@opengsd/gsd-core 1.13.0 → 1.15.0

package/gsd-core/bin/lib/install-engine.cjs

@@ -23,6 +23,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const runtimeArtifactConversion = require("./runtime-artifact-conversion.cjs");
+const security_cjs_1 = require("./security.cjs");
 const runtimeArtifactLayout = require("./runtime-artifact-layout.cjs");
 const runtimeArtifactInstallPlan = require("./runtime-artifact-install-plan.cjs");
 const runtimeNamePolicy = require("./runtime-name-policy.cjs");
@@ -111,7 +112,7 @@ function previousOwnedCorpusFiles(configDir, prefix) {
 }
 function pruneEmptyCorpusParents(start, stop) {
     let current = node_path_1.default.dirname(start);
-    while (current !== stop && current.startsWith(stop + node_path_1.default.sep)) {
+    while (current !== stop && current.startsWith(stop + node_path_1.default.sep)) { // allow-handrolled-containment: ancestor-walk loop condition, not a containment gate
         if (installFs().readdirSync(current).length > 0)
             return;
         installFs().rmdirSync(current);
@@ -347,8 +348,11 @@ function hasExistingSymlinkBetween(root, fullPath, options = {}) {
     const resolvedFullPath = node_path_1.default.resolve(fullPath);
     // (a) Path-traversal refusal — ALWAYS enforced, even with opt-in. An untrusted
     // destSubpath string that escapes the install root via '..' is rejected
-    // regardless of user opt-in state (ADR-1239 Phase B threat (a)).
-    if (resolvedFullPath !== resolvedRoot && !resolvedFullPath.startsWith(resolvedRoot + node_path_1.default.sep)) {
+    // regardless of user opt-in state (ADR-1239 Phase B threat (a)). Lexical
+    // (ADR-4650 decision 6): this function's whole purpose is to DETECT
+    // symlinks between root and target, so resolving them here would erase what
+    // it measures.
+    if ((0, security_cjs_1.tryWithinRootLexical)(resolvedFullPath, resolvedRoot) === null) {
         return true;
     }
     // #2393 (security-review finding): realpathSync fully resolves all symlink
@@ -726,6 +730,16 @@ function _copyStaged(stagedDir, destDir, kind, configDir, runtime) {
             continue;
         if (!entry.name.endsWith('.md'))
             continue;
+        // #4782: compact agent variants are consumed ONLY through the non-claude
+        // gate in init.cts's agent-skills persona fallback (`runtime !== 'claude'`
+        // — claude's contract is a skills-injection path, never a persona
+        // fallback). Staging them into Claude's agents directory shipped 29 dead
+        // files whose `name:` frontmatter is identical to their canonical
+        // sibling's, leaving the harness resolution unstated. Claude never
+        // selects compact, so claude is the one runtime whose agents kind skips
+        // them; every other runtime's emission is byte-identical.
+        if (kind.kind === 'agents' && runtime === 'claude' && entry.name.endsWith('.compact.md'))
+            continue;
         const stem = entry.name.slice(0, -3); // strip .md
         let destName;
         if (kind.kind === 'agents') {
@@ -1492,6 +1506,15 @@ function installOpencodeFamilySkills(runtime, targetDir, rawCommandsDir, pathPre
             content = applyOpencodeFamilyPathPrefix(content, runtime, pathPrefix);
             content = processAttribution(content, resolveAttribution(runtime));
             const skillDir = node_path_1.default.join(dest, skillName);
+            // isPathConfined is lexical and cannot see a symlink. mkdirSync({recursive:true})
+            // does NOT throw when skillDir already exists as a symlink to a directory, so a
+            // pre-planted link would redirect the SKILL.md write outside `dest`. Refuse to
+            // write through a link (epic #4636; mirrors retired-artifact-cleanup.cts:77).
+            try {
+                if (installFs().lstatSync(skillDir).isSymbolicLink())
+                    continue;
+            }
+            catch { /* ENOENT: not created yet — the normal case */ }
             installFs().mkdirSync(skillDir, { recursive: true });
             installFs().writeFileSync(node_path_1.default.join(skillDir, 'SKILL.md'), content);
             // #2322 HIGH-3 parity: persist the capability-owned marker so a later
@@ -1868,6 +1891,9 @@ function installOpencodeFamilyArtifacts(runtime, configDir, scope, resolvedProfi
         isWindowsHost: process.platform === 'win32',
         resolvedTarget: (0, shell_command_projection_cjs_1.posixNormalize)(node_path_1.default.resolve(configDir)),
         homeDir: (0, shell_command_projection_cjs_1.posixNormalize)(node_os_1.default.homedir()),
+        // #4377: the runtime's own localConfigDir, so an opted-in local install
+        // emits `<dir>/...` instead of this checkout's absolute path.
+        localDirName: runtimeArtifactConversion._localIncludeDirName(runtime),
     });
     // #2329: destDir is derived from the SAME hostBehaviors.flatCommandDir
     // descriptor value read by writeManifest's manifest-key prefix and by

