@pareto4/pp-core 1.11.1 → 1.12.0

package/pp-core/bin/lib/config.cjs

@@ -27,10 +27,11 @@ const modelProfiles = require("./model-profiles.cjs");
 const { VALID_PROFILES, getAgentToModelMapForProfile, formatAgentToModelMapAsTable } = modelProfiles;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configSchema = require("./config-schema.cjs");
-const { VALID_CONFIG_KEYS, isValidConfigKey } = configSchema;
+const { VALID_CONFIG_KEYS, isValidConfigKey, capabilityEnumValues } = configSchema;
 const secrets_cjs_1 = require("./secrets.cjs");
 const review_reviewer_selection_cjs_1 = require("./review-reviewer-selection.cjs");
 const configuration_cjs_1 = require("./configuration.cjs");
+const phase_tier_cjs_1 = require("./phase-tier.cjs");
 // ─── Constants ────────────────────────────────────────────────────────────────
 const CONFIG_KEY_SUGGESTIONS = {
     'workflow.nyquist_validation_enabled': 'workflow.nyquist_validation',
@@ -464,6 +465,53 @@ function setConfigValues(cwd, entries) {
         }
     });
 }
+/**
+ * The ONE membership test every enum guard in `cmdConfigSet` asks (13-REVIEW
+ * CR-01). The raw value is parsed before the guards — `true`/`false`/numbers
+ * coerced, and a value starting with `[` or `{` JSON-parsed — and
+ * `String(['dev']) === 'dev'`, so a membership test on `String(parsedValue)`
+ * let a one-element array through and wrote it. Every value list here is
+ * strings, so only a plain string can be a member.
+ */
+function isStringMember(list, value) {
+    return typeof value === 'string' && list.includes(value);
+}
+/**
+ * Config keys `pp-tools config-set` accepts ONLY a real JSON boolean for
+ * (07-14 / REV-CR-01).
+ *
+ * The parse above coerces exactly the two lowercase words `true` and `false`;
+ * every other spelling an operator plausibly types becomes a truthy string
+ * (`"FALSE"`, `"no"`, `"off"`) or a number. `capability-activation`'s
+ * `_resolveActivationValue` ends in `Boolean(r.value)`, so those strings read as
+ * ON — an operator typing `config-set vault.enabled FALSE` to switch the vault
+ * off instead ARMED every step `capabilities/vault` hangs on that key, against
+ * the constraint that a `vault.enabled=false` project stays completely inert.
+ *
+ * The list, not ten copies of the same `if`: the first seven are capability
+ * activation keys read through that `Boolean()` (the vault switches plus every
+ * key that gates a blocking hook in the shipped registry). The last three were already guarded individually and are folded in here
+ * unchanged, message included, so there is one mechanism in this file rather
+ * than two.
+ *
+ * REFUSE, do not normalise: `FALSE` plainly means false, but `1`, `enabled` and
+ * `on` are guesses, and a config-set that silently rewrites the operator's word
+ * is the same class of silent-wrong-answer this phase exists to end. A typed
+ * usage error names the two accepted values.
+ */
+const BOOLEAN_ONLY_CONFIG_KEYS = Object.freeze([
+    'vault.enabled',
+    'vault.required',
+    'vault.practices_enabled',
+    'workflow.schema_drift_gate',
+    'workflow.nyquist_validation',
+    'workflow.security_enforcement',
+    'workflow.ui_safety_gate',
+    'pareto.enabled',
+    'git.create_tag',
+    'workflow.post_planning_gaps',
+    'plan_review.source_grounding',
+]);
 /**
  * Command to set a value in the config file, allowing nested values via dot notation (e.g.,
  * "workflow.research").
