@praneeth_54/agentdoctor 2.1.0 → 3.0.1

package/dist/cli/commands/start.js

@@ -0,0 +1,86 @@
+import { EXIT_CODES } from "../../types/index.js";
+import { initBrainStore, rebuildBrain, getBrainStatus } from "../../core/brain-cli/service.js";
+import { discoverProjectRoots } from "../../product/discovery/roots.js";
+import { buildProjectDna, persistProjectDna } from "../../product/dna/build.js";
+import { resolveRepoRoot } from "../../utils/path.js";
+import { resolveCliProjectRoot } from "../safe-root.js";
+function printJson(value) {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+export async function runStartCommand(options) {
+    const prefer = options.select ?? options.root;
+    const discovery = await discoverProjectRoots({
+        cwd: prefer ? resolveRepoRoot(prefer) : process.cwd(),
+        ...(prefer ? { prefer: resolveRepoRoot(prefer) } : {}),
+        ...(options.maxEntries !== undefined ? { maxEntries: options.maxEntries } : {}),
+        autoSelect: !options.listOnly,
+    });
+    if (options.listOnly || discovery.blocked || !discovery.selected) {
+        if (options.json) {
+            printJson({ discovery, dna: null, brain: null });
+            return discovery.blocked ? EXIT_CODES.USAGE_ERROR : EXIT_CODES.SUCCESS;
+        }
+        if (discovery.blocked) {
+            process.stderr.write(`Blocked: ${discovery.blockReason}\n`);
+            return EXIT_CODES.USAGE_ERROR;
+        }
+        process.stdout.write("Project candidates:\n");
+        if (discovery.candidates.length === 0) {
+            process.stdout.write("  (none found — navigate into a project or pass a path)\n");
+            return EXIT_CODES.USAGE_ERROR;
+        }
+        for (const [i, c] of discovery.candidates.entries()) {
+            process.stdout.write(`  [${i + 1}] ${c.root}\n      score=${c.score} markers=${c.markers.join(", ")} (${c.reason})\n`);
+        }
+        process.stdout.write("\nRe-run with --select <path> to initialize that project.\n");
+        return EXIT_CODES.SUCCESS;
+    }
+    const root = discovery.selected.root;
+    const dna = await persistProjectDna(root);
+    let brainStatus = null;
+    if (options.initBrain !== false) {
+        brainStatus = await initBrainStore(root);
+        if (options.rebuildBrain) {
+            await rebuildBrain(root);
+            brainStatus = await getBrainStatus(root);
+        }
+    }
+    const payload = { discovery, dna, brain: brainStatus };
+    if (options.json) {
+        printJson(payload);
+    }
+    else {
+        process.stdout.write(`AgentDoctor start\n`);
+        process.stdout.write(`  root: ${root}\n`);
+        process.stdout.write(`  fingerprint: ${dna.fingerprint}\n`);
+        process.stdout.write(`  type: ${dna.projectType}\n`);
+        process.stdout.write(`  languages: ${dna.languages.join(", ") || "(none)"}\n`);
+        process.stdout.write(`  frameworks: ${dna.frameworks.join(", ") || "(none)"}\n`);
+        process.stdout.write(`  files: ${dna.counts.files} (source ${dna.counts.sourceFiles}, tests ${dna.counts.testFiles})\n`);
+        if (brainStatus) {
+            process.stdout.write(`  brain: ${brainStatus.hasSnapshot ? `snapshot ${brainStatus.latestSnapshotId}` : "initialized (no snapshot yet — run with --rebuild-brain or brain rebuild)"}\n`);
+        }
+        process.stdout.write(`  DNA written to .agentdoctor/dna/project-dna.json\n`);
+    }
+    return EXIT_CODES.SUCCESS;
+}
+export async function runDnaCommand(options) {
+    const gated = await resolveCliProjectRoot(options.root);
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
+    const root = gated.root;
+    const dna = options.persist ? await persistProjectDna(root) : await buildProjectDna(root);
+    if (options.json) {
+        printJson(dna);
+    }
+    else {
+        process.stdout.write(`Project DNA: ${dna.name} (${dna.fingerprint})\n`);
+        process.stdout.write(`  type: ${dna.projectType}\n`);
+        process.stdout.write(`  languages: ${dna.languages.join(", ") || "(none)"}\n`);
+        process.stdout.write(`  frameworks: ${dna.frameworks.join(", ") || "(none)"}\n`);
+        process.stdout.write(`  monorepo: ${dna.monorepo.isMonorepo ? dna.monorepo.tool : "no"}\n`);
+    }
+    return EXIT_CODES.SUCCESS;
+}

