@praneeth_54/agentdoctor 3.0.0 → 3.0.1

package/dist/intelligence/graph/build.js

@@ -1,7 +1,7 @@
-import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import ts from "typescript";
+import { discoverFiles } from "../../discovery/files.js";
 import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
 import { buildRepositoryGraph } from "../../platform/graph/build.js";
 import { CONTRACTS_VERSION } from "../../contracts/index.js";
@@ -45,35 +45,15 @@ async function applyLanguageEnrichment(graph, root) {
     }
 }
 export async function listTsFiles(root, limit = 400) {
-    const out = [];
-    const skip = new Set(["node_modules", ".git", "dist", "coverage", ".agentdoctor", "vendor"]);
-    async function walk(dir) {
-        if (out.length >= limit)
-            return;
-        let entries;
-        try {
-            entries = await fs.readdir(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const e of entries) {
-            if (skip.has(e.name))
-                continue;
-            const abs = path.join(dir, e.name);
-            if (e.isSymbolicLink())
-                continue;
-            if (e.isDirectory()) {
-                await walk(abs);
-                continue;
-            }
-            if (/\.(ts|tsx|mts|cts)$/i.test(e.name) && !e.name.endsWith(".d.ts")) {
-                out.push(abs);
-            }
-        }
-    }
-    await walk(root);
-    return out.sort();
+    const discovered = await discoverFiles({ root });
+    return discovered.files
+        .filter((f) => {
+        const name = path.basename(f.relativePath);
+        return /\.(ts|tsx|mts|cts)$/i.test(name) && !name.endsWith(".d.ts");
+    })
+        .map((f) => f.absolutePath)
+        .sort()
+        .slice(0, limit);
 }
 /**
  * TypeScript compiler API based graph enrichment.

package/dist/intelligence/graph/incremental.d.ts

@@ -12,6 +12,8 @@ export interface GraphSnapshot {
     nodes: GraphNode[];
     edges: GraphEdge[];
     limitations: string[];
+    /** Reject cached graphs built under a prior ownership boundary. */
+    ownershipBoundaryVersion?: number;
 }
 export interface GraphStatus {
     present: boolean;

package/dist/intelligence/graph/incremental.js

@@ -3,6 +3,7 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { PACKAGE_VERSION } from "../../constants.js";
+import { OWNERSHIP_BOUNDARY_VERSION } from "../../project/ownership.js";
 import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
 import { atomicWriteTextFile } from "../../utils/fs.js";
 import { buildIntelligenceGraph, listTsFiles } from "./build.js";
@@ -75,6 +76,13 @@ async function loadSnapshot(root) {
         if (!isValidSnapshot(parsed)) {
             return { ok: false, corrupt: true, error: "index.json failed schema checks" };
         }
+        if (parsed.ownershipBoundaryVersion !== OWNERSHIP_BOUNDARY_VERSION) {
+            return {
+                ok: false,
+                corrupt: false,
+                error: `graph index ownership boundary is stale (have ${String(parsed.ownershipBoundaryVersion ?? "missing")}, need ${OWNERSHIP_BOUNDARY_VERSION})`,
+            };
+        }
         return { ok: true, snapshot: parsed };
     }
     catch (error) {
@@ -109,6 +117,7 @@ async function buildAndPersist(root, mode = "auto") {
             ...graph.limitations,
             "Incremental index persists file hashes for change detection",
         ],
+        ownershipBoundaryVersion: OWNERSHIP_BOUNDARY_VERSION,
     };
     const saved = await persistSnapshot(root, snapshot);
     return { snapshot, path: saved };

package/dist/mcp/intelligence/path-safety.d.ts

@@ -4,6 +4,11 @@ export { tryDecodeUriComponent };
  * Validate a user-supplied repository-relative or in-repo target.
  * Returns a normalized path relative to root (POSIX) when the target is path-like and safe,
  * or null when the target is treated as a non-path identifier (graph id / label).
- * Throws a safe Error (no outside path leakage) when a path-like target escapes the root.
+ * Throws a safe Error (no outside path leakage) when a path-like target escapes the root
+ * or is outside project ownership (.private, AgentDoctorOS, fixtures, validation).
  */
 export declare function assertSafeRepoTarget(root: string, rawTarget: string): string | null;
+/**
+ * Async ownership gate including nested-repository ancestry (for MCP file-path tools).
+ */
+export declare function assertSafeOwnedRepoTarget(root: string, rawTarget: string): Promise<string | null>;

