@quonfig/cli 0.0.69 → 0.0.70

package/dist/migrate/push-to-cloud.js

@@ -1,7 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { readKeyPlan, removeQfFromGitignore, writeImportState, writeKeyPlan } from './import-state.js';
-import { buildAuditFinalCommit, buildAuditPerChangeCommits, buildMigrationCommitMessage, buildMigrationCounts, writeQuonfigFiles, } from './local-write.js';
+import { buildAuditFinalCommit, buildAuditPerChangeCommits, buildMigrationCommitMessage, buildMigrationCounts, collectExistingWorkspaceKeys, writeQuonfigFiles, } from './local-write.js';
 import { getFullKeyPlan, getKeyRewrites, preflightKeyRewrites } from './key-rewriter.js';
 import { deriveFollowUpFromConversionNotes, writeMigrationReport } from './migration-report.js';
 import { cloneAndStackPush, } from '../util/clone-and-stack-push.js';
@@ -60,10 +60,14 @@ export const pushMigrationToCloud = async (opts) => {
     // not per-commit) so key-def and reference sites resolve identically, then
     // enforce --strict-keys before any clone/commit/push. Mappings persisted by a
     // previous run (.qf/key-plan.json in the reused clone) are authoritative so a
-    // delta run cannot replan a subset and land on different finals. (When the
-    // clone is fresh, the plan only comes down WITH the clone — the collapsed
-    // commit's apply() re-plans below once it can read the cloned .qf/.)
+    // delta run cannot replan a subset and land on different finals. qfg-hbuy.12:
+    // keys already in the workspace seed the rewriter so a case-variant collision
+    // (incoming `Foo`, existing `foo`) renames instead of aborting, while a
+    // byte-equal match keeps the silent-overwrite re-migration path. (When the
+    // clone is fresh, both the plan and the existing keys only come down WITH the
+    // clone — the post-clone re-plan below repeats this once it can read them.)
     preflightKeyRewrites(opts.changes, {
+        existingKeys: collectExistingWorkspaceKeys(opts.localDir),
         persistedKeys: readKeyPlan(opts.localDir) ?? undefined,
         strict: opts.strictKeys,
     });
@@ -79,8 +83,23 @@ export const pushMigrationToCloud = async (opts) => {
             mergeEnvironmentsIntoQuonfigJson(dir, opts.environments);
         }
     };
+    // Re-plan once the clone exists: a FRESH clone of a live workspace delivers
+    // .qf/key-plan.json AND the existing key files only at this point (the
+    // pre-clone preflight above couldn't see either), and both must win before
+    // any file is written. The collapsed path runs this at the top of its single
+    // commit; audit-log mode prepends it as a no-op commit spec (its apply()
+    // stages nothing, so stackCommits silently skips the commit) so it runs
+    // BEFORE the first per-change commit writes files (qfg-hbuy.12).
+    const replanAgainstClone = (dir) => {
+        preflightKeyRewrites(opts.changes, {
+            existingKeys: collectExistingWorkspaceKeys(dir),
+            persistedKeys: readKeyPlan(dir) ?? undefined,
+            strict: opts.strictKeys,
+        });
+    };
     const commits = opts.fullHistory
         ? [
+            { apply: replanAgainstClone, message: 'migrator: replan keys against the cloned workspace (no-op)' },
             ...buildAuditPerChangeCommits(opts.changes, opts.source),
             buildAuditFinalCommit({
                 changes: opts.changes,
@@ -97,14 +116,7 @@ export const pushMigrationToCloud = async (opts) => {
             {
                 message: () => computedCommitMessage,
                 async apply(dir) {
-                    // Re-plan now that the clone exists: a FRESH clone of a previously
-                    // migrated workspace delivers .qf/key-plan.json only at this point
-                    // (the pre-clone preflight above couldn't see it), and the
-                    // persisted mappings must win before any file is written.
-                    preflightKeyRewrites(opts.changes, {
-                        persistedKeys: readKeyPlan(dir) ?? undefined,
-                        strict: opts.strictKeys,
-                    });
+                    replanAgainstClone(dir);
                     mergeEnvsIfPresent(dir);
                     const { livePaths, resolutions: resolutionEntries } = writeQuonfigFiles(dir, opts.changes, opts.source);
                     removeQfFromGitignore(dir);