package/dist/cli/commands/v2.js

@@ -1,5 +1,5 @@
 import { EXIT_CODES } from "../../types/index.js";
-import { resolveRepoRoot } from "../../utils/path.js";
+import { resolveCliProjectRoot } from "../safe-root.js";
 import { analyzeChanges } from "../../core/changes/analyze.js";
 import { analyzeContextHealth } from "../../core/context-health/analyze.js";
 import { scanSecrets } from "../../core/secrets/scan.js";
@@ -16,7 +16,12 @@ function printJson(value) {
     process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 export async function runChangesCommand(options) {
-    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const gated = await resolveCliProjectRoot(options.root ?? process.cwd());
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
+    const root = gated.root;
     const report = await analyzeChanges({
         root,
         ...(options.since ? { since: options.since } : {}),
@@ -38,7 +43,12 @@ export async function runChangesCommand(options) {
     return EXIT_CODES.SUCCESS;
 }
 export async function runContextHealthCommand(options) {
-    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const gated = await resolveCliProjectRoot(options.root ?? process.cwd());
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
+    const root = gated.root;
     const report = await analyzeContextHealth(root);
     if (options.json)
         printJson(report);
@@ -51,7 +61,12 @@ export async function runContextHealthCommand(options) {
     return EXIT_CODES.SUCCESS;
 }
 export async function runSecretsCommand(options) {
-    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const gated = await resolveCliProjectRoot(options.root ?? process.cwd());
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
+    const root = gated.root;
     const report = await scanSecrets({ root, enabled: true });
     if (options.json)
         printJson(report);
@@ -67,8 +82,13 @@ export async function runSecretsCommand(options) {
 }
 export async function runFixUndoCommand(options) {
     try {
+        const gated = await resolveCliProjectRoot(options.root);
+        if (!gated.ok) {
+            console.error(`Error: ${gated.message}`);
+            return gated.code;
+        }
         const record = await undoFix({
-            root: resolveRepoRoot(options.root ?? process.cwd()),
+            root: gated.root,
             auditId: options.auditId,
         });
         process.stdout.write(`Undid Safe Fix audit ${options.auditId} → undo audit ${record.id}\n`);
@@ -80,7 +100,12 @@ export async function runFixUndoCommand(options) {
     }
 }
 export async function runFixHistoryCommand(options) {
-    const audits = await listFixAudits(resolveRepoRoot(options.root ?? process.cwd()));
+    const gated = await resolveCliProjectRoot(options.root);
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
+    const audits = await listFixAudits(gated.root);
     if (options.json)
         printJson({ audits });
     else if (audits.length === 0)
@@ -93,7 +118,12 @@ export async function runFixHistoryCommand(options) {
     return EXIT_CODES.SUCCESS;
 }
 export async function runBaselineCommand(options) {
-    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const gated = await resolveCliProjectRoot(options.root ?? process.cwd());
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
+    const root = gated.root;
     try {
         if (options.action === "list") {
             const names = await listNamedBaselines(root);
@@ -167,7 +197,12 @@ export async function runBaselineCommand(options) {
     }
 }
 export async function runPackagesCommand(options) {
-    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const gated = await resolveCliProjectRoot(options.root ?? process.cwd());
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
+    const root = gated.root;
     const mono = await detectMonorepo(root);
     if (!options.scan) {
         if (options.json)
@@ -200,8 +235,13 @@ export async function runPackagesCommand(options) {
     return EXIT_CODES.SUCCESS;
 }
 export async function runPrReviewCommand(options) {
+    const gated = await resolveCliProjectRoot(options.root);
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
     const report = await analyzePullRequest({
-        root: resolveRepoRoot(options.root ?? process.cwd()),
+        root: gated.root,
         dryRun: true,
         ...(options.base ? { baseRef: options.base } : {}),
     });
@@ -215,8 +255,13 @@ export async function runPrReviewCommand(options) {
 }
 export async function runDashboardCommand(options) {
     try {
+        const gated = await resolveCliProjectRoot(options.root);
+        if (!gated.ok) {
+            console.error(`Error: ${gated.message}`);
+            return gated.code;
+        }
         const server = await startDashboardServer({
-            root: resolveRepoRoot(options.root ?? process.cwd()),
+            root: gated.root,
             host: options.host ?? "127.0.0.1",
             port: options.port ?? 8787,
             readOnly: true,
@@ -237,7 +282,12 @@ export async function runDashboardCommand(options) {
     }
 }
 export async function runPluginsCommand(options) {
-    const root = resolveRepoRoot(options.root ?? process.cwd());
+    const gated = await resolveCliProjectRoot(options.root);
+    if (!gated.ok) {
+        console.error(`Error: ${gated.message}`);
+        return gated.code;
+    }
+    const root = gated.root;
     const plugins = await discoverPlugins(root);
     const analyzerResults = options.run ? await runPluginAnalyzers(root) : undefined;
     if (options.json) {