@@ -508,12 +556,12 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         catch { /* keep as string */ }
     }
     const VALID_CONTEXT_VALUES = ['dev', 'research', 'review'];
-    if (kp === 'context' && !VALID_CONTEXT_VALUES.includes(String(parsedValue))) {
+    if (kp === 'context' && !isStringMember(VALID_CONTEXT_VALUES, parsedValue)) {
         error(`Invalid context value '${val}'. Valid values: ${VALID_CONTEXT_VALUES.join(', ')}`);
     }
     // Codebase drift detector (#2003)
     const VALID_DRIFT_ACTIONS = ['warn', 'auto-remap'];
-    if (kp === 'workflow.drift_action' && !VALID_DRIFT_ACTIONS.includes(String(parsedValue))) {
+    if (kp === 'workflow.drift_action' && !isStringMember(VALID_DRIFT_ACTIONS, parsedValue)) {
         error(`Invalid workflow.drift_action '${val}'. Valid values: ${VALID_DRIFT_ACTIONS.join(', ')}`);
     }
     if (kp === 'workflow.drift_threshold') {
@@ -521,51 +569,62 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
             error(`Invalid workflow.drift_threshold '${val}'. Must be a positive integer.`);
         }
     }
-    // Post-planning gap checker (#2493)
-    if (kp === 'workflow.post_planning_gaps') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid workflow.post_planning_gaps '${val}'. Must be a boolean (true or false).`);
-        }
-    }
-    // #3086 — git.create_tag: boolean only
-    if (kp === 'git.create_tag') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid git.create_tag '${val}'. Must be a boolean (true or false).`);
-        }
+    // Boolean-only keys, in ONE place (07-14 / REV-CR-01; absorbs the individual
+    // guards #2493 workflow.post_planning_gaps, #3086 git.create_tag and #22
+    // plan_review.source_grounding, whose message this reproduces verbatim).
+    if (BOOLEAN_ONLY_CONFIG_KEYS.includes(kp) && typeof parsedValue !== 'boolean') {
+        error(`Invalid ${kp} '${val}'. Must be a boolean (true or false).`, ERROR_REASON.USAGE);
     }
     if (kp === 'ship.pr_body_sections') {
         validateShipPrBodySections(parsedValue);
     }
+    // Phase ceremony tier (pack 9) — enum, src/phase-tier.cts owns the list
+    if (kp === 'phase.tier' && !isStringMember(phase_tier_cjs_1.PHASE_TIERS, parsedValue)) {
+        error(`Invalid phase.tier '${val}'. Valid values: ${phase_tier_cjs_1.PHASE_TIERS.join(', ')}`, ERROR_REASON.CONFIG_INVALID_VALUE);
+    }
     // Human verification checkpoint mode (#3309)
     const VALID_HUMAN_VERIFY_MODES = ['mid-flight', 'end-of-phase'];
-    if (kp === 'workflow.human_verify_mode' && !VALID_HUMAN_VERIFY_MODES.includes(String(parsedValue))) {
+    if (kp === 'workflow.human_verify_mode' && !isStringMember(VALID_HUMAN_VERIFY_MODES, parsedValue)) {
         error(`Invalid workflow.human_verify_mode '${val}'. Valid values: ${VALID_HUMAN_VERIFY_MODES.join(', ')}`);
     }
     // Context position enum validation (#2937)
     const VALID_CONTEXT_POSITIONS = ['front', 'end'];
-    if (kp === 'statusline.context_position' && !VALID_CONTEXT_POSITIONS.includes(String(parsedValue))) {
+    if (kp === 'statusline.context_position' && !isStringMember(VALID_CONTEXT_POSITIONS, parsedValue)) {
         error(`Invalid statusline.context_position '${val}'. Valid values: ${VALID_CONTEXT_POSITIONS.join(', ')}`);
     }
     // Fallow scope + profile enum validation (#3424)
     const VALID_FALLOW_SCOPES = ['phase', 'repo'];
-    if (kp === 'code_quality.fallow.scope' && !VALID_FALLOW_SCOPES.includes(String(parsedValue))) {
+    if (kp === 'code_quality.fallow.scope' && !isStringMember(VALID_FALLOW_SCOPES, parsedValue)) {
         error(`Invalid code_quality.fallow.scope '${val}'. Valid values: ${VALID_FALLOW_SCOPES.join(', ')}`);
     }
     const VALID_FALLOW_PROFILES = ['minimal', 'standard', 'strict'];
-    if (kp === 'code_quality.fallow.profile' && !VALID_FALLOW_PROFILES.includes(String(parsedValue))) {
+    if (kp === 'code_quality.fallow.profile' && !isStringMember(VALID_FALLOW_PROFILES, parsedValue)) {