package/gsd-core/bin/lib/install-profiles.cjs

@@ -740,6 +740,11 @@ function readInstalledCapabilitySkill(stem, registry) {
         return null;
     const skillPath = node_path_1.default.join(capDir, relSkillPath);
     try {
+        // statSync follows symlinks; isPathConfined is lexical and cannot see one.
+        // Refuse to read through a link so an outside file's content cannot be
+        // installed as a capability skill (epic #4636).
+        if (node_fs_1.default.lstatSync(skillPath).isSymbolicLink())
+            return null;
         if (!node_fs_1.default.statSync(skillPath).isFile())
             return null;
         return { capId, content: node_fs_1.default.readFileSync(skillPath, 'utf8') };
@@ -858,6 +863,15 @@ function stageSkillsForRuntimeAsSkills(srcCommandsDir, resolvedProfile, converte
                 if (!(0, external_descriptor_trust_cjs_1.isPathConfined)(skillName, stageDir))
                     continue; // defense-in-depth
                 const destDir = node_path_1.default.join(stageDir, skillName);
+                // isPathConfined is lexical and cannot see a symlink. mkdirSync({recursive:true})
+                // does NOT throw when destDir already exists as a symlink to a directory, so a
+                // pre-planted link would redirect the SKILL.md write outside `stageDir`. Refuse
+                // to write through a link (epic #4636; mirrors retired-artifact-cleanup.cts:77).
+                try {
+                    if (installFs().lstatSync(destDir).isSymbolicLink())
+                        continue;
+                }
+                catch { /* ENOENT: not created yet — the normal case */ }
                 installFs().mkdirSync(destDir, { recursive: true });
                 installFs().writeFileSync(node_path_1.default.join(destDir, 'SKILL.md'), found.content);
                 // #2322 HIGH-3: persist the capability-owned marker so a later prune