package/dist/cli/commands/verify.js

@@ -1,5 +1,6 @@
 import { evaluateVerifyPolicy } from "../../core/policy/evaluate.js";
 import { verify } from "../../core/verify/verify.js";
+import { classifyBroadUserScanRoot } from "../../product/discovery/roots.js";
 import { emitGithubReports } from "../../reporters/github/emit.js";
 import { renderVerifyJsonReport } from "../../reporters/verify/json.js";
 import { renderVerifyTerminalReport } from "../../reporters/verify/terminal.js";
@@ -15,6 +16,11 @@ export async function runVerifyCommand(options) {
         console.error(`Error: not a directory: ${target}`);
         return EXIT_CODES.USAGE_ERROR;
     }
+    const broad = classifyBroadUserScanRoot(target);
+    if (broad.blocked) {
+        console.error(`Error: ${broad.reason}`);
+        return EXIT_CODES.USAGE_ERROR;
+    }
     try {
         const result = await verify({
             cwd: target,

package/dist/cli/program.js

@@ -20,6 +20,8 @@ import { runWorkspaceCommand } from "./commands/workspace.js";
 import { runAskCommand, runChatCommand } from "./commands/chat.js";
 import { runAgentCommand, runPlanCommand } from "./commands/agent.js";
 import { runLearnCommand } from "./commands/learn.js";
+import { runProductCommand } from "./commands/product.js";
+import { runStartCommand, runDnaCommand } from "./commands/start.js";
 import { collectOpsHealth } from "../ops/health.js";
 import { listSessions, loadSession } from "../platform/sessions/store.js";
 import { exportReports } from "../platform/reports/export.js";
@@ -1282,6 +1284,7 @@ export function createProgram() {
         .option("--list-tools", "List available agent tools", false)
         .option("--tool <name>", "Run a single tool by name")
         .option("--goal <text>", "Build a change plan for this goal")
+        .option("--role <role>", "Specialized role for plan/apply (planner, coder, tester, reviewer, security, …)")
         .option("--approve", "Record explicit human approval", false)
         .option("--apply", "Apply approved changes (requires --approve)", false)
         .option("--apply-ops <json>", "JSON array of {name, arguments} tool ops for --apply")
@@ -1294,6 +1297,7 @@ export function createProgram() {
             listTools: Boolean(options.listTools),
             ...(options.tool !== undefined ? { tool: options.tool } : {}),
             ...(options.goal !== undefined ? { goal: options.goal } : {}),
+            ...(options.role !== undefined ? { role: options.role } : {}),
             approve: Boolean(options.approve),
             apply: Boolean(options.apply),
             ...(options.applyOps !== undefined ? { applyOpsJson: options.applyOps } : {}),
@@ -1543,6 +1547,143 @@ export function createProgram() {
         const code = await runExplainCommand(rule);
         process.exitCode = code;
     });
+    function bindProductCommand(name, description, action) {
+        program
+            .command(name)
+            .description(description)
+            .argument("[path]", "Repository path")
+            .option("--json", "Emit JSON report", false)
+            .action(async (pathArg, _options, command) => {
+            const options = command.optsWithGlobals();
+            process.exitCode = await runProductCommand({
+                action,
+                root: resolveTargetArgument(pathArg),
+                json: Boolean(options.json),
+            });
+        });
+    }
+    program
+        .command("start")
+        .description("Safe project discovery: detect project root, build Project DNA, initialize Project Brain")
+        .argument("[path]", "Optional project path (default: cwd)")
+        .option("--list", "List candidates without initializing", false)
+        .option("--select <path>", "Explicitly select a project root")
+        .option("--max-entries <n>", "Refuse scans larger than this entry budget", "25000")
+        .option("--no-init-brain", "Skip Project Brain store initialization")
+        .option("--rebuild-brain", "Compile Project Brain after init", false)
+        .option("--json", "Emit JSON", false)
+        .action(async (pathArg, options) => {
+        process.exitCode = await runStartCommand({
+            ...(pathArg !== undefined ? { root: resolveTargetArgument(pathArg) } : {}),
+            listOnly: Boolean(options.list),
+            ...(options.select !== undefined ? { select: options.select } : {}),
+            maxEntries: Number(options.maxEntries ?? 25000),
+            initBrain: options.initBrain !== false,
+            rebuildBrain: Boolean(options.rebuildBrain),
+            json: Boolean(options.json),
+        });
+    });
+    program
+        .command("dna")
+        .description("Build deterministic Project DNA fingerprint")
+        .argument("[path]", "Repository path")
+        .option("--persist", "Write .agentdoctor/dna/project-dna.json", false)
+        .option("--json", "Emit JSON", false)
+        .action(async (pathArg, options) => {
+        process.exitCode = await runDnaCommand({
+            root: resolveTargetArgument(pathArg),
+            persist: Boolean(options.persist),