package/dist/migrate/quonfig-target/ruleset.js

@@ -53,7 +53,10 @@ function valueToMatchFor(operator, clause, ctx) {
         // qfg-6na9.3: this value is a referenced segment KEY — resolve it through
         // the per-run rewriter so a sanitized/disambiguated segment key stays in
         // sync with the IN_SEG rules pointing at it (no dangling targeting).
-        return { type: 'string', value: resolveKey(String(clause.values[0] ?? '')) };
+        // qfg-hbuy.10: resolve in the SEGMENT namespace, so a segment renamed to
+        // dodge a same-keyed flag keeps its references (falls back to the default
+        // namespace for non-colliding segments).
+        return { type: 'string', value: resolveKey(String(clause.values[0] ?? ''), 'segment') };
     }
     if (operator === 'PROP_MATCHES' || operator === 'PROP_DOES_NOT_MATCH') {
         if (clause.values.length > 1) {

package/dist/migrate/source.d.ts

@@ -2,6 +2,15 @@ import type { ConversionNote } from './quonfig-target/report.js';
 export interface LegacyChange {
     changedAt?: number;
     key?: string;
+    /**
+     * qfg-hbuy.10: source-side key namespace. LaunchDarkly flags and segments
+     * are SEPARATE key namespaces, so a flag and a segment can legitimately
+     * share one source key. Sources that model segments as their own namespace
+     * tag segment changes `'segment'` so the key rewriter can disambiguate the
+     * collision (the flag keeps the clean name; the segment gets a
+     * deterministic `-segment` suffix). Absent = the default namespace.
+     */
+    keyNamespace?: 'segment';
     raw: unknown;
     source: string;
 }