package/gsd-core/bin/lib/installer-migrations.cjs

@@ -17,6 +17,7 @@ const installer_migration_authoring_cjs_1 = require("./installer-migration-autho
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const clock_cjs_1 = require("./clock.cjs");
 const install_scope_cjs_1 = require("./install-scope.cjs");
+const security_cjs_1 = require("./security.cjs");
 // #2874 (ADR-58 cleanup phase): this file is the ~1200-line migration
 // plan/apply/rollback/lock/journal engine — almost none of it is on the
 // installRuntimeArtifacts call tree. Only `readInstallManifest` and
@@ -122,8 +123,17 @@ function evaluateRemoveEmptyDir(configDir, fullPath) {
     catch {
         return 'left-in-place';
     }
-    if (resolvedTarget === resolvedRoot || !resolvedTarget.startsWith(resolvedRoot + node_path_1.default.sep)) {
-        // Refuses both "target IS configDir" and "target escaped configDir".
+    // `resolvedTarget === resolvedRoot` is a DELIBERATE ADDITIONAL rejection,
+    // separate from the containment decision: `tryWithinRootLexical` treats
+    // target === root as CONTAINED, but removing the config root itself is
+    // never in scope for this action (see the doc comment above) — this arm
+    // prevents `rmdirSync` from ever being asked to remove `configDir` itself.
+    // Kept as its own check per ADR-4650 decision 6 (a wrapper may add its own
+    // conditions on top of the canonical predicate, never invert it).
+    if (resolvedTarget === resolvedRoot)
+        return 'left-in-place';
+    if ((0, security_cjs_1.tryWithinRootLexical)(resolvedTarget, resolvedRoot) === null) {
+        // Refuses "target escaped configDir".
         return 'left-in-place';
     }
     let entries;
@@ -270,7 +280,14 @@ function readInstallManifest(configDir) {
         version: typeof m.version === 'string' ? m.version : null,
         timestamp: typeof m.timestamp === 'string' ? m.timestamp : null,
         mode: typeof m.mode === 'string' ? m.mode : null,
-        files: m.files && typeof m.files === 'object' ? m.files : {},
+        // #4544 (review): `typeof [] === 'object'` — a manifest whose `files` is a
+        // JSON array passed the object-shape guard, and Object.keys() then yielded
+        // "0","1",... as install-relative file paths. Consumers iterate these keys,
+        // so an array shape must degrade to the empty set exactly like a
+        // non-object shape does.
+        files: m.files && typeof m.files === 'object' && !Array.isArray(m.files)
+            ? m.files
+            : {},
         manifestVersion: normalizeManifestVersion(m.manifestVersion),
         runtime: normalizeReportedRuntime(rawRuntime),
         scope: (0, install_scope_cjs_1.isInstallScopeId)(m.scope) ? m.scope : null,
@@ -598,11 +615,30 @@ function acquireInstallMigrationLock(configDir, { timeoutMs = DEFAULT_LOCK_TIMEO
         }
     }
 }
+// DELIBERATELY LEXICAL — the RESOLUTION policy stays lexical, never realpath
+// (`assertWithinRoot` / `tryWithinRoot`, src/security.cts).
+//
+// Reviewed under epic #4636 Phase 3 and reverted after the remote matrix proved
+// the realpath collapse wrong. This module's contract is that a symlinked
+// managed path is treated AS A LINK and never dereferenced — it is snapshotted
+// as a link, restored as a link, and backed up as a link. The realpath-based
+// predicate dereferences exactly the symlinks this module exists to preserve
+// and then rejects them for escaping configDir
+// ("migration path escapes configDir: extensions/gsd.cjs"). Four tests in
+// tests/installer-migrations.test.cjs pin that behavior.
+//
+// The containment DECISION now routes through the canonical LEXICAL predicate
+// (`tryWithinRootLexical`, ADR-4650 decision 6) — only the comparison moved;
+// the lexical policy itself remains this module's own required choice, and
+// the thrown message / returned `fullPath` are unchanged.
+//
+// `normalizeRelPath` is the pre-gate: it throws on absolute paths and on any
+// '..' segment BEFORE this runs, so the check below is defense-in-depth over
+// already-traversal-free input rather than the primary boundary.
 function ensureInsideConfig(configDir, relPath) {
     const normalized = normalizeRelPath(relPath);
     const fullPath = node_path_1.default.resolve(configDir, normalized);
-    const root = node_path_1.default.resolve(configDir);
-    if (fullPath !== root && !fullPath.startsWith(root + node_path_1.default.sep)) {
+    if ((0, security_cjs_1.tryWithinRootLexical)(fullPath, configDir) === null) {
         throw new Error(`migration path escapes configDir: ${relPath}`);
     }
     return { normalized, fullPath };