+            json: Boolean(options.json),
+        });
+    });
+    bindProductCommand("requirements", "Trace requirements from markdown docs (evidence-backed)", "requirements");
+    bindProductCommand("api", "Discover HTTP route patterns (regex evidence)", "api");
+    bindProductCommand("database", "Discover schema objects from migrations/SQL/Prisma", "database");
+    bindProductCommand("events", "Detect queues, workers, cron, and event markers", "events");
+    bindProductCommand("dependency", "Analyze direct dependencies and workspace duplicates", "dependency");
+    bindProductCommand("deps", "Alias for dependency", "dependency");
+    bindProductCommand("health-code", "Aggregate code health indicators with evidence", "health-code");
+    bindProductCommand("code-health", "Alias for health-code", "health-code");
+    bindProductCommand("map", "Build navigable software map from project layout", "map");
+    bindProductCommand("decisions", "Load ADR files and decision ledger", "decisions");
+    bindProductCommand("forensic", "Read-only forensic analysis (git + ledgers + brain)", "forensic");
+    bindProductCommand("twin", "Software digital twin snapshot", "twin");
+    bindProductCommand("eval-lab", "Run evaluation lab fixture checks", "eval-lab");
+    bindProductCommand("self-check", "Self-diagnosis of AgentDoctor installation", "self-check");
+    bindProductCommand("infra", "Detect Docker/K8s/Terraform/CI artifacts", "infra");
+    bindProductCommand("incident", "Build incident timeline hypotheses", "incident");
+    bindProductCommand("security-doctor", "Security heuristics: secrets, auth markers, dangerous patterns", "security-doctor");
+    bindProductCommand("test-brain", "Test Brain: test-impact plus graph file↔test mapping", "test-brain");
+    bindProductCommand("privacy-doctor", "PII-ish pattern scan (not legal compliance)", "privacy-doctor");
+    bindProductCommand("tech-debt", "Technical debt roadmap (TODO/FIXME, architecture, tests)", "tech-debt");
+    bindProductCommand("features", "Feature intelligence (flows + API links)", "features");
+    bindProductCommand("evolution", "Software evolution timeline from git + ledger", "evolution");
+    bindProductCommand("org", "Load organization model (.agentdoctor/org)", "org");
+    program
+        .command("memory")
+        .description("Query institutional memory (brain + ledgers)")
+        .argument("<query>", "Memory query")
+        .argument("[path]", "Repository path")
+        .option("--json", "Emit JSON report", false)
+        .action(async (query, pathArg, _options, command) => {
+        const options = command.optsWithGlobals();
+        process.exitCode = await runProductCommand({
+            action: "memory",
+            query,
+            root: resolveTargetArgument(pathArg),
+            json: Boolean(options.json),
+        });
+    });
+    program
+        .command("search")
+        .description("Search symbols and concepts (brain + bounded file scan)")
+        .argument("<query>", "Search query")
+        .argument("[path]", "Repository path")
+        .option("--json", "Emit JSON report", false)
+        .action(async (query, pathArg, _options, command) => {
+        const options = command.optsWithGlobals();
+        process.exitCode = await runProductCommand({
+            action: "search",
+            query,
+            root: resolveTargetArgument(pathArg),
+            json: Boolean(options.json),
+        });
+    });
+    program
+        .command("role-agent")
+        .description("Run the coding loop with a specialized agent role")
+        .argument("[path]", "Repository path")
+        .requiredOption("--role <role>", "Agent role (planner, coder, tester, reviewer, security, …)")
+        .requiredOption("--goal <text>", "Goal for the role agent")
+        .option("--approve", "Record human approval for writes", false)
+        .option("--apply", "Apply changes (requires --approve)", false)
+        .option("--json", "Emit JSON", false)
+        .action(async (pathArg, options) => {
+        process.exitCode = await runProductCommand({
+            action: "role-agent",
+            root: resolveTargetArgument(pathArg),
+            role: options.role,
+            goal: options.goal,
+            approve: Boolean(options.approve),
+            apply: Boolean(options.apply),
+            json: Boolean(options.json),
+        });
+    });
+    program
+        .command("what-if")
+        .description("Graph-backed change impact for a file or symbol")
+        .argument("<target>", "File path or symbol")
+        .argument("[path]", "Repository path")
+        .option("--json", "Emit JSON report", false)
+        .action(async (target, pathArg, _options, command) => {
+        const options = command.optsWithGlobals();
+        process.exitCode = await runProductCommand({
+            action: "what-if",
+            root: resolveTargetArgument(pathArg),
+            target,
+            json: Boolean(options.json),
+        });
+    });
     program
         .command("doctor")
         .description("Check AgentDoctor installation health")