package/dist/migrate/sources/launch/translate.js

@@ -1,6 +1,6 @@
 import { normalizeImportedWeights } from '../../quonfig-target/weights.js';
 import { zodToJsonSchema } from './zod-to-json-schema.js';
-import { resolveKey } from '../../key-rewriter.js';
+import { resolveKey, resolveMappedKey } from '../../key-rewriter.js';
 /**
  * Thrown by transformConfig when the source config is structurally invalid
  * (e.g. variant/valueType mismatch) and the migrator cannot produce a valid
@@ -50,6 +50,74 @@ function resolveSegmentRef(valueToMatch) {
     else if (Array.isArray(v.value))
         v.value = v.value.map((x) => (typeof x === 'string' ? resolveKey(x) : x));
 }
+/**
+ * qfg-hbuy.11: a value's `decryptWith` names the CONFIG KEY holding its
+ * AES-GCM key — a by-key reference, exactly like an IN_SEG segment ref. When
+ * the referenced config was renamed by the key rewriter the reference must
+ * follow, or the config can never decrypt. A key absent from the map points
+ * at a pre-existing workspace config the import does not own — left
+ * untouched. Recurses into weighted_values so encrypted variant splits are
+ * covered too.
+ */
+function rewriteValueKeyRefs(value) {
+    if (!value || typeof value !== 'object')
+        return;
+    const v = value;
+    if (typeof v.decryptWith === 'string') {
+        const mapped = resolveMappedKey(v.decryptWith);
+        if (mapped !== null)
+            v.decryptWith = mapped;
+    }
+    if (v.type === 'weighted_values') {
+        const inner = v.value;
+        let entries = [];
+        if (Array.isArray(inner)) {
+            entries = inner;
+        }
+        else if (inner && typeof inner === 'object') {
+            const wvs = inner.weightedValues;
+            if (Array.isArray(wvs))
+                entries = wvs;
+        }
+        for (const entry of entries) {
+            if (entry && typeof entry === 'object' && entry.value) {
+                rewriteValueKeyRefs(entry.value);
+            }
+        }
+    }
+}
+/**
+ * qfg-hbuy.11: walk every value position that can carry `decryptWith`
+ * (default rules, per-environment rules, variants) and rewrite the reference
+ * through the final key map. Mirrors normalizeJsonValuesInConfig's traversal.
+ */
+function rewriteKeyReferencesInConfig(out) {
+    const walkRules = (rules) => {
+        if (!Array.isArray(rules))
+            return;
+        for (const rule of rules) {
+            if (!rule || typeof rule !== 'object')
+                continue;
+            const r = rule;
+            if (r.value)
+                rewriteValueKeyRefs(r.value);
+        }
+    };
+    const defaultSection = out.default;
+    if (defaultSection)
+        walkRules(defaultSection.rules);
+    if (Array.isArray(out.environments)) {
+        for (const env of out.environments) {
+            walkRules(env.rules);
+        }
+    }
+    if (Array.isArray(out.variants)) {
+        for (const variant of out.variants) {
+            if (variant && variant.value)
+                rewriteValueKeyRefs(variant.value);
+        }
+    }
+}
 /**
  * qfg-l18w / qfg-0q1f: Operators Quonfig accepts in rule criteria. Mirrors
  * the `OperatorSchema` enum in cli/src/verify/validate.ts (and app-quonfig's
@@ -328,6 +396,15 @@ export function transformConfig(config, envIdMap, onDroppedEnv, onCoercedSentine
     if (typeof out.key === 'string') {
         out.key = normalizeKey(out.key);
     }
+    // qfg-hbuy.11: `schemaKey` references ANOTHER config's key (the schema this
+    // config validates against). If that schema was renamed by the key rewriter
+    // the reference must follow; a schemaKey absent from the map references a
+    // pre-existing workspace schema and is left untouched.
+    if (typeof out.schemaKey === 'string') {
+        const mapped = resolveMappedKey(out.schemaKey);
+        if (mapped !== null)
+            out.schemaKey = mapped;
+    }
     delete out.changedBy;
     delete out.modifiedAt;
     delete out.createdAt;
@@ -424,6 +501,9 @@ export function transformConfig(config, envIdMap, onDroppedEnv, onCoercedSentine
         }
     }
     normalizeJsonValuesInConfig(out);
+    // qfg-hbuy.11: rewrite `decryptWith` references AFTER json-normalization so
+    // the walker sees the final value shapes.
+    rewriteKeyReferencesInConfig(out);
     normalizeWeightsInConfig(out, onNormalizedWeights);
     validateOperators(out);
     return out;

package/dist/migrate/sources/launchdarkly/translate.js

@@ -22,6 +22,16 @@ const ALWAYS_TRUE = { operator: 'ALWAYS_TRUE' };
 function normalizeKey(key) {
     return resolveKey(key);
 }
+/**
+ * qfg-hbuy.10: LD segments are their OWN key namespace — a project can carry a
+ * flag and a segment both keyed `checkout`. Segment key definitions (and the
+ * IN_SEG references in `ruleset.ts`) resolve through the segment namespace so
+ * the collision case gets the deterministic `-segment` suffix while the flag
+ * keeps the clean name. Non-colliding segments resolve exactly as before.
+ */
+function normalizeSegmentKey(key) {
+    return resolveKey(key, 'segment');
+}
 /** Environment keys are LD slugs already; lowercase + hyphenate to be safe. */
 function slugifyEnvKey(key) {
     return key
@@ -53,7 +63,7 @@ export function flagOutputPath(key) {
     return `feature-flags/${normalizeKey(key)}.json`;
 }
 export function segmentOutputPath(key) {
-    return `segments/${normalizeKey(key)}.json`;
+    return `segments/${normalizeSegmentKey(key)}.json`;
 }
 /**
  * Translate one LaunchDarkly flag into a Quonfig feature-flag file.
@@ -199,7 +209,7 @@ export function translateSegment(segment, report) {
     // Trailing catch-all: anyone not matched above is not in the segment.
     rules.push({ criteria: [ALWAYS_TRUE], value: { type: 'bool', value: false } });
     const out = {
-        key: normalizeKey(segment.key),
+        key: normalizeSegmentKey(segment.key),
         type: 'segment',
         valueType: 'bool',
         default: { rules },