package/dist/mcp/intelligence/path-safety.js

@@ -1,4 +1,6 @@
 import path from "node:path";
+import fs from "node:fs";
+import { assertProjectOwnedRepoPath, classifyRelativePathOwnership, ProjectOwnershipError, } from "../../project/ownership.js";
 import { PathEscapeError, rejectHostilePathInput, resolveSafeRepoPath, tryDecodeUriComponent, } from "../../security/paths.js";
 import { sanitizeForOutput } from "../../utils/path.js";
 export { tryDecodeUriComponent };
@@ -6,7 +8,8 @@ export { tryDecodeUriComponent };
  * Validate a user-supplied repository-relative or in-repo target.
  * Returns a normalized path relative to root (POSIX) when the target is path-like and safe,
  * or null when the target is treated as a non-path identifier (graph id / label).
- * Throws a safe Error (no outside path leakage) when a path-like target escapes the root.
+ * Throws a safe Error (no outside path leakage) when a path-like target escapes the root
+ * or is outside project ownership (.private, AgentDoctorOS, fixtures, validation).
  */
 export function assertSafeRepoTarget(root, rawTarget) {
     if (typeof rawTarget !== "string" || rawTarget.includes("\0")) {
@@ -52,12 +55,62 @@ export function assertSafeRepoTarget(root, rawTarget) {
     const primary = candidates[candidates.length - 1];
     try {
         const abs = resolveSafeRepoPath(root, primary);
-        return path.relative(root, abs).split(path.sep).join("/");
+        const lexicalRel = path.isAbsolute(primary)
+            ? path.relative(root, abs).split(path.sep).join("/")
+            : primary.replace(/\\/g, "/").replace(/^\.\//, "");
+        // Lexical non-owned prefixes always deny.
+        if (classifyRelativePathOwnership(lexicalRel) !== "project_owned") {
+            throw new Error("path outside project ownership");
+        }
+        // Realpath-relative classification catches symlink aliases into non-owned trees.
+        let realRoot = root;
+        let realAbs = abs;
+        try {
+            realRoot = fs.realpathSync(root);
+        }
+        catch {
+            /* keep */
+        }
+        try {
+            realAbs = fs.realpathSync(abs);
+        }
+        catch {
+            /* keep */
+        }
+        const realRel = path.relative(realRoot, realAbs).split(path.sep).join("/") || ".";
+        if (realRel.startsWith("..") ||
+            path.isAbsolute(realRel) ||
+            classifyRelativePathOwnership(realRel) !== "project_owned") {
+            throw new Error("path outside project ownership");
+        }
+        return realRel || lexicalRel;
     }
     catch (error) {
         if (error instanceof PathEscapeError) {
             throw new Error(error.message);
         }
+        if (error instanceof Error && error.message === "path outside project ownership") {
+            throw error;
+        }
         throw new Error("invalid target");
     }
 }
+/**
+ * Async ownership gate including nested-repository ancestry (for MCP file-path tools).
+ */
+export async function assertSafeOwnedRepoTarget(root, rawTarget) {
+    const rel = assertSafeRepoTarget(root, rawTarget);
+    if (rel === null)
+        return null;
+    try {
+        const abs = resolveSafeRepoPath(root, rel);
+        await assertProjectOwnedRepoPath(root, abs, rel);
+    }
+    catch (error) {
+        if (error instanceof PathEscapeError || error instanceof ProjectOwnershipError) {
+            throw new Error(error.message);
+        }
+        throw error;
+    }
+    return rel;
+}

package/dist/platform/graph/build.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
+import { decideDirectoryTraversal } from "../../project/ownership.js";
 import { readTextFile } from "../../utils/fs.js";
 import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
 const SKIP = new Set([
@@ -48,6 +49,14 @@ async function walk(root, dir, files, dirs, limit) {
         if (entry.isSymbolicLink())
             continue;
         if (entry.isDirectory()) {
+            const relativeDir = toPosixRelative(root, absolute);
+            const traversal = await decideDirectoryTraversal({
+                projectRoot: root,
+                absoluteDir: absolute,
+                relativeDir,
+            });
+            if (!traversal.traverse)
+                continue;
             dirs.push(absolute);
             await walk(root, absolute, files, dirs, limit);
             continue;