package/dist/cli/safe-root.d.ts

@@ -0,0 +1,17 @@
+import { type ExitCode } from "../types/index.js";
+export type CliRootOk = {
+    ok: true;
+    root: string;
+};
+export type CliRootErr = {
+    ok: false;
+    message: string;
+    code: ExitCode;
+};
+/**
+ * Resolve a CLI project root and refuse home / Desktop / Downloads / Documents
+ * (and similarly broad user folders) before any recursive intelligence work.
+ */
+export declare function resolveCliProjectRoot(pathArg?: string): Promise<CliRootOk | CliRootErr>;
+/** Sync variant when the path is already known to exist (tests / internal). */
+export declare function assertCliProjectRootSync(pathArg?: string): CliRootOk | CliRootErr;

package/dist/cli/safe-root.js

@@ -0,0 +1,32 @@
+import { classifyBroadUserScanRoot } from "../product/discovery/roots.js";
+import { EXIT_CODES } from "../types/index.js";
+import { isDirectory } from "../utils/fs.js";
+import { resolveRepoRoot } from "../utils/path.js";
+/**
+ * Resolve a CLI project root and refuse home / Desktop / Downloads / Documents
+ * (and similarly broad user folders) before any recursive intelligence work.
+ */
+export async function resolveCliProjectRoot(pathArg) {
+    const root = resolveRepoRoot(pathArg ?? process.cwd());
+    if (!(await isDirectory(root))) {
+        return {
+            ok: false,
+            message: `not a directory: ${root}`,
+            code: EXIT_CODES.USAGE_ERROR,
+        };
+    }
+    const broad = classifyBroadUserScanRoot(root);
+    if (broad.blocked) {
+        return { ok: false, message: broad.reason, code: EXIT_CODES.USAGE_ERROR };
+    }
+    return { ok: true, root };
+}
+/** Sync variant when the path is already known to exist (tests / internal). */
+export function assertCliProjectRootSync(pathArg) {
+    const root = resolveRepoRoot(pathArg ?? process.cwd());
+    const broad = classifyBroadUserScanRoot(root);
+    if (broad.blocked) {
+        return { ok: false, message: broad.reason, code: EXIT_CODES.USAGE_ERROR };
+    }
+    return { ok: true, root };
+}