package/dist/migrate/sources/launchdarkly.js

@@ -164,7 +164,14 @@ async function* fetchChangesImpl() {
         yield { key: flag.key, raw: { data: flag, kind: 'flag' }, source: SOURCE_NAME };
     }
     for (const segment of snapshot.segments) {
-        yield { key: segment.key, raw: { data: segment, kind: 'segment' }, source: SOURCE_NAME };
+        // qfg-hbuy.10: LD segments are their own key namespace — tag them so the
+        // key rewriter can disambiguate a flag and a segment sharing one key.
+        yield {
+            key: segment.key,
+            keyNamespace: 'segment',
+            raw: { data: segment, kind: 'segment' },
+            source: SOURCE_NAME,
+        };
     }
 }
 /** Path to this run's audit-walk resume cursor (always under os.tmpdir; see filename comment). */
@@ -235,7 +242,13 @@ async function* fetchAuditHistory(apiKey) {
         }
     }
     for (const segment of segmentsByKey.values()) {
-        yield { key: segment.key, raw: { data: segment, kind: 'segment' }, source: SOURCE_NAME };
+        // qfg-hbuy.10: see the matching tag in fetchChangesImpl.
+        yield {
+            key: segment.key,
+            keyNamespace: 'segment',
+            raw: { data: segment, kind: 'segment' },
+            source: SOURCE_NAME,
+        };
     }
 }
 function translateImpl(change) {

package/dist/util/policy-a-key.d.ts

@@ -10,7 +10,9 @@
  *   - 1..200 chars (ASCII-only, so char length == byte length),
  *   - not the reserved key `"new"`,
  *   - no leading dot (a `.beta.json` config is silently skipped by the loader
- *     and `qfg verify`).
+ *     and `qfg verify`),
+ *   - no trailing dot or space (silently stripped on Windows), and
+ *   - the first dot-segment is not a Windows reserved device name (qfg-hbuy.6).
  *
  * NOTE the layering: this is the create boundary (hard). The general charset is
  * a *warning* in `qfg verify` (`src/verify/validate.ts`, qfg-6na9.5) during the
@@ -18,6 +20,18 @@
  * Keep the messages aligned with app-quonfig's for a consistent UX.
  */
 export declare const POLICY_A_KEY_RE: RegExp;
+/**
+ * Windows reserved device names (qfg-hbuy.6). Byte-identical mirror of
+ * app-quonfig `src/lib/domain/config-schemas.ts` `WINDOWS_RESERVED_DEVICE_NAME_RE`
+ * and the qfg-verify hook's FS-safety floor (`src/verify/validate.ts`
+ * `FS_SAFETY_FLOOR_CHECKS`). Matched case-insensitively against the FIRST
+ * dot-segment of the key (`k.split('.')[0]`), because Windows treats
+ * `con.anything` as the `con` device. So `con`, `CON`, and `com3.foo` are
+ * rejected while `foo.con`, `com10`, and `console` are fine. The audit
+ * (project/plans/26-07-policy-a-audit-findings.md) specifically wants these
+ * checks byte-identical across enforcement points — keep the regex in sync.
+ */
+export declare const WINDOWS_RESERVED_DEVICE_NAME_RE: RegExp;
 /**
  * Returns a human-readable error message for a key that violates Policy A, or
  * `null` if the key is valid. First failing rule wins (matches the order Zod