package/dist/product/decisions/ledger.d.ts

@@ -1,10 +1,19 @@
+import { type ProjectOwnershipClass } from "../../project/ownership.js";
 import type { ProductEvidence, TruthLabel } from "../truth.js";
+/** Why a decision document is attributed to the current project. */
+export type DecisionSourceKind = "adr_file" | "decision_ledger" | "architecture_document" | "internal_note" | "unknown";
 export interface DecisionRecord {
     id: string;
     title: string;
     status?: string;
+    /** Wire-compat provenance channel. */
     source: "adr-file" | "ledger";
+    sourceKind: DecisionSourceKind;
     truth: TruthLabel;
+    /** Explicit meaning for UI — never “architecture proven correct”. */
+    truthMeaning: string;
+    projectRoot: string;
+    ownership: ProjectOwnershipClass;
     evidence: ProductEvidence[];
     recordedAt?: string;
     bodyExcerpt?: string;
@@ -16,9 +25,12 @@ export interface DecisionLedgerResult {
     limitations: string[];
 }
 export declare function parseAdrDecisions(rootInput: string, maxFileSizeBytes?: number): Promise<DecisionRecord[]>;
-export declare function appendDecisionLedgerEntry(rootInput: string, record: Omit<DecisionRecord, "source" | "truth"> & {
+export declare function appendDecisionLedgerEntry(rootInput: string, record: Omit<DecisionRecord, "source" | "truth" | "sourceKind" | "truthMeaning" | "projectRoot" | "ownership"> & {
     source?: DecisionRecord["source"];
+    sourceKind?: DecisionSourceKind;
     truth?: TruthLabel;
+    truthMeaning?: string;
+    ownership?: ProjectOwnershipClass;
 }): Promise<DecisionRecord>;
 export declare function loadDecisionLedger(rootInput: string): Promise<DecisionLedgerResult>;
 export declare function resolveDecisionPath(rootInput: string, candidate: string): string;