         error(`Invalid code_quality.fallow.profile '${val}'. Valid values: ${VALID_FALLOW_PROFILES.join(', ')}`);
     }
-    // plan_review.source_grounding (#22) — boolean only
-    if (kp === 'plan_review.source_grounding') {
-        if (typeof parsedValue !== 'boolean') {
-            error(`Invalid plan_review.source_grounding '${val}'. Must be a boolean (true or false).`);
-        }
-    }
     // plan_review.source_grounding_authority (#22) — enum
     const VALID_SOURCE_GROUNDING_AUTHORITIES = ['grep', 'intel', 'treesitter', 'lsp', 'scip'];
-    if (kp === 'plan_review.source_grounding_authority' && !VALID_SOURCE_GROUNDING_AUTHORITIES.includes(String(parsedValue))) {
+    if (kp === 'plan_review.source_grounding_authority' && !isStringMember(VALID_SOURCE_GROUNDING_AUTHORITIES, parsedValue)) {
         error(`Invalid plan_review.source_grounding_authority '${val}'. Valid values: ${VALID_SOURCE_GROUNDING_AUTHORITIES.join(', ')}`);
     }
+    // Capability enum keys, in ONE place (13-05, D-07). Measured 2026-10-09:
+    // `config-set workflow.code_review_depth bogus` wrote at exit 0, as did every
+    // other enum key, because no guard consulted the registry's declared `values`. This runs AFTER every
+    // hand-coded guard above, so a key that already has its own guard
+    // (`workflow.drift_action`) keeps its message byte-identical; the
+    // registry, through `capabilityEnumValues`, is the only list consulted
+    // here. The refused value is NOT echoed (T-13-03): it is operator text and
+    // may carry terminal control sequences. Only the WRITE path changes: how an
+    // existing enum key is READ is deliberately unchanged in this phase (D-07).
+    // The TYPE is checked before membership (13-REVIEW CR-01): a value starting
+    // with `[` is JSON-parsed above, and `String(['standards']) === 'standards'`,
+    // so a membership-only test let a one-element array through and wrote it —
+    // which `federated-config` silently reads back as the default for an enum
+    // key. Every declared capability enum value is a string, so a non-string
+    // parse (array, object, number, boolean) can never be a member.
+    const enumValues = capabilityEnumValues(kp);
+    if (enumValues && !isStringMember(enumValues, parsedValue)) {
+        error(`Invalid ${kp}. Valid values: ${enumValues.join(', ')}`, ERROR_REASON.CONFIG_INVALID_VALUE);
+    }
     if (kp === 'review.default_reviewers') {
         const normalized = (0, review_reviewer_selection_cjs_1.normalizeConfiguredDefaultReviewers)(parsedValue);
         if (normalized.errors.length > 0) {
@@ -592,7 +651,58 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
         output(maskedResult, raw, `${kp}=${masked}`);
         return;
     }
-    output(setConfigValueResult, raw, `${kp}=${String(parsedValue)}`);
+    // Pack 6 D-07: the WRITTEN value stays raw; its echo (and the value it
+    // replaced) is display-safe.
+    const shownValue = redactConfigCoordinates(kp, parsedValue);
+    const shownResult = {
+        ...setConfigValueResult,
+        value: redactConfigCoordinates(kp, setConfigValueResult.value),
+        previousValue: redactConfigCoordinates(kp, setConfigValueResult.previousValue),
+    };
+    output(shownResult, raw, `${kp}=${String(shownValue)}`);
+}
+/**
+ * Pack 6 D-07: the display-safe form of a config value about to be EMITTED,
+ * for the config keys that hold a remote repo coordinate (the shared-tier repo,
+ * `SHARED_REPO_CONFIG_KEY`). `keyPath` is the dotted path the value was read
+ * at (`''` for the whole config): the key itself, or any ancestor object that
+ * carries it, is projected through the one owner (`redactCloneTarget` in
+ * src/vault.cts); every other value is returned untouched (and a
+ * credential-free coordinate is unchanged by the owner). The file on disk and
+ * every in-process reader keep the raw value. Lazily required, so this
+ * module's load graph is unchanged.