package/gsd-core/bin/lib/loop-resolver.cjs

@@ -224,6 +224,9 @@ function resolveLoopHooks(input) {
             active.consumes = consumes;
         if (onError !== undefined)
             active.onError = onError;
+        // #4209 DISP-02: only a literal `true` projects; absent/false stay inert.
+        if (hook['supportsReviewerLanes'] === true)
+            active.supportsReviewerLanes = true;
         activeHooks.push(active);
     }
     // Process contributions
@@ -422,17 +425,20 @@ function sanitizeLoadFailReason(reason) {
         .slice(0, 300);
     return cleaned || '(no reason given)';
 }
-function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
-    if (!point) {
-        coreError('loop render-hooks requires a <point> argument. Valid points: ' + CANONICAL_POINTS.join(', '));
-        return;
-    }
-    // --active-cap <capId> mode: emit 'true' or 'false' only (scanner-safe, no JSON envelope)
-    const activeCapId = typeof options['activeCap'] === 'string' ? options['activeCap'] : undefined;
-    if (activeCapId !== undefined && activeCapId === '') {
-        coreError('--active-cap requires a <capId> value (e.g. --active-cap tdd)');
-        return;
-    }
+/**
+ * The full config/registry/capability-state resolution `cmdLoopRenderHooks` performs, minus its
+ * CLI-only output formatting — extracted so an in-process caller (e.g. `review-lane dispatch-step`
+ * self-verifying a `supportsReviewerLanes` trait) can reach the SAME resolution `gsd_run loop
+ * render-hooks <point> --raw` would give it, without spawning a subprocess and re-parsing its
+ * stdout (which was subject to `io.cjs`'s `@file:` overflow protocol on the rendered-string
+ * envelope — a bug class this in-process call cannot hit, since it never touches that envelope
+ * or its rendering at all).
+ *
+ * Throws on an invalid `point` (mirrors `resolveLoopHooks`); callers convert to their own error
+ * channel. Emits the same loud stderr load-failure warnings `cmdLoopRenderHooks` always has,
+ * regardless of caller — a skipped gate must never be silently invisible.
+ */
+function resolveActiveHooksForPoint(cwd, point, options = {}) {
     const runtimeConfigDir = typeof options['configDir'] === 'string'
         ? options['configDir']
         : undefined;
@@ -468,15 +474,7 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     for (const cap of state.capabilities || []) {
         capabilityStatesById.set(cap.id, cap);
     }
-    let resolved;
-    try {
-        resolved = resolveLoopHooks({ point, registry, config, cwd, capabilityStatesById });
-    }
-    catch (err) {
-        const msg = (err instanceof Error) ? err.message : String(err);
-        coreError(msg);
-        return;
-    }
+    const resolved = resolveLoopHooks({ point, registry, config, cwd, capabilityStatesById });
     // ── ADR-1244 D2: load-failed capability gates FAIL OPEN with a loud warning ────
     // Decision (#2009): a capability that failed to LOAD must not block the loop.
     // The prior behavior injected a BLOCKING synthetic gate (blocking:true,
@@ -525,24 +523,44 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     for (const w of loadFailWarnings) {
         process.stderr.write(`gsd: warning — ${w}\n`);
     }
-    // --active-cap mode: print exactly 'true' or 'false' with no envelope
+    // Surface capability-state warnings and the #2009 load-failure fail-open warnings together
+    // (in addition to the stderr emission above, which is the channel host workflows actually see).
+    const combinedWarnings = [...(state.warnings || []), ...loadFailWarnings];
+    return { point: resolved.point, activeHooks: resolved.activeHooks, warnings: combinedWarnings };
+}
+function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
+    if (!point) {
+        coreError('loop render-hooks requires a <point> argument. Valid points: ' + CANONICAL_POINTS.join(', '));
+        return;
+    }
+    // --active-cap <capId> mode: emit 'true' or 'false' only (scanner-safe, no JSON envelope)
+    const activeCapId = typeof options['activeCap'] === 'string' ? options['activeCap'] : undefined;
+    if (activeCapId !== undefined && activeCapId === '') {
+        coreError('--active-cap requires a <capId> value (e.g. --active-cap tdd)');
+        return;
+    }
+    let result;
+    try {
+        result = resolveActiveHooksForPoint(cwd, point, options);
+    }
+    catch (err) {
+        const msg = (err instanceof Error) ? err.message : String(err);
+        coreError(msg);
+        return;
+    }
     if (activeCapId !== undefined) {
-        const isActive = resolved.activeHooks.some((h) => h.capId === activeCapId);
+        const isActive = result.activeHooks.some((h) => h.capId === activeCapId);
         process.stdout.write(isActive ? 'true\n' : 'false\n');
         return;
     }
-    const rendered = renderLoopHooks(resolved);
+    const rendered = renderLoopHooks({ point: result.point, activeHooks: result.activeHooks });
     const envelope = {
-        point: resolved.point,
-        activeHooks: resolved.activeHooks,
+        point: result.point,
+        activeHooks: result.activeHooks,
         rendered,
     };
-    // Surface capability-state warnings and the #2009 load-failure fail-open
-    // warnings together in the structured `warnings` channel (in addition to the
-    // stderr emission above, which is the channel host workflows actually see).
-    const combinedWarnings = [...(state.warnings || []), ...loadFailWarnings];
-    if (combinedWarnings.length > 0) {
-        envelope.warnings = combinedWarnings;
+    if (result.warnings.length > 0) {
+        envelope.warnings = result.warnings;
     }
     coreOutput(envelope, raw);
 }
@@ -550,6 +568,7 @@ module.exports = {
     resolveLoopHooks,
     renderLoopHooks,
     cmdLoopRenderHooks,
+    resolveActiveHooksForPoint,
     // Exported for tests
     _getNestedConfigValue,
     _resolveActivationValue,