package/dist/product/decisions/ledger.js

@@ -2,21 +2,26 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { DEFAULT_MAX_FILE_SIZE_BYTES } from "../../constants.js";
 import { detectProject } from "../../detectors/project.js";
-import { readTextFile } from "../../utils/fs.js";
+import { classifyRelativePathOwnership, isProjectOwnedRelativePath, verifiedDecisionTruthMeaning, } from "../../project/ownership.js";
 import { resolveSafeRepoPath } from "../../security/paths.js";
+import { pathExists, readTextFile } from "../../utils/fs.js";
 import { resolveRepoRoot } from "../../utils/path.js";
-import { pathExists } from "../../utils/fs.js";
 function ledgerFile(root) {
     return path.join(resolveRepoRoot(root), ".agentdoctor", "decisions", "entries.jsonl");
 }
+/**
+ * ADR-shaped paths under the current project-owned tree only.
+ * Nested foreign trees with an adr directory segment are excluded by ownership
+ * before this runs; this still refuses internal_docs / private paths as defense in depth.
+ */
 function isAdrPath(relativePath) {
+    if (!isProjectOwnedRelativePath(relativePath))
+        return false;
     const norm = relativePath.replace(/\\/g, "/").toLowerCase();
-    return (norm.startsWith("docs/adr/") ||
-        norm.startsWith("adr/") ||
-        norm.includes("/adr/") ||
-        /^adr-\d+/i.test(path.basename(relativePath)));
+    const base = path.basename(relativePath);
+    return norm.startsWith("docs/adr/") || norm.startsWith("adr/") || /^adr[-_]\d+/i.test(base);
 }
-function parseAdr(relativePath, content) {
+function parseAdr(projectRoot, relativePath, content) {
     const lines = content.split(/\r?\n/);
     let title = "";
     let status;
@@ -31,12 +36,17 @@ function parseAdr(relativePath, content) {
     if (!title)
         return null;
     const id = relativePath.replace(/[^\w./-]/g, "_");
+    const ownership = classifyRelativePathOwnership(relativePath);
     return {
         id,
         title,
         ...(status !== undefined ? { status } : {}),
         source: "adr-file",
+        sourceKind: "adr_file",
         truth: "VERIFIED",
+        truthMeaning: verifiedDecisionTruthMeaning(),
+        projectRoot,
+        ownership,
         evidence: [{ path: relativePath, line: 1, excerpt: title.slice(0, 120) }],
         bodyExcerpt: content.slice(0, 400),
     };
@@ -52,7 +62,7 @@ export async function parseAdrDecisions(rootInput, maxFileSizeBytes = DEFAULT_MA
         const text = await readTextFile(path.join(root, rel), maxFileSizeBytes);
         if (!text)
             continue;
-        const parsed = parseAdr(rel, text);
+        const parsed = parseAdr(root, rel, text);
         if (parsed)
             decisions.push(parsed);
     }
@@ -66,7 +76,11 @@ export async function appendDecisionLedgerEntry(rootInput, record) {
     const full = {
         ...record,
         source: record.source ?? "ledger",
+        sourceKind: record.sourceKind ?? "decision_ledger",
         truth: record.truth ?? "VERIFIED",
+        truthMeaning: record.truthMeaning ?? verifiedDecisionTruthMeaning(),
+        projectRoot: root,
+        ownership: record.ownership ?? "project_owned",
         recordedAt: record.recordedAt ?? new Date().toISOString(),
     };
     await fs.appendFile(ledgerFile(root), `${JSON.stringify(full)}\n`, "utf8");
@@ -76,7 +90,9 @@ export async function loadDecisionLedger(rootInput) {
     const root = resolveRepoRoot(rootInput);
     const limitations = [
         "ADR parsing reads markdown titles and Status lines only.",
-        "Ledger JSONL entries are merged with discovered ADR files (deduped by id).",
+        "Only project-owned trees are scanned; nested repositories and private/validation checkouts are excluded.",
+        "VERIFIED means the ADR file was found and parsed — not that the architecture decision is independently proven correct.",
+        "Ledger JSONL entries are merged with discovered ADR files (deduped by id) when present and project-owned.",
     ];
     const fromAdr = await parseAdrDecisions(root);
     const fromLedger = [];
@@ -87,7 +103,22 @@ export async function loadDecisionLedger(rootInput) {
             if (!line.trim())
                 continue;
             try {
-                fromLedger.push(JSON.parse(line));
+                const raw = JSON.parse(line);
+                const evidencePath = raw.evidence?.[0]?.path ?? raw.id;
+                if (!isProjectOwnedRelativePath(String(evidencePath)) &&
+                    !isProjectOwnedRelativePath(String(raw.id))) {
+                    limitations.push(`Skipped non-owned ledger entry: ${raw.id}`);
+                    continue;
+                }
+                fromLedger.push({
+                    ...raw,
+                    source: raw.source ?? "ledger",
+                    sourceKind: raw.sourceKind ?? "decision_ledger",
+                    truth: raw.truth ?? "VERIFIED",
+                    truthMeaning: raw.truthMeaning ?? verifiedDecisionTruthMeaning(),
+                    projectRoot: raw.projectRoot ?? root,
+                    ownership: raw.ownership ?? classifyRelativePathOwnership(String(evidencePath)),
+                });
             }
             catch {
                 limitations.push("Skipped malformed decision ledger line.");

package/dist/product/discovery/roots.d.ts

@@ -25,6 +25,16 @@ export interface DiscoverProjectOptions {
     /** Auto-select highest score when exactly one strong candidate. */
     autoSelect?: boolean;
 }
+/**
+ * True when `cwd` is the user home directory or a similarly unsafe broad folder
+ * (Desktop / Downloads / Documents). Used to refuse silent whole-home scans.
+ */
+export declare function classifyBroadUserScanRoot(cwdInput: string, homeInput?: string): {
+    blocked: true;
+    reason: string;
+} | {
+    blocked: false;
+};
 /**
  * Discover likely project roots from cwd without silently scanning home/Desktop/Downloads
  * or unbounded parent trees.