package/dist/constants.d.ts

@@ -1,5 +1,5 @@
 import type { AgentId } from "./types/index.js";
-export declare const PACKAGE_VERSION = "2.1.0";
+export declare const PACKAGE_VERSION = "3.0.1";
 export declare const DEFAULT_MAX_FILE_SIZE_BYTES: number;
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export declare const DEFAULT_IGNORE_DIRECTORIES: Set<string>;

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const PACKAGE_VERSION = "2.1.0";
+export const PACKAGE_VERSION = "3.0.1";
 export const DEFAULT_MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024; // 2 MiB
 /** Directories skipped during normal discovery (unless a rule needs them later). */
 export const DEFAULT_IGNORE_DIRECTORIES = new Set([

package/dist/core/brain-cli/service.js

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { LocalBrainStore, createBrainQueryEngine, redactBrainForStorage, } from "../understanding/brain/index.js";
 import { compileProjectBrain } from "../../mcp/brain/compile.js";
+import { OWNERSHIP_BOUNDARY_VERSION } from "../../project/ownership.js";
 import { resolveRepoRoot } from "../../utils/path.js";
 import { isDirectory } from "../../utils/fs.js";
 function storeFor(root) {
@@ -16,11 +17,13 @@ export async function getBrainStatus(root) {
     const storeRoot = path.join(resolved, ".agentdoctor", "project-brain");
     try {
         const meta = await store.readMeta();
+        const boundaryOk = meta.ownershipBoundaryVersion === OWNERSHIP_BOUNDARY_VERSION;
+        const hasUsableLatest = boundaryOk && meta.latestSnapshotId !== null;
         return {
             root: resolved,
             storeRoot,
-            hasSnapshot: meta.latestSnapshotId !== null,
-            latestSnapshotId: meta.latestSnapshotId,
+            hasSnapshot: hasUsableLatest,
+            latestSnapshotId: hasUsableLatest ? meta.latestSnapshotId : null,
             snapshotCount: meta.snapshots.length,
             projectName: meta.projectName || null,
             schemaVersion: meta.schemaVersion || null,

package/dist/core/monorepo/detect.js

@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { classifyRelativePathOwnership, isUnderNestedRepository } from "../../project/ownership.js";
 import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
 async function readJson(file) {
     try {
@@ -99,6 +100,15 @@ export async function detectMonorepo(rootInput) {
                 continue;
             if (seen.has(pkg.absolutePath))
                 continue;
+            const ownership = classifyRelativePathOwnership(pkg.relativePath);
+            if (ownership !== "project_owned") {
+                limitations.push(`Skipped non-owned workspace package: ${pkg.relativePath} (${ownership})`);
+                continue;
+            }
+            if (await isUnderNestedRepository(root, pkg.absolutePath)) {
+                limitations.push(`Skipped nested-repository workspace package: ${pkg.relativePath}`);
+                continue;
+            }
             seen.add(pkg.absolutePath);
             packages.push(pkg);
         }

package/dist/core/secrets/scan.js

@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { decideDirectoryTraversal } from "../../project/ownership.js";
 import { readTextFile } from "../../utils/fs.js";
 import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
 const SECRET_PATTERNS = [
@@ -94,6 +95,14 @@ async function walkFiles(root, dir, out, limit) {
         if (entry.isSymbolicLink())
             continue;
         if (entry.isDirectory()) {
+            const relativeDir = toPosixRelative(root, absolute);
+            const traversal = await decideDirectoryTraversal({
+                projectRoot: root,
+                absoluteDir: absolute,
+                relativeDir,
+            });
+            if (!traversal.traverse)
+                continue;
             await walkFiles(root, absolute, out, limit);
             continue;
         }