package/gsd-core/bin/lib/mcp-catalog.cjs

@@ -402,8 +402,8 @@ function classifyUnindexedUri(uri) {
 }
 /** Second, independent gate (design "Hostile inputs" gate 2): re-validate an INDEXED entry's relPath against the catalog root, catching a symlink planted after the index was built. */
 function readIndexedResource(catalog, entry) {
-    const check = (0, security_cjs_1.validatePath)(entry.relPath, catalog.root);
-    if (!check.safe) {
+    const contained = (0, security_cjs_1.tryWithinRoot)(entry.relPath, catalog.root);
+    if (contained === null) {
         fail(exports.REASON.TRAVERSAL_REFUSED, `indexed resource escapes catalog root: ${entry.relPath}`);
     }
     let raw;

package/gsd-core/bin/lib/milestone.cjs

@@ -38,7 +38,7 @@ const stateContract = require("./state-contract.cjs");
 const { publishStateContract } = stateContract;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
-const { normalizePhaseName, matchPhaseDirs, PHASE_NUMBER_TOKEN_SOURCE, isSentinelPhaseId, isSentinelPhaseDir } = phaseIdMod;
+const { normalizePhaseName, matchPhaseDirs, isSentinelPhaseId, isSentinelPhaseDir, buildPhaseHeadingScanRegex, PHASE_HEADING_BASELINE } = phaseIdMod;
 const pattern_cjs_1 = require("./pattern.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapParserMod = require("./roadmap-parser.cjs");
@@ -642,8 +642,21 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
             // windows converge to the same value regardless of which version drove
             // the lookup.
             const scopedContent = sliceMilestoneWindow(roadmapContent, version) ?? extractCurrentMilestone(roadmapContent, cwd);
-            // #1729: `(?:\s*\([^)\n]{0,200}\))?` tolerates a pre-colon ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE).
-            const phasePattern = new RegExp(`#{2,4}\\s*Phase\\s+(${PHASE_NUMBER_TOKEN_SOURCE})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*:\\s*([^\\n]+)`, 'gi');
+            // #1729: `(?:\s*\([^)\n]{0,200}\))?` tolerates a pre-colon ( ) tag, owned
+            // by buildPhaseHeadingScanRegex (phase-id.cts) so this guard also
+            // recognizes bracket-convention headings instead of hand-rolling a
+            // literal `Phase\s+`.
+            // #4984 fix: resolved ONCE and threaded into BOTH the heading scan and
+            // the disk-side matchPhaseDirs check below — the heading scan alone
+            // recognizing `[GSD.02] 01:` and extracting the bare phase-number token
+            // "01" is only half the fix. Without also passing this convention to
+            // matchPhaseDirs, its bracket-qualified match arm never fires, "01"
+            // matches no bracket directory name ("GSD.02-01-setup"), and every
+            // properly-scaffolded bracket phase reads as disk_status: 'no_directory'
+            // — turning a real bracket project's own phases into false "ROADMAP
+            // lists N unstarted phase(s)" failures on `milestone complete`.
+            const convention = resolvePhaseIdConvention(cwd);
+            const { regex: phasePattern, phaseNumGroup } = buildPhaseHeadingScanRegex(PHASE_HEADING_BASELINE.ANY_BRACKET, convention);
             const noDirectoryPhases = [];
             let pm;
             const phaseDirEntries = (() => {
@@ -658,7 +671,7 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
                 }
             })();
             while ((pm = phasePattern.exec(scopedContent)) !== null) {
-                const phaseNum = pm[1];
+                const phaseNum = pm[phaseNumGroup];
                 // Phase 0 (pre-milestone) and Phase 999 (backlog) are sentinels, not
                 // real phases — they legitimately have no directory and must not block
                 // milestone completion. Mirrors the engine-wide sentinel convention
@@ -672,7 +685,7 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
                 // with a matching token exists on disk. Use the same matchPhaseDirs
                 // owner that roadmap.analyze uses to avoid false positives on decimal
                 // (2.1) and letter-suffix (12A) phase IDs. (#2528)
-                const hasDirectory = matchPhaseDirs(phaseDirEntries, normalized).matches.length > 0;
+                const hasDirectory = matchPhaseDirs(phaseDirEntries, normalized, convention).matches.length > 0;
                 if (!hasDirectory) {
                     noDirectoryPhases.push(phaseNum);
                 }