package/dist/product/discovery/roots.js

@@ -84,6 +84,26 @@ function scoreMarkers(markers) {
     }
     return score;
 }
+/**
+ * True when `cwd` is the user home directory or a similarly unsafe broad folder
+ * (Desktop / Downloads / Documents). Used to refuse silent whole-home scans.
+ */
+export function classifyBroadUserScanRoot(cwdInput, homeInput) {
+    const cwd = path.resolve(cwdInput);
+    const home = normalizeHome(homeInput ?? os.homedir());
+    const baselower = path.basename(cwd).toLowerCase();
+    if (cwd === home ||
+        SUSPICIOUS_DIR_NAMES.has(baselower) ||
+        isUnderHomeSubtree(cwd, home, "Desktop") ||
+        isUnderHomeSubtree(cwd, home, "Downloads") ||
+        isUnderHomeSubtree(cwd, home, "Documents")) {
+        return {
+            blocked: true,
+            reason: "Refusing to scan home / Desktop / Downloads / Documents (or similarly broad user folders) as a project root. Navigate into a project directory or pass an explicit project path.",
+        };
+    }
+    return { blocked: false };
+}
 /**
  * Discover likely project roots from cwd without silently scanning home/Desktop/Downloads
  * or unbounded parent trees.
@@ -96,12 +116,8 @@ export async function discoverProjectRoots(options = {}) {
         "Discovery uses shallow marker probes and bounded entry counts — not a full repository index.",
         "Candidates are VERIFIED only when marker files/directories exist on disk.",
     ];
-    const baselower = path.basename(cwd).toLowerCase();
-    if (cwd === home ||
-        SUSPICIOUS_DIR_NAMES.has(baselower) ||
-        isUnderHomeSubtree(cwd, home, "Desktop") ||
-        isUnderHomeSubtree(cwd, home, "Downloads") ||
-        isUnderHomeSubtree(cwd, home, "Documents")) {
+    const broad = classifyBroadUserScanRoot(cwd, home);
+    if (broad.blocked) {
         const estimatedEntries = await countEntriesShallow(cwd, Math.min(maxEntries, 5_000));
         return {
             cwd,
@@ -109,7 +125,7 @@ export async function discoverProjectRoots(options = {}) {
             candidates: [],
             selected: null,
             blocked: true,
-            blockReason: "Refusing to scan home / Desktop / Downloads / Documents (or similarly broad user folders) as a project root. Navigate into a project directory or pass an explicit project path.",
+            blockReason: broad.reason,
             estimatedEntries,
             limitations,
         };

package/dist/product/graph/enrich-languages.js

@@ -1,7 +1,7 @@
-import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { getAdapterForFile, parseSourceFile } from "../../languages/index.js";
+import { discoverFiles } from "../../discovery/files.js";
 import { readTextFile } from "../../utils/fs.js";
 import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
 function nodeId(kind, key) {
@@ -9,37 +9,12 @@ function nodeId(kind, key) {
 }
 const LANG_FILE_RE = /\.(py|php|go|java|kt|kts|rs|dart)$/i;
 async function listLanguageSourceFiles(root, limit = 120) {
-    const out = [];
-    const skip = new Set(["node_modules", ".git", "dist", "coverage", ".agentdoctor", "vendor"]);
-    async function walk(dir) {
-        if (out.length >= limit)
-            return;
-        let entries;
-        try {
-            entries = await fs.readdir(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        for (const e of entries) {
-            if (out.length >= limit)
-                return;
-            if (skip.has(e.name))
-                continue;
-            const abs = path.join(dir, e.name);
-            if (e.isSymbolicLink())
-                continue;
-            if (e.isDirectory()) {
-                await walk(abs);
-                continue;
-            }
-            if (LANG_FILE_RE.test(e.name)) {
-                out.push(abs);
-            }
-        }
-    }
-    await walk(root);
-    return out.sort();
+    const discovered = await discoverFiles({ root });
+    return discovered.files
+        .filter((f) => LANG_FILE_RE.test(f.relativePath))
+        .map((f) => f.absolutePath)
+        .sort()
+        .slice(0, limit);
 }
 function evidenceFromAdapter(kind) {
     if (kind === "ast")