package/dist/util/policy-a-key.js

@@ -10,7 +10,9 @@
  *   - 1..200 chars (ASCII-only, so char length == byte length),
  *   - not the reserved key `"new"`,
  *   - no leading dot (a `.beta.json` config is silently skipped by the loader
- *     and `qfg verify`).
+ *     and `qfg verify`),
+ *   - no trailing dot or space (silently stripped on Windows), and
+ *   - the first dot-segment is not a Windows reserved device name (qfg-hbuy.6).
  *
  * NOTE the layering: this is the create boundary (hard). The general charset is
  * a *warning* in `qfg verify` (`src/verify/validate.ts`, qfg-6na9.5) during the
@@ -22,6 +24,18 @@
 // across both sources of truth — see the module doc above.
 // eslint-disable-next-line unicorn/better-regex
 export const POLICY_A_KEY_RE = /^[A-Za-z0-9._-]+$/;
+/**
+ * Windows reserved device names (qfg-hbuy.6). Byte-identical mirror of
+ * app-quonfig `src/lib/domain/config-schemas.ts` `WINDOWS_RESERVED_DEVICE_NAME_RE`
+ * and the qfg-verify hook's FS-safety floor (`src/verify/validate.ts`
+ * `FS_SAFETY_FLOOR_CHECKS`). Matched case-insensitively against the FIRST
+ * dot-segment of the key (`k.split('.')[0]`), because Windows treats
+ * `con.anything` as the `con` device. So `con`, `CON`, and `com3.foo` are
+ * rejected while `foo.con`, `com10`, and `console` are fine. The audit
+ * (project/plans/26-07-policy-a-audit-findings.md) specifically wants these
+ * checks byte-identical across enforcement points — keep the regex in sync.
+ */
+export const WINDOWS_RESERVED_DEVICE_NAME_RE = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
 /**
  * Returns a human-readable error message for a key that violates Policy A, or
  * `null` if the key is valid. First failing rule wins (matches the order Zod
@@ -38,5 +52,15 @@ export function policyAKeyError(key) {
         return 'Key can only contain letters, numbers, dots, dashes, and underscores';
     if (key.startsWith('.'))
         return 'Key cannot start with a dot';
+    // ── FS-safety floor parity with app-quonfig PolicyAKeySchema (qfg-hbuy.6) ──
+    // The charset above already covers the hook's control-char and
+    // Windows-reserved-char floor items; these two are the only floor items the
+    // charset alone permits. Without them the UI/create boundary accepts the key
+    // and the user gets a confusing 422 at push time instead of a clean error.
+    if (/[ .]$/.test(key))
+        return 'Key cannot end with a dot or space';
+    if (WINDOWS_RESERVED_DEVICE_NAME_RE.test(key.split('.')[0])) {
+        return 'Key cannot use a Windows reserved device name (con, prn, aux, nul, com1-9, lpt1-9) before the first dot';
+    }
     return null;
 }

package/dist/verify/standalone.d.ts

@@ -21,5 +21,12 @@
  * exists to catch (verified live on staging: a `configs/bad charset key.json`
  * push was accepted unvalidated). A listed-but-unreadable file is now a hard
  * failure (fail closed), not a silent skip.
+ *
+ * qfg-hbuy.4: enumerates RECURSIVELY (`-r`) and with NO name filtering. The
+ * old non-recursive listing plus `endsWith('.json') && !includes('/.')` filter
+ * meant dotfiles, nested paths (configs/sub/x.json), and case-variant
+ * extensions (FOO.JSON) never reached validation at all — ghost files that
+ * push fine but no loader reads. The hook must see EVERYTHING under the
+ * validated dirs; validateFileMap is the layer that decides what is an error.
  */
 export declare function readFilesFromCommit(commitOid: string, cwd?: string): Map<string, string>;

