactRoot = path3.resolve(cwd, ".context", "systematic", "ce-review");
+    try {
+      canonicalRoot = fs4.realpathSync(artifactRoot);
+      if (!fs4.statSync(canonicalRoot).isDirectory()) {
+        return {
+          message: "Review artifact directory is not a directory",
+          ok: false
+        };
+      }
+    } catch {
+      return { message: "Review artifact directory is unavailable", ok: false };
     }
-  } catch {
-    return { message: "Review artifact directory is unavailable", ok: false };
   }
   const candidate = path3.resolve(cwd, input);
   if (pathContainsSymlink(candidate)) {
     return {
-      message: "Review artifact path must not contain symlinks",
+      message: "Review artifact path must not contain symlinks; pass a fully resolved path",
       ok: false
     };
   }
@@ -2138,7 +2158,7 @@ function resolveReviewArtifactPath(input, cwd) {
   } catch {
     return { message: "Review artifact file was not found", ok: false };
   }
-  if (!isWithinDirectory(canonicalTarget, canonicalRoot)) {
+  if (canonicalRoot !== undefined && !isWithinDirectory(canonicalTarget, canonicalRoot)) {
     return {
       message: "Review artifact path must remain inside .context/systematic/ce-review",
       ok: false
@@ -2721,9 +2741,12 @@ Usage:
 Commands:
   list [type]                  List available skills, agents, or commands
   capabilities                 Read-only standalone-CLI observation; not a host-runtime or canonical-registry view
-  validate-review-artifact <path>
+  validate-review-artifact <path> [--allow-outside-artifact-root]
                                Validate a ce:review run artifact
                                The <path> argument is required by design; no artifact discovery is performed.
+                               --allow-outside-artifact-root skips the requirement that <path> resolve
+                               inside .context/systematic/ce-review, for validating artifacts copied from
+                               CI, issues, or fixtures. Not for the ce:review parent's own run artifact.
                                Exit statuses: 0 valid artifact, 1 validation failure,
                                2 operational failure, 3 legacy artifact with no schema_version
   config [subcommand]          Configuration management
@@ -2744,6 +2767,7 @@ Examples:
   systematic list skills
   systematic capabilities
   systematic validate-review-artifact .context/systematic/ce-review/review-summary.json
+  systematic validate-review-artifact --allow-outside-artifact-root /path/to/external-artifact.json
   systematic list agents
   systematic config show
   systematic config show --json
@@ -2774,7 +2798,6 @@ Scope:
   project   <cwd>/.pi/agents (default)
   global    $PI_CODING_AGENT_DIR/agents or ~/.pi/agent/agents
 `;
-var VALIDATE_REVIEW_ARTIFACT_USAGE = "Usage: systematic validate-review-artifact <path>";
 var REVIEW_ARTIFACT_SCHEMA_RELATIVE_PATH = "skills/ce-review/references/review-summary-schema.json";
 function defaultCapabilityRoots() {
   const configDir = process.env.XDG_CONFIG_HOME ? path5.join(process.env.XDG_CONFIG_HOME, "opencode") : path5.join(os2.homedir(), ".config/opencode");
@@ -2935,19 +2958,17 @@ function validateReviewArtifactArgument(argv) {
   const commandIndex = argv[0] === "systematic" ? 1 : 0;
   if (argv[commandIndex] !== "validate-review-artifact")
     return;
-  if (argv.length !== commandIndex + 2)
-    return;
-  return argv[commandIndex + 1];
+  return parseValidateReviewArtifactArguments(argv.slice(commandIndex + 1));
 }
 function runValidateReviewArtifact(options) {
   const outputSink = options.outputSink ?? ((message) => console.log(message));
   const errorSink = options.errorSink ?? ((message) => console.error(message));
-  const input = validateReviewArtifactArgument(options.argv);
-  if (input === undefined) {
+  const parsedArgs = validateReviewArtifactArgument(options.argv);
+  if (parsedArgs === undefined) {
     errorSink(VALIDATE_REVIEW_ARTIFACT_USAGE);
     return 2;
   }
-  const resolved = resolveReviewArtifactPath(input, options.cwd ?? process.cwd());
+  const resolved = resolveReviewArtifactPath(parsedArgs.path, options.cwd ?? process.cwd(), { allowOutsideArtifactRoot: parsedArgs.allowOutsideArtifactRoot });
   if (!resolved.ok) {
     errorSink(resolved.message);
     return 2;
@@ -2972,7 +2993,7 @@ function runValidateReviewArtifact(options) {
     errorSink(`Review artifact validation failed: ${result.error.issues.length} issue(s)`);
     return 1;
   }
-  outputSink("Review artifact is valid");
+  outputSink(formatReviewArtifactSuccessMessage(parsedArgs.allowOutsideArtifactRoot));
   return 0;
 }
 function runValidateReviewArtifactCli(options) {

package/dist/lib/review-artifact-path.d.ts

@@ -16,5 +16,16 @@ export declare function formatReviewArtifactIssuePath(issuePath: readonly Proper
 export declare function readReviewArtifact(filePath: string): ReadArtifactResult;
 export declare function isLegacyReviewArtifact(value: unknown): boolean;
 export declare function hasParentDirectoryTraversal(input: string): boolean;
+export declare const ALLOW_OUTSIDE_ARTIFACT_ROOT_FLAG = "--allow-outside-artifact-root";
+export declare const VALIDATE_REVIEW_ARTIFACT_USAGE = "Usage: systematic validate-review-artifact <path> [--allow-outside-artifact-root]";
+export interface ValidateReviewArtifactArguments {
+    readonly path: string;
+    readonly allowOutsideArtifactRoot: boolean;
+}
+export declare function parseValidateReviewArtifactArguments(argv: readonly string[]): ValidateReviewArtifactArguments | undefined;
+export declare function formatReviewArtifactSuccessMessage(allowOutsideArtifactRoot: boolean): string;
 export declare function pathContainsSymlink(candidate: string): boolean;
-export declare function resolveReviewArtifactPath(input: string, cwd: string): ArtifactPathResult;
+export interface ResolveReviewArtifactPathOptions {
+    readonly allowOutsideArtifactRoot?: boolean;
+}
+export declare function resolveReviewArtifactPath(input: string, cwd: string, options?: ResolveReviewArtifactPathOptions): ArtifactPathResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fro.bot/systematic",
-  "version": "3.16.2",
+  "version": "3.16.3",
   "description": "Compound-engineering loops for OpenCode, Pi, and Claude Code",
   "type": "module",
   "homepage": "https://fro.bot/systematic",

package/skills/ce-review/references/synthesis-artifact-contract.md

@@ -247,6 +247,18 @@ validation, and it does not delete the artifact to escape the check. A failing
 artifact is evidence and stays on disk; an absent artifact is never evidence
 of a clean run.
 
+Both commands also accept `--allow-outside-artifact-root`, which skips the
+containment check so a copy fetched from CI, an issue attachment, or a fixture
+can be validated from outside `.context/systematic/ce-review`. It also drops
+the requirement that `.context/systematic/ce-review` exist at all. That is not
+a workaround for the "directory is unavailable" degradation described above:
+that degradation is deliberate visible failure for the parent's own run
+artifact, and the flag does not change how the parent's own validation run is
+judged. This is an external-validation mode for artifacts the parent did not
+just produce. The parent must never pass this flag when validating its own
+run's `review-summary.json`; doing so would silently accept a mismatched or
+misplaced artifact as this run's evidence.
+
 This is enforcement by visible failure, not by containment. An agent that
 never runs the command can still finalize an artifact, but produces no evidence
 in either direction. That is why the command exists as an independently