+ */
+function redactConfigCoordinates(keyPath, value) {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { SHARED_REPO_CONFIG_KEY } = require('./vault-coordinates.cjs');
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { redactCloneTarget } = require('./vault.cjs');
+    const safe = (v) => (typeof v === 'string' && v !== '' ? (redactCloneTarget(v) ?? v) : v);
+    const target = SHARED_REPO_CONFIG_KEY.split('.');
+    const at = keyPath === '' ? [] : keyPath.split('.');
+    if (at.length > target.length || at.some((seg, i) => seg !== target[i]))
+        return value;
+    const rest = target.slice(at.length);
+    if (rest.length === 0)
+        return safe(value);
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    const copy = JSON.parse(JSON.stringify(value));
+    // The flat form: the whole dotted key written as one top-level property.
+    if (at.length === 0 && typeof copy[SHARED_REPO_CONFIG_KEY] === 'string') {
+        copy[SHARED_REPO_CONFIG_KEY] = safe(copy[SHARED_REPO_CONFIG_KEY]);
+    }
+    let node = copy;
+    for (const seg of rest.slice(0, -1)) {
+        const next = node[seg];
+        if (next === null || typeof next !== 'object' || Array.isArray(next))
+            return copy;
+        node = next;
+    }
+    const leaf = rest[rest.length - 1];
+    if (typeof node[leaf] === 'string')
+        node[leaf] = safe(node[leaf]);
+    return copy;
 }
 function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
     const configPath = node_path_1.default.join(planningDir(cwd), 'config.json');
@@ -665,7 +775,9 @@ function cmdConfigGet(cwd, keyPath, raw, defaultValue) {
         output(masked, raw, masked);
         return;
     }
-    output(current, raw, String(current));
+    // Pack 6 D-07: a remote coordinate (or a section carrying one) is emitted display-safe.
+    const shown = redactConfigCoordinates(kp, current);
+    output(shown, raw, String(shown));
 }
 /**
  * Command to set the model profile in the config file.
@@ -768,6 +880,7 @@ function cmdMigrateConfig(cwd, raw) {
 }
 module.exports = {
     VALID_CONFIG_KEYS,
+    BOOLEAN_ONLY_CONFIG_KEYS,
     cmdConfigEnsureSection,
     cmdConfigSet,
     cmdConfigGet,
@@ -777,5 +890,7 @@ module.exports = {
     cmdMigrateConfig,
     // Exported for programmatic use by capability-writer and tests
     setConfigValue,
+    // Pack 6 D-07: `state load` emits the whole config through the same projection.
+    redactConfigCoordinates,
     setConfigValues,
 };

package/pp-core/bin/lib/core-utils.cjs

@@ -61,22 +61,58 @@ function detectSubRepos(cwd) {
 // ─── Summary body helpers ─────────────────────────────────────────────────
 /**
  * Extract a one-liner from the summary body when it's not in frontmatter.
+ *
+ * The slot is the one the SUMMARY template defines (`template.cts` summary body,
+ * `templates/summary.md:51` and its `<one_liner_rules>`): the FIRST paragraph
+ * directly after the FIRST `# ` title, written either as a whole bold paragraph
+ * (a wrapped one is joined with single spaces, the outer `**` stripped once and
+ * inner bold spans kept) or as the `**Label:** prose` line bug #2660 pinned.
+ * Anything else — a plain-prose first paragraph, or a bold span under a later
+ * heading — yields null. 261007-rly D-3/D-8: the old pattern took the first bold
+ * span after ANY heading anywhere in the file, which put fragments such as
+ * `Task 1` and `D-08-32 — applied as written.` into 15 of the 34 accomplishment
+ * lines of the v1.1 close (todos/done/milestone-complete-writes-a-poor-milestone-record.md).
+ * Shared by `milestone complete` and `summary-extract`'s `one_liner`.