package/dist/core/understanding/brain/storage/store.d.ts

@@ -9,6 +9,8 @@ export interface SnapshotMeta {
     projectName: string;
     brainId: string;
     checksum: string;
+    /** Snapshots without this stamp (or with a mismatch) must not be served as current truth. */
+    ownershipBoundaryVersion?: number;
 }
 export interface BrainStoreMeta {
     storageFormatVersion: BrainStorageFormatVersion;
@@ -16,6 +18,8 @@ export interface BrainStoreMeta {
     projectName: string;
     latestSnapshotId: string | null;
     snapshots: SnapshotMeta[];
+    /** When missing or mismatched, latest brain is treated as stale vs current ownership rules. */
+    ownershipBoundaryVersion?: number;
 }
 export interface SnapshotComparison {
     leftId: string;

package/dist/core/understanding/brain/storage/store.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { atomicWriteTextFile } from "../../../../utils/fs.js";
+import { OWNERSHIP_BOUNDARY_VERSION } from "../../../../project/ownership.js";
 import { parseBrainDelta, serializeBrainDelta } from "../delta.js";
 import { checkBrainCompatibility, migrateBrain } from "../migrate.js";
 import { assertBrainContract } from "../contract.js";
@@ -198,6 +199,7 @@ export class LocalBrainStore {
             projectName: brain.metadata.projectName,
             brainId: brain.metadata.brainId,
             checksum: nextChecksum,
+            ownershipBoundaryVersion: OWNERSHIP_BOUNDARY_VERSION,
         };
         const meta = await this.readMeta();
         const snapshots = meta.snapshots.filter((s) => s.id !== snapshotId);
@@ -209,10 +211,15 @@ export class LocalBrainStore {
             projectName: brain.metadata.projectName,
             latestSnapshotId: snapshotId,
             snapshots,
+            ownershipBoundaryVersion: OWNERSHIP_BOUNDARY_VERSION,
         });
         return snapMeta;
     }
     async loadSnapshot(snapshotId) {
+        const meta = await this.readMeta();
+        if (meta.ownershipBoundaryVersion !== OWNERSHIP_BOUNDARY_VERSION) {
+            throw new BrainStorageError(`brain store ownership boundary is stale (have ${String(meta.ownershipBoundaryVersion ?? "missing")}, need ${OWNERSHIP_BOUNDARY_VERSION}); rebuild required`);
+        }
         const target = await assertInsideRootResolved(this.root, this.brainPath(snapshotId));
         let raw;
         try {
@@ -224,9 +231,17 @@ export class LocalBrainStore {
             }
             throw error;
         }
-        const meta = await this.readMeta();
         const snap = meta.snapshots.find((s) => s.id === snapshotId);
         if (snap) {
+            if (snap.ownershipBoundaryVersion !== undefined &&
+                snap.ownershipBoundaryVersion !== OWNERSHIP_BOUNDARY_VERSION) {
+                throw new BrainStorageError(`snapshot ${snapshotId} ownership boundary is stale (have ${snap.ownershipBoundaryVersion}, need ${OWNERSHIP_BOUNDARY_VERSION}); rebuild required`);
+            }
+            // Pre-stamp snapshots created before ownershipBoundaryVersion was recorded are
+            // unsafe to serve once the store claims a current boundary — require rebuild.
+            if (snap.ownershipBoundaryVersion === undefined) {
+                throw new BrainStorageError(`snapshot ${snapshotId} missing ownershipBoundaryVersion; rebuild required`);
+            }
             const actual = checksumPayload(raw);
             if (actual !== snap.checksum) {
                 throw new BrainStorageError(`checksum mismatch for snapshot ${snapshotId}`);
@@ -261,7 +276,12 @@ export class LocalBrainStore {
         return meta.latestSnapshotId;
     }
     async loadLatest() {
-        const id = await this.latestSnapshotId();
+        const meta = await this.readMeta();
+        if (meta.ownershipBoundaryVersion !== OWNERSHIP_BOUNDARY_VERSION) {
+            // Pre-boundary or outdated snapshots must not be served as current project truth.
+            return null;
+        }
+        const id = meta.latestSnapshotId;
         if (!id) {
             return null;
         }

package/dist/dashboard/page.d.ts

@@ -0,0 +1,2 @@
+/** Embedded dashboard HTML. Version injected only from PACKAGE_VERSION. */
+export declare function htmlPage(): string;