package/dist/product/index.d.ts

@@ -39,7 +39,7 @@ export { analyzeInfra } from "./ops/infra.js";
 export type { InfraReport, InfraArtifact } from "./ops/infra.js";
 export { buildIncidentHypotheses } from "./ops/incident.js";
 export type { IncidentReport, IncidentTimelineItem } from "./ops/incident.js";
-export { discoverProjectRoots, resolveStartedProjectRoot } from "./discovery/roots.js";
+export { discoverProjectRoots, resolveStartedProjectRoot, classifyBroadUserScanRoot, } from "./discovery/roots.js";
 export type { ProjectDiscoveryReport, ProjectCandidate, DiscoverProjectOptions, } from "./discovery/roots.js";
 export { buildProjectDna, persistProjectDna } from "./dna/build.js";
 export type { ProjectDna } from "./dna/build.js";
@@ -67,3 +67,6 @@ export { evaluateApprovalRecord, formatApprovalRecordSummary } from "./approval/
 export type { ApprovalRecord, ApprovalState, ApprovalRisk, ApprovalEvaluationInput, ApprovalEvaluationResult, } from "./approval/model.js";
 export { issueApprovalGrant, consumeApprovalGrant, hashPlanPayload, hashFileWritePlan, } from "./approval/session.js";
 export type { ApprovalGrant, ConsumeApprovalResult } from "./approval/session.js";
+export { classifyRelativePathOwnership, decideDirectoryTraversal, isNestedRepositoryRoot, isProjectOwnedRelativePath, isUnderNestedRepository, assertProjectOwnedRepoPath, ProjectOwnershipError, OWNERSHIP_BOUNDARY_VERSION, verifiedDecisionTruthMeaning, } from "../project/ownership.js";
+export type { ProjectOwnershipClass, DirectoryTraversalDecision } from "../project/ownership.js";
+export type { DecisionSourceKind } from "./decisions/ledger.js";

package/dist/product/index.js

@@ -19,7 +19,7 @@ export { runEvalLab } from "./eval/lab.js";
 export { diagnoseAgentDoctorSelf } from "./self/diagnose.js";
 export { analyzeInfra } from "./ops/infra.js";
 export { buildIncidentHypotheses } from "./ops/incident.js";
-export { discoverProjectRoots, resolveStartedProjectRoot } from "./discovery/roots.js";
+export { discoverProjectRoots, resolveStartedProjectRoot, classifyBroadUserScanRoot, } from "./discovery/roots.js";
 export { buildProjectDna, persistProjectDna } from "./dna/build.js";
 export { enrichGraphWithLanguageAdapters } from "./graph/enrich-languages.js";
 export { analyzeSecuritySurface } from "./security/doctor.js";
@@ -33,3 +33,4 @@ export { buildSoftwareEvolutionTimeline } from "./evolution/timeline.js";
 export { queryMemory } from "./memory/institutional.js";
 export { evaluateApprovalRecord, formatApprovalRecordSummary } from "./approval/model.js";
 export { issueApprovalGrant, consumeApprovalGrant, hashPlanPayload, hashFileWritePlan, } from "./approval/session.js";
+export { classifyRelativePathOwnership, decideDirectoryTraversal, isNestedRepositoryRoot, isProjectOwnedRelativePath, isUnderNestedRepository, assertProjectOwnedRepoPath, ProjectOwnershipError, OWNERSHIP_BOUNDARY_VERSION, verifiedDecisionTruthMeaning, } from "../project/ownership.js";

package/dist/product/map/software-map.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { DEFAULT_MAX_FILE_SIZE_BYTES } from "../../constants.js";
 import { detectProject } from "../../detectors/project.js";
 import { detectMonorepo } from "../../detectors/monorepo.js";
+import { isProjectOwnedRelativePath } from "../../project/ownership.js";
 import { resolveRepoRoot } from "../../utils/path.js";
 function nodeId(prefix, p) {
     return `${prefix}:${p.replace(/[^\w./-]/g, "_")}`;
@@ -11,7 +12,7 @@ async function topLevelEntries(root) {
     try {
         const entries = await fs.readdir(root, { withFileTypes: true });
         return entries
-            .filter((e) => e.isDirectory() && !e.name.startsWith("."))
+            .filter((e) => e.isDirectory() && !e.name.startsWith(".") && isProjectOwnedRelativePath(e.name))
             .map((e) => e.name)
             .sort();
     }

package/dist/product/memory/institutional.js

@@ -19,6 +19,11 @@ export async function queryMemory(rootInput, query) {
     const brain = await loadLatestBrain(root);
     if (brain) {
         for (const bh of searchBrain(brain, q).slice(0, 15)) {
+            if (bh.text.includes(".private/") ||
+                bh.text.includes("AgentDoctorOS/") ||
+                bh.text.includes("oss-validation/")) {
+                continue;
+            }
             hits.push({
                 source: "brain",
                 id: bh.id,

package/dist/product/search/software-search.js

@@ -22,6 +22,11 @@ export async function searchSymbolsAndConcepts(rootInput, query, options) {
     const brain = await loadLatestBrain(root);
     if (brain) {
         for (const bh of searchBrain(brain, q)) {
+            if (bh.text.includes(".private/") ||
+                bh.text.includes("AgentDoctorOS/") ||
+                bh.text.includes("oss-validation/")) {
+                continue;
+            }
             hits.push({
                 kind: "brain",
                 path: ".agentdoctor/project-brain",

package/dist/product/twin/store.js

@@ -5,6 +5,7 @@ import { DEFAULT_MAX_FILE_SIZE_BYTES } from "../../constants.js";
 import { atomicWriteTextFile, pathExists, readJsonFile } from "../../utils/fs.js";
 import { resolveRepoRoot } from "../../utils/path.js";
 import { buildSoftwareDigitalTwinSnapshot } from "./digital-twin.js";
+import { OWNERSHIP_BOUNDARY_VERSION } from "../../project/ownership.js";
 function twinDir(root) {
     return path.join(resolveRepoRoot(root), ".agentdoctor", "twin");
 }
@@ -12,7 +13,10 @@ function snapshotPath(root) {
     return path.join(twinDir(root), "snapshot.json");
 }
 function hashInputs(changedFiles) {
-    const payload = (changedFiles ?? []).slice().sort().join("\n");
+    const payload = [
+        `ownership-boundary:${OWNERSHIP_BOUNDARY_VERSION}`,
+        ...(changedFiles ?? []).slice().sort(),
+    ].join("\n");
     return createHash("sha256").update(payload).digest("hex").slice(0, 16);
 }
 export async function loadTwinSnapshot(rootInput) {
@@ -22,6 +26,10 @@ export async function loadTwinSnapshot(rootInput) {
         return null;
     if (parsed.data.meta.root !== root)
         return null;
+    // Reject twins built under a prior ownership boundary (or any mismatched hash).
+    const expected = hashInputs(parsed.data.meta.changedFiles);
+    if (parsed.data.meta.invalidationHash !== expected)
+        return null;
     return parsed.data;
 }
 export async function saveTwinSnapshot(rootInput, twin, meta) {

package/dist/product/whatif/engine.js

@@ -1,16 +1,37 @@
 import { deriveGraphChangeImpact } from "../../assurance/change.js";
 import { buildIntelligenceGraph } from "../../intelligence/graph/build.js";
+import { assertProjectOwnedRepoPath, classifyRelativePathOwnership, ProjectOwnershipError, } from "../../project/ownership.js";
+import { PathEscapeError, resolveSafeRepoPath } from "../../security/paths.js";
 import { resolveRepoRoot } from "../../utils/path.js";
 import { minProductTruth } from "../truth.js";
 function normalizeTarget(target) {
     return target.replace(/\\/g, "/").replace(/^\.\//, "");
 }
+async function assertOwnedWhatIfTarget(root, target) {
+    const normalized = normalizeTarget(target);
+    const lexical = classifyRelativePathOwnership(normalized);
+    if (lexical !== "project_owned") {
+        throw new ProjectOwnershipError(lexical, `what-if target outside project ownership (${lexical})`);
+    }
+    try {
+        const abs = resolveSafeRepoPath(root, normalized);
+        await assertProjectOwnedRepoPath(root, abs, normalized);
+    }
+    catch (error) {
+        if (error instanceof PathEscapeError || error instanceof ProjectOwnershipError) {
+            throw error;
+        }
+        // Non-existent owned path remains a valid hypothetical change target.
+    }
+    return normalized;
+}
 export async function analyzeWhatIf(rootInput, target, options) {
     const root = resolveRepoRoot(rootInput);
-    const normalized = normalizeTarget(target);
+    const normalized = await assertOwnedWhatIfTarget(root, target);
     const limitations = [
         "Impact analysis uses intelligence graph import/call edges when available.",
         "Symbol-level precision depends on graph node coverage.",
+        "What-if targets must be project-owned paths (containment alone is not ownership).",
     ];
     let graph = options?.graph;
     if (!graph && options?.buildGraph !== false) {