package/dist/verify/standalone.js

@@ -99,26 +99,32 @@ async function runGitHook() {
  * exists to catch (verified live on staging: a `configs/bad charset key.json`
  * push was accepted unvalidated). A listed-but-unreadable file is now a hard
  * failure (fail closed), not a silent skip.
+ *
+ * qfg-hbuy.4: enumerates RECURSIVELY (`-r`) and with NO name filtering. The
+ * old non-recursive listing plus `endsWith('.json') && !includes('/.')` filter
+ * meant dotfiles, nested paths (configs/sub/x.json), and case-variant
+ * extensions (FOO.JSON) never reached validation at all — ghost files that
+ * push fine but no loader reads. The hook must see EVERYTHING under the
+ * validated dirs; validateFileMap is the layer that decides what is an error.
  */
 export function readFilesFromCommit(commitOid, cwd) {
     const files = new Map();
     const dirs = ['configs', 'feature-flags', 'segments', 'log-levels', 'schemas', 'schemas-protected'];
     for (const dir of dirs) {
-        // List files in this directory at the given commit. A directory that
-        // doesn't exist yields an empty listing (exit 0); a bad/unreadable OID
-        // throws — fail closed, the hook rejects the push.
-        const listing = execFileSync('git', ['ls-tree', '-z', '--name-only', commitOid, `${dir}/`], {
+        // List every leaf entry under this directory at the given commit. A
+        // directory that doesn't exist yields an empty listing (exit 0); a
+        // bad/unreadable OID throws — fail closed, the hook rejects the push.
+        const listing = execFileSync('git', ['ls-tree', '-z', '-r', '--name-only', commitOid, `${dir}/`], {
             cwd,
             encoding: 'utf8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
         const filenames = listing.split('\0').filter(Boolean);
         for (const filePath of filenames) {
-            if (!filePath.endsWith('.json') || filePath.includes('/.'))
-                continue;
-            // Fail closed: if a listed file can't be read, the push must not be
-            // accepted with that file unvalidated — let the error propagate to the
-            // hook's per-ref handler, which rejects the push.
+            // Fail closed: if a listed entry can't be read (bad object, submodule
+            // gitlink, ...), the push must not be accepted with that entry
+            // unvalidated — let the error propagate to the hook's per-ref handler,
+            // which rejects the push.
             const content = execFileSync('git', ['show', `${commitOid}:${filePath}`], {
                 cwd,
                 encoding: 'utf8',