@@ -826,7 +839,7 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
         // never disagree with what a real run actually archives. Absent
         // --archive-quick this stays `[]` and nothing on disk is touched either
         // way (dry-run always returns before any mutation below).
-        const quickDirsToArchive = options.archiveQuick ? listQuickTaskDirsForArchive(cwd) : [];
+        const quickDirsToArchive = options.archiveQuick ? listQuickTaskDirsForArchive(cwd).map((d) => d.name) : [];
         const dryRunResult = {
             dry_run: true,
             version,
@@ -1482,6 +1495,16 @@ function writeQuickArchiveReadme(archiveQuickDir) {
  * written three times, and only the real-run copy applied `requireSafePath`,
  * so a dry-run preview could list a directory the real run would silently
  * skip).
+ *
+ * Returns the proven `ContainedPath` alongside each entry's bare `name`
+ * (`no-unconfined-path-join`'s `discardedContainmentResult` arm — a bare
+ * statement call to `requireSafePath` throws away the exact answer it just
+ * computed). The two dry-run previews only need `name` for display;
+ * `archiveQuickTaskDirectories` deliberately does NOT reuse `abs` for its
+ * rename — it re-derives and re-validates independently as TOCTOU
+ * defense-in-depth (see its own comment), so `abs` exists here only to make
+ * this function's own discard explicit, not to be trusted downstream as a
+ * stale-safe proof.
  */
 function listQuickTaskDirsForArchive(cwd) {
     const planningBase = planningPaths(cwd).planning;
@@ -1494,19 +1517,20 @@ function listQuickTaskDirsForArchive(cwd) {
         // .planning/quick absent or unreadable — nothing to select.
         return [];
     }
-    const names = [];
+    const results = [];
     for (const entry of sourceEntries) {
         if (!entry.isDirectory())
             continue; // excludes symlinks too — see MAJOR 3 note above
+        let abs;
         try {
-            (0, security_cjs_1.requireSafePath)(node_path_1.default.join(quickDir, entry.name), planningBase, 'quick task dir', { allowAbsolute: true });
+            abs = (0, security_cjs_1.requireSafePath)(node_path_1.default.join(quickDir, entry.name), planningBase, 'quick task dir', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
         }
         catch {
             continue; // symlink/escape attempt — never a candidate, in preview OR real run
         }
-        names.push(entry.name);
+        results.push({ name: entry.name, abs });
     }
-    return names.sort();
+    return results.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
 /**
  * #2142: move each DIRECTORY entry under `.planning/quick/` into
@@ -1555,7 +1579,7 @@ function archiveQuickTaskDirectories(cwd, version) {
     // #2142 MAJOR 5 (review): dirNames is the SAME selection
     // `listQuickTaskDirsForArchive` hands to both dry-run previews — this is
     // the real run, so it cannot disagree with what a preview reported.
-    const dirNames = listQuickTaskDirsForArchive(cwd);
+    const dirNames = listQuickTaskDirsForArchive(cwd).map((d) => d.name);
     if (dirNames.length === 0) {
         // Boundary 0 (#2142): zero (safe) directory entries (empty dir, only
         // stray files, or every entry excluded by the selection rule) must not
@@ -1576,7 +1600,7 @@ function archiveQuickTaskDirectories(cwd, version) {
                 // rename are two separate filesystem observations, and an entry
                 // that was a safe real directory at selection time could in theory
                 // be swapped for a symlink before this loop reaches it.
-                safeSrc = (0, security_cjs_1.requireSafePath)(src, planningBase, 'quick task dir', { allowAbsolute: true });
+                safeSrc = (0, security_cjs_1.requireSafePath)(src, planningBase, 'quick task dir', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
             }
             catch {
                 continue; // symlink/escape attempt — skip, not archived
@@ -1669,7 +1693,7 @@ function cmdQuickArchive(cwd, version, options, raw) {
     // `cmdMilestoneComplete`'s own dry-run preview and the real
     // `archiveQuickTaskDirectories` both use, so all three can never disagree.
     if (options.dryRun) {
-        const quickDirsToArchive = listQuickTaskDirsForArchive(cwd);
+        const quickDirsToArchive = listQuickTaskDirsForArchive(cwd).map((d) => d.name);
         output({
             dry_run: true,
             version,