  */
 function extractOneLinerFromBody(content) {
     if (!content)
         return null;
     const normalized = content.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
     const body = normalized.replace(/^---\n[\s\S]*?\n---\n*/, '');
-    const match = body.match(/^#[^\n]*\n+\*\*([^*\n]+)\*\*([^\n]*)/m);
-    if (!match)
+    const lines = body.split('\n');
+    const title = lines.findIndex((l) => /^# /.test(l));
+    if (title === -1)
+        return null;
+    let i = title + 1;
+    while (i < lines.length && lines[i].trim() === '')
+        i++;
+    const paragraph = [];
+    while (i < lines.length && lines[i].trim() !== '' && !/^#{1,6}\s/.test(lines[i]))
+        paragraph.push(lines[i++]);
+    if (paragraph.length === 0)
         return null;
-    const boldInner = match[1].trim();
-    const afterBold = match[2];
-    if (/:\s*$/.test(boldInner)) {
-        const prose = afterBold.trim();
+    // `**Label:** prose` (bug #2660): the prose after the label, null when empty.
+    const label = paragraph[0].match(/^\*\*([^*\n]+)\*\*([^\n]*)/);
+    if (label && /:\s*$/.test(label[1].trim())) {
+        const prose = label[2].trim();
         return prose.length > 0 ? prose : null;
     }
-    return boldInner.length > 0 ? boldInner : null;
+    // A whole bold paragraph, single-line or wrapped.
+    const first = paragraph[0].trim();
+    const last = paragraph[paragraph.length - 1].trim();
+    if (!first.startsWith('**'))
+        return null;
+    let bold = null;
+    if (last.endsWith('**'))
+        bold = paragraph.map((l) => l.trim()).join(' ');
+    // A bold first line with prose glued under it (no blank line between) — the
+    // shape tests/core-utils.test.cjs pins; the bold line is still the slot.
+    else if (first.length > 4 && first.endsWith('**'))
+        bold = first;
+    if (bold === null)
+        return null;
+    const inner = bold.slice(2, -2).trim();
+    return inner.length > 0 ? inner : null;
 }
 // ─── Misc utilities ───────────────────────────────────────────────────────────
 function pathExistsInternal(cwd, targetPath) {

package/pp-core/bin/lib/discovery-input-check.cjs

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * Discovery input-package enforcement engine (discovery-v2 Phase 2,
+ * INPUT-02/INPUT-03, D-18/D-19/D-22).
+ *
+ * Scans the per-engagement `.planning/discovery/session-NN.md` files and the
+ * confidential input directory, failing loud (D-19) when:
+ *   - a session is `Completed` while `[TO CONFIRM]` markers remain in its
+ *     body (completed_with_unconfirmed), or
+ *   - a completeness_score of 100 counts unconfirmed topics — markers remain,
+ *     or the session is still `Pre-Filled` (score_counts_unconfirmed; D-18:
+ *     Pre-Filled is not Completed), or
+ *   - git tracks any file under `.planning/discovery-input/confidential/`
+ *     (confidential_tracked — the D-22 mechanical backstop), with a single
+ *     designed exception: the backstop `confidential/.gitignore` itself is
+ *     exempt — it is written to be committed (UAT gap 1).
+ *
+ * Graceful arms (Pitfall 4 / RESEARCH A3): a non-git project, a project with
+ * no `.planning/discovery/` directory, and a session without a frontmatter
+ * block all pass clean — the check fails only on real violations.
+ *
+ * Content-free contract (T-02-05): output names file paths, structured
+ * reasons, and counts only — never file contents.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const io = require("./io.cjs");
+const { output, error, ERROR_REASON } = io;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const fm = require("./frontmatter.cjs");
+// ─── Constants ────────────────────────────────────────────────────────────────
+const SESSION_STATUS = Object.freeze({
+    NOT_STARTED: 'Not Started',
+    PRE_FILLED: 'Pre-Filled',
+    IN_PROGRESS: 'In Progress',
+    COMPLETED: 'Completed',
+});
+const TO_CONFIRM_MARKER = '[TO CONFIRM]';
+const CONFIDENTIAL_DIR = '.planning/discovery-input/confidential/';
+// UAT gap 1 / D-22: input-package.md Step 4 writes this file with `*` +
+// `!.gitignore` so the confidentiality backstop travels with the repo; the
+// gate must accept its own designed state, else Step 6 remediation would
+// strip protection from fresh clones. `git ls-files` emits forward-slash
+// relative paths on every platform, so strict `===` equality is correct.
+const CONFIDENTIAL_BACKSTOP = `${CONFIDENTIAL_DIR}.gitignore`;
+const DISCOVERY_DIR = '.planning/discovery';
+const GIT_TIMEOUT_MS = 5000;
+// Anchored fixed-shape filename filter (threat T-02-07): never a regex over
+// untrusted session content — content scanning is literal-only below.
+const SESSION_FILE_RE = /^session-\d{2}\.md$/;
+// Frontmatter block at byte 0 — same shape extractFrontmatter recognizes, so
+// the body slice stays in lockstep with what the parser consumed.
+const FRONTMATTER_BLOCK_RE = /^---\r?\n[\s\S]+?\r?\n---/;
+// ─── Session content check (D-18/D-19) ────────────────────────────────────────
+/**
+ * Check one session file's content for pre-fill violations. Pure.
+ *
+ * Marker counting scans only the body (content after the closing frontmatter
+ * delimiter) via literal split on TO_CONFIRM_MARKER — zero regex over
+ * untrusted content (T-02-07), counts every occurrence. A session without a
+ * frontmatter block is not pre-filled (A3) and returns no violations. A
+ * session can carry both violation kinds.
+ */
+function checkSessionContent(name, content) {
+    const violations = [];
+    if (typeof content !== 'string' || content.length === 0)
+        return violations;
+    const front = fm.extractFrontmatter(content);
+    if (Object.keys(front).length === 0)
+        return violations;
+    const blockMatch = FRONTMATTER_BLOCK_RE.exec(content);
+    const body = blockMatch ? content.slice(blockMatch[0].length) : content;
+    const markers = body.split(TO_CONFIRM_MARKER).length - 1;
+    const status = typeof front.status === 'string' ? front.status : '';
+    const scoreRaw = front.completeness_score;
+    const score = typeof scoreRaw === 'string' && scoreRaw.trim() !== '' ? Number(scoreRaw) : NaN;
+    // D-19: a Completed session must have zero unconfirmed markers.
+    if (status === SESSION_STATUS.COMPLETED && markers > 0) {
+        violations.push({ session: name, reason: 'completed_with_unconfirmed', markers });
+    }
+    // D-18/D-19: a score of 100 may never count unconfirmed topics — markers
+    // remain (any status) or the session never left Pre-Filled.
+    if ((markers > 0 && score === 100) || (status === SESSION_STATUS.PRE_FILLED && score === 100)) {
+        violations.push({ session: name, reason: 'score_counts_unconfirmed', score: 100, markers });
+    }
+    return violations;
+}
+// ─── Confidential backstop (D-22) ─────────────────────────────────────────────
+/**
+ * Ask git for tracked files under the confidential directory. Array args,
+ * fixed literal path, no shell, bounded timeout (threat T-02-04; T-01-08
+ * precedent). Any failure — non-git directory, missing git binary, timeout —
+ * degrades to zero tracked files with git flagged unavailable: a non-git
+ * project cannot track anything (Pitfall 4).
+ */
+function findTrackedConfidentialInternal(cwd) {
+    try {
+        const stdout = (0, node_child_process_1.execFileSync)('git', ['ls-files', '--', CONFIDENTIAL_DIR], {
+            cwd,
+            encoding: 'utf-8',
+            timeout: GIT_TIMEOUT_MS,
+            windowsHide: true, // #685: no console-window flash on Windows
+        });
+        return { files: stdout.split(/\r?\n/).map(l => l.trim()).filter(Boolean), git: 'ok' };
+    }
+    catch {
+        return { files: [], git: 'unavailable' };
+    }
+}
+/** Public form of the D-22 backstop: tracked confidential paths, [] when none or non-git. */
+function findTrackedConfidential(cwd) {
+    return findTrackedConfidentialInternal(cwd).files;
+}
+// ─── Package aggregation ──────────────────────────────────────────────────────
+/**
+ * Aggregate the full input-package check for a project root: every
+ * `.planning/discovery/session-NN.md` runs through checkSessionContent, and
+ * each git-tracked confidential file appends a confidential_tracked
+ * violation — except the one designed path, the backstop `.gitignore`
+ * itself (exact-path exemption, UAT gap 1 / D-22). Missing discovery dir →
+ * ok:true with sessions_checked 0.
+ */
+function checkInputPackage(cwd) {
+    const violations = [];
+    let names = [];
+    try {
+        names = node_fs_1.default.readdirSync(node_path_1.default.join(cwd, DISCOVERY_DIR));
+    }
+    catch {
+        names = []; // no input package — graceful arm (Pitfall 4)
+    }
+    const sessions = names.filter(n => SESSION_FILE_RE.test(n)).sort();
+    let prefilled = 0;
+    for (const name of sessions) {
+        let content = '';
+        try {
+            content = node_fs_1.default.readFileSync(node_path_1.default.join(cwd, DISCOVERY_DIR, name), 'utf-8');
+        }
+        catch {
+            continue; // unreadable session: nothing to scan, nothing to fail on
+        }
+        const front = fm.extractFrontmatter(content);
+        const status = typeof front.status === 'string' ? front.status : '';
+        const mode = typeof front.mode === 'string' ? front.mode : '';
+        if (status === SESSION_STATUS.PRE_FILLED || mode === 'pre-fill')
+            prefilled += 1;
+        violations.push(...checkSessionContent(name, content));
+    }
+    const tracked = findTrackedConfidentialInternal(cwd);
+    for (const file of tracked.files) {
+        // Violation-policy exemption, not a git-truth change: findTrackedConfidential
+        // still reports the backstop path; only the exact designed path is skipped.
+        if (file === CONFIDENTIAL_BACKSTOP)
+            continue;
+        violations.push({ file, reason: 'confidential_tracked' });
+    }
+    const summary = {
+        sessions_checked: sessions.length,
+        prefilled,
+        git: tracked.git,
+    };
+    if (violations.length > 0)
+        return { ok: false, violations, ...summary };
+    return { ok: true, ...summary };
+}
+// ─── CLI adapter ──────────────────────────────────────────────────────────────
+/** One content-free line per violation: path + structured reason + counts (T-02-05). */
+function formatViolation(v) {
+    if (v.reason === 'confidential_tracked') {
+        return `  ${v.file}: confidential_tracked`;
+    }
+    const score = v.reason === 'score_counts_unconfirmed' ? `score: ${v.score}, ` : '';
+    return `  ${v.session}: ${v.reason} (${score}markers: ${v.markers})`;
+}
+/**
+ * CLI adapter for `pp-tools discovery input-check` (dotted form
+ * `pp-tools query discovery.input-check`).
+ *
+ * Exit semantics (D-19/D-22): any violation exits non-zero via
+ * ERROR_REASON.DISCOVERY_INPUT_CHECK_FAILED, naming each violation by path
+ * and reason — never file contents. A clean run exits 0 with
+ * { ok, sessions_checked, prefilled, git }. The command takes no positional
+ * path argument — fixed convention paths resolve against cwd, eliminating
+ * the traversal surface entirely (T-02-08).
+ */
+function cmdDiscoveryInputCheck(cwd, args, raw) {
+    // args arrive shaped ['discovery', 'input-check', ...]; global output
+    // flags are consumed by the dispatcher, so anything left is a usage error.
+    if (args.slice(2).length > 0) {
+        error('Usage: pp-tools discovery input-check', ERROR_REASON.USAGE);
+        return; // unreachable — error() exits
+    }
+    const result = checkInputPackage(cwd);
+    if (!result.ok) {
+        const lines = result.violations.map(formatViolation).join('\n');
+        error(`discovery input-check: ${result.violations.length} violation(s):\n${lines}`, ERROR_REASON.DISCOVERY_INPUT_CHECK_FAILED);
+        return; // unreachable — error() exits
+    }
+    output({
+        ok: true,
+        sessions_checked: result.sessions_checked,
+        prefilled: result.prefilled,
+        git: result.git,
+    }, raw);
+}
+module.exports = {
+    SESSION_STATUS,
+    TO_CONFIRM_MARKER,
+    checkSessionContent,
+    findTrackedConfidential,
+    checkInputPackage,
+    cmdDiscoveryInputCheck,
+};