package/dist/verify/validate.js

@@ -160,6 +160,86 @@ const DIR_TO_TYPE = {
 const CONFIG_DIRS = new Set(Object.keys(DIR_TO_TYPE));
 const SCHEMA_DIRS = new Set(['schemas', 'schemas-protected']);
 const KNOWN_DIRS = new Set([...CONFIG_DIRS, ...SCHEMA_DIRS]);
+// ── Ghost-file prevention (qfg-hbuy.4) ──────────────────────────────────
+// Within the validated content dirs (KNOWN_DIRS), every entry must be a
+// top-level, non-dot, lowercase-`.json` file. Anything else used to be
+// silently SKIPPED by the enumeration filters — a "ghost" file that pushes
+// fine but is invisible to the hook and to every loader, and a mixed-case
+// FOO.JSON can collide with foo.json on a case-insensitive customer clone
+// (the exact clonability failure Policy A exists to prevent). A skipped
+// entry is a bypass; an error is a rejected push. Paths OUTSIDE the
+// validated dirs (quonfig.json, README.md, .qf/, ...) are not this rule's
+// business and stay untouched.
+function ghostEntryIssue(dir, relPath, name, nested) {
+    if (nested) {
+        return {
+            file: relPath,
+            message: `Subdirectories are not allowed inside "${dir}/" — nested files are never loaded (ghost file)`,
+            severity: 'error',
+            suggestion: `Move config files to the top level: "${dir}/<key>.json"`,
+        };
+    }
+    if (name.startsWith('.')) {
+        return {
+            file: relPath,
+            message: `Dotfile "${name}" is not allowed inside "${dir}/" — hidden files are never loaded (ghost file)`,
+            severity: 'error',
+            suggestion: `Remove the file or rename it without the leading dot`,
+        };
+    }
+    if (!name.endsWith('.json')) {
+        if (name.toLowerCase().endsWith('.json')) {
+            return {
+                file: relPath,
+                message: `File extension must be lowercase ".json" (found "${name}") — a case-variant extension is never loaded and can collide with another file on a case-insensitive filesystem`,
+                severity: 'error',
+                suggestion: `Rename to "${name.slice(0, -5)}.json"`,
+            };
+        }
+        return {
+            file: relPath,
+            message: `Only ".json" files are allowed inside "${dir}/" (found "${name}")`,
+            severity: 'error',
+            suggestion: `Remove the file or rename it to "<key>.json"`,
+        };
+    }
+    return null;
+}
+/**
+ * Disk-walk variant of the ghost rule (validateWorkspace). Returns the list
+ * of names that should proceed to content validation, pushing an issue for
+ * every ghost entry.
+ *
+ * Dotfiles are the one place the disk rule is softer than the committed-tree
+ * rule: `qfg push` never sends dotfiles (collectFiles skips them), so a local
+ * `configs/.DS_Store` is inert OS junk — erroring on it would break every
+ * macOS user. A `.json`-looking dotfile is almost certainly a mistake, so it
+ * gets a WARNING; other dotfiles are skipped silently.
+ */
+function listValidatedDirEntries(dirPath, dir, issues) {
+    const names = [];
+    for (const entry of fs.readdirSync(dirPath, { withFileTypes: true })) {
+        const relPath = `${dir}/${entry.name}`;
+        if (entry.name.startsWith('.')) {
+            if (entry.name.toLowerCase().endsWith('.json')) {
+                issues.push({
+                    file: relPath,
+                    message: `Dotfile "${entry.name}" in "${dir}/" is ignored — it is never validated, pushed, or loaded`,
+                    severity: 'warning',
+                    suggestion: `Remove the file or rename it without the leading dot`,
+                });
+            }
+            continue;
+        }
+        const ghost = ghostEntryIssue(dir, relPath, entry.name, entry.isDirectory());
+        if (ghost) {
+            issues.push(ghost);
+            continue;
+        }
+        names.push(entry.name);
+    }
+    return names;
+}
 // Operators that reference segments
 const SEGMENT_OPERATORS = new Set(['IN_SEG', 'NOT_IN_SEG']);
 // Operators that require a propertyName
@@ -318,12 +398,13 @@ export function validateWorkspace(workspaceDir) {
             suggestion: `Create quonfig.json with format: {"environments": ["production", "staging"]}`,
         });
     }
-    // First pass: parse all files and collect keys
+    // First pass: parse all files and collect keys. Ghost entries (dotfiles,
+    // subdirectories, non-lowercase-.json names) are reported here (qfg-hbuy.4).
     for (const dir of KNOWN_DIRS) {
         const dirPath = path.join(workspaceDir, dir);
         if (!fs.existsSync(dirPath))
             continue;
-        const files = fs.readdirSync(dirPath).filter((f) => f.endsWith('.json') && !f.startsWith('.'));
+        const files = listValidatedDirEntries(dirPath, dir, issues);
         for (const file of files) {
             const filePath = path.join(dirPath, file);
             const relPath = `${dir}/${file}`;
@@ -482,7 +563,8 @@ export function validateWorkspace(workspaceDir) {
             allConfigs.push({ key: config.key, type: config.type, dir, file: relPath });
         }
     }
-    // Second pass: referential integrity
+    // Second pass: referential integrity. Keep the plain skip-filter here —
+    // ghost entries were already reported (once) by the first pass.
     for (const dir of KNOWN_DIRS) {
         const dirPath = path.join(workspaceDir, dir);
         if (!fs.existsSync(dirPath))
@@ -629,8 +711,15 @@ export function validateFileMap(files) {
         const file = parts.at(-1);
         if (!KNOWN_DIRS.has(dir))
             continue;
-        if (!file || !file.endsWith('.json') || file.startsWith('.'))
+        if (!file)
             continue;
+        // qfg-hbuy.4: a dotfile, nested path, or non-lowercase-.json entry inside
+        // a validated dir is a hard error (rejected push), not a silent skip.
+        const ghost = ghostEntryIssue(dir, relPath, file, parts.length > 2);
+        if (ghost) {
+            issues.push(ghost);
+            continue;
+        }
         filesChecked++;
         let parsed;
         try {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.69";
+declare const _default: "0.0.70";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.69';
+export default '0.0.70';

package/oclif.manifest.json

@@ -4136,5 +4136,5 @@
       ]
     }
   },
-  "version": "0.0.69"
+  "version": "0.0.70"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.69",
+  "version": "0.0.70",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },