@stylusnexus/work-plan 2026.6.15 → 2026.6.18

package/skills/work-plan/lib/plan_worktree.py

@@ -267,6 +267,43 @@ def is_published(local_path: Path, branch: str) -> bool:
     return remote_branch_exists(local_path, branch)
 
 
+def rebase_onto_origin(worktree: Path, branch: str) -> bool:
+    """Fetch origin/<branch> and rebase the worktree (checked out at <branch>)
+    onto it, so a shared-tier write lands on top of any teammate's pushed plan
+    changes instead of diverging (#241).
+
+    Returns:
+      True  — the worktree is now at-or-ahead of origin: rebase succeeded,
+              there was nothing to replay, or the branch isn't published yet
+              (local is authoritative — nothing to rebase onto).
+      False — the rebase hit a conflict (it is ABORTED so the worktree is left
+              clean, never half-rebased) or git couldn't run. The caller must
+              NOT write — it surfaces {needs_rebase} and bails.
+
+    Never raises.
+    """
+    wt = Path(worktree).expanduser()
+    # Fetch so origin/<branch> is authoritative before we compare.
+    fetch_branch(wt, branch)
+    if not remote_branch_exists(wt, branch):
+        return True  # unpublished — no upstream to rebase onto; local wins
+    # --autostash: the normal flow is write-file-then-commit, so the worktree's
+    # .work-plan/ is routinely dirty when we rebase. Without autostash git would
+    # refuse the rebase on the dirty precondition and we'd report a spurious
+    # {needs_rebase}; autostash shelves the local edits, rebases, and reapplies
+    # them on top — so a clean rebase succeeds even with pending plan edits.
+    proc = _git(wt, "rebase", "--autostash", f"origin/{branch}")
+    if proc is None:
+        return False
+    if proc.returncode == 0:
+        return True
+    # True conflict (autostash reapply or replayed commits): abort so the
+    # worktree is never left in a partially-rebased state. A blind write over a
+    # diverged shared branch is exactly what this guard exists to prevent.
+    _git(wt, "rebase", "--abort")
+    return False
+
+
 def unpushed_oneline(local_path: Path, branch: str) -> list:
     """One-line summaries of commits on local `branch` not yet on origin
     (`origin/<branch>..<branch>`). If origin/<branch> doesn't exist, every commit

package/skills/work-plan/lib/tracks.py

@@ -1,4 +1,5 @@
 """Discover tracks under notes_root and shared .work-plan/ dirs."""
+import re
 import sys
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -74,9 +75,11 @@ def discover_tracks(cfg: dict) -> list[Track]:
     for t in private:
         key = (t.repo, t.name)
         if key in shared_keys:
+            hint = f" --repo={t.folder}" if t.folder else ""
             print(
                 f"WARN: track {t.name!r} (repo={t.repo!r}) exists in both shared"
-                f" ({shared_keys[key].path}) and private ({t.path}); using shared.",
+                f" ({shared_keys[key].path}) and private ({t.path}); using shared."
+                f" → resolve with `/work-plan dedupe-tiers{hint}`.",
                 file=sys.stderr,
             )
         else:
@@ -85,6 +88,63 @@ def discover_tracks(cfg: dict) -> list[Track]:
     return merged
 
 
+def issue_refs(track: "Track") -> set:
+    """All GitHub issue numbers a track references: the union of its frontmatter
+    `github.issues` list and every `#NNNN` token in its body. Used by
+    dedupe-tiers as the no-data-loss invariant — a private copy is only safe to
+    drop when its issue refs are a subset of the shared twin's.
+    """
+    refs: set = set()
+    fm_issues = (track.meta.get("github") or {}).get("issues") or []
+    for n in fm_issues:
+        try:
+            refs.add(int(n))
+        except (TypeError, ValueError):
+            continue
+    for m in re.finditer(r"#(\d+)", track.body or ""):
+        refs.add(int(m.group(1)))
+    return refs
+
+
+def find_tier_duplicates(cfg: dict) -> list:
+    """Return (shared, private) Track pairs that collide on (repo, name) across
+    BOTH the active and archived tiers. Unlike discover_tracks, this does NOT
+    print a warning and does NOT drop the private side — it hands both copies to
+    the caller (dedupe-tiers) so the orphan can be inspected and removed.
+    """
+    pairs: list = []
+
+    # A duplicate requires a PRIVATE copy, which lives under notes_root. With no
+    # notes_root configured there can be no private tier and thus no duplicates —
+    # return early (also keeps the helper safe to call with a bare cfg).
+    if not cfg.get("notes_root"):
+        return pairs
+
+    shared_active = {(t.repo, t.name): t
+                     for t in _discover_shared_tracks(cfg, include_archive=False)}
+    for t in _discover_private_tracks(cfg, include_archive=False):
+        s = shared_active.get((t.repo, t.name))
+        if s is not None:
+            pairs.append((s, t))
+
+    shared_arch = {(t.repo, t.name): t
+                   for t in _discover_shared_tracks(cfg, include_archive=True,
+                                                    archive_only=True)}
+    notes_root = Path(cfg["notes_root"]).expanduser()
+    if notes_root.exists():
+        for md_path in sorted(notes_root.rglob("*.md")):
+            if "archive" not in md_path.parts:
+                continue
+            if md_path.name.startswith((".", "_", "-")):
+                continue
+            t = _build_track(md_path, notes_root, cfg)
+            s = shared_arch.get((t.repo, t.name))
+            if s is not None:
+                pairs.append((s, t))
+
+    return pairs
+
+
 def filter_tracks_by_repo(tracks: list[Track], key: str) -> list[Track]:
     """Filter tracks by repo. Matches the config-key folder name OR the
     `org/repo` GitHub slug, so users can pass either. Case-insensitive."""
@@ -176,10 +236,12 @@ def discover_archived_tracks(cfg: dict) -> list[Track]:
     for t in private_archived:
         key = (t.repo, t.name)
         if key in shared_keys:
+            hint = f" --repo={t.folder}" if t.folder else ""
             print(
                 f"WARN: archived track {t.name!r} (repo={t.repo!r}) exists in"
                 f" both shared ({shared_keys[key].path}) and private"
-                f" ({t.path}); using shared.",
+                f" ({t.path}); using shared."
+                f" → resolve with `/work-plan dedupe-tiers{hint}`.",
                 file=sys.stderr,
             )
         else:

package/skills/work-plan/tests/test_auto_triage.py

@@ -347,5 +347,108 @@ class AutoTriageApplyTest(unittest.TestCase):
         self.assertIn("0 issue(s) assigned", buf.getvalue())
 
 
+class AutoTriageJsonScanTest(unittest.TestCase):
+    """--json scan mode (#241): emit a machine batch with a batch_id."""
+
+    def test_json_mode_emits_batch_with_id_and_prompt(self):
+        cfg = _make_cfg()
+        tracks = [_make_track("auth-flow", "org/myrepo", [])]
+        rc, out, _ = _drive_prepare(["--json"], cfg=cfg, tracks=tracks,
+                                    open_issues=_open_issues(4501, 4502))
+        self.assertEqual(rc, 0)
+        data = json.loads(out.strip())  # stdout is a single JSON object
+        self.assertIn("batch_id", data)
+        self.assertTrue(data["batch_id"])
+        self.assertEqual({i["number"] for i in data["untracked"]}, {4501, 4502})
+        self.assertIn("prompt", data)
+        self.assertIn("answers_path", data)
+        # Track entries carry scope text for grounded matching.
+        self.assertIn("scope", data["tracks"][0])
+
+
+class AutoTriageHeuristicTest(unittest.TestCase):
+    """--heuristic (#373): the CLI writes the v2 answers file itself, no LLM."""
+
+    def test_heuristic_writes_answers_file_with_source_and_batch_id(self):
+        cfg = _make_cfg()
+        track = _make_track("auth-flow", "org/myrepo", [], slug="auth-flow")
+        track.meta["milestone_alignment"] = "v0.4"
+        open_issues = [{"number": 4501, "title": "auth thing", "state": "OPEN",
+                        "milestone": {"title": "v0.4"}, "labels": []}]
+        with tempfile.TemporaryDirectory() as tmp:
+            batch_file = Path(tmp) / "auto_triage.org_myrepo.json"
+            answers_file = Path(tmp) / "auto_triage.org_myrepo.answers.json"
+            with patch("commands.auto_triage.load_config", return_value=cfg), \
+                 patch("commands.auto_triage.discover_tracks", return_value=[track]), \
+                 patch("commands.auto_triage.fetch_open_issues", return_value=open_issues), \
+                 patch("commands.auto_triage._batch_path", return_value=batch_file), \
+                 patch("commands.auto_triage._answers_path", return_value=answers_file):
+                buf = io.StringIO()
+                with redirect_stdout(buf):
+                    rc = auto_triage.run(["--heuristic"])
+            self.assertEqual(rc, 0)
+            self.assertTrue(answers_file.exists(), "heuristic must write the answers file")
+            doc = json.loads(answers_file.read_text())
+            self.assertEqual(doc["version"], 2)
+            self.assertEqual(doc["source"], "heuristic")
+            batch = json.loads(batch_file.read_text())
+            self.assertEqual(doc["batch_id"], batch["batch_id"])  # correlates
+            sug = doc["suggestions"][0]
+            self.assertEqual(sug["issue"], 4501)
+            self.assertEqual(sug["verdict"], "suggest")
+            self.assertEqual(sug["track"], "auth-flow")
+
+
+class AutoTriageV2AnswersTest(unittest.TestCase):
+    """v2 abstain-first answers schema (#241) + back-compat with v1."""
+
+    def _batch(self, nums, batch_id="abc123"):
+        return {"batch_id": batch_id, "repo": "org/myrepo", "folder": "myrepo",
+                "untracked": [{"number": n} for n in nums]}
+
+    def test_v2_applies_only_clear_suggestions(self):
+        cfg = _make_cfg()
+        track = _make_track("auth-flow", "org/myrepo", [], slug="auth-flow")
+        answers = {"version": 2, "batch_id": "abc123", "suggestions": [
+            {"issue": 4501, "verdict": "suggest", "track": "auth-flow",
+             "margin": "clear", "confidence": 0.9, "rationale": "label area/auth"},
+            {"issue": 4502, "verdict": "suggest", "track": "auth-flow",
+             "margin": "narrow", "confidence": 0.55, "rationale": "maybe"},
+            {"issue": 4507, "verdict": "abstain", "rationale": "no fit"},
+        ]}
+        rc, mwrite, out = _drive_apply(cfg=cfg, tracks=[track],
+                                       batch=self._batch([4501, 4502, 4507]),
+                                       answers=answers)
+        self.assertEqual(rc, 0)
+        mwrite.assert_called_once()  # only the clear suggestion is written
+        written = mwrite.call_args[0][1]["github"]["issues"]
+        self.assertIn(4501, written)
+        self.assertNotIn(4502, written)  # narrow margin → left untracked
+        self.assertNotIn(4507, written)  # abstained → left untracked
+
+    def test_v1_answers_still_apply(self):
+        cfg = _make_cfg()
+        track = _make_track("auth-flow", "org/myrepo", [], slug="auth-flow")
+        answers = [{"track": "auth-flow", "issues": [4501]}]  # legacy shape
+        rc, mwrite, out = _drive_apply(cfg=cfg, tracks=[track],
+                                       batch=self._batch([4501]), answers=answers)
+        self.assertEqual(rc, 0)
+        mwrite.assert_called_once()
+        self.assertIn(4501, mwrite.call_args[0][1]["github"]["issues"])
+
+    def test_batch_id_mismatch_warns_but_applies(self):
+        cfg = _make_cfg()
+        track = _make_track("auth-flow", "org/myrepo", [], slug="auth-flow")
+        answers = {"version": 2, "batch_id": "STALE", "suggestions": [
+            {"issue": 4501, "verdict": "suggest", "track": "auth-flow",
+             "margin": "clear", "rationale": "label area/auth"}]}
+        rc, mwrite, out = _drive_apply(cfg=cfg, tracks=[track],
+                                       batch=self._batch([4501], batch_id="abc123"),
+                                       answers=answers)
+        self.assertEqual(rc, 0)
+        self.assertIn("older scan", out)
+        mwrite.assert_called_once()
+
+
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_batch_slot.py

@@ -52,11 +52,21 @@ def _drive(args, tracks=None, vis="PRIVATE"):
     cfg = {"notes_root": "/tmp/fake-notes", "repos": {"ok": {"github": "ok/repo"}}}
     gh_proc = MagicMock(returncode=0, stdout="{}", stderr="")
 
+    # Writes go through lib.membership_guard (re-read via parse_file, write via
+    # write_file). Returning each track's own meta/body lets the guard mutate
+    # them in place, so assertions on track.meta still observe the merge.
+    by_path = {str(t.path): t for t in tracks}
+
+    def fake_parse(p):
+        t = by_path[str(p)]
+        return (t.meta, t.body)
+
     with patch("commands.batch_slot.load_config", return_value=cfg), \
          patch("commands.batch_slot.discover_tracks", return_value=tracks), \
          patch("commands.batch_slot.subprocess.run", return_value=gh_proc), \
          patch("lib.write_guard.repo_visibility", return_value=vis), \
-         patch("commands.batch_slot.write_file") as mw:
+         patch("lib.membership_guard.parse_file", side_effect=fake_parse), \
+         patch("lib.membership_guard.write_file") as mw:
         buf = io.StringIO()
         with redirect_stdout(buf):
             rc = batch_slot.run(args)
@@ -272,6 +282,12 @@ class BatchSlotTest(unittest.TestCase):
         def _raise(*a, **kw):
             raise AssertionError("input() must not be called on non-interactive path")
 
+        by_path = {str(t.path): t for t in (source, target)}
+
+        def fake_parse(p):
+            t = by_path[str(p)]
+            return (t.meta, t.body)
+
         with patch("builtins.input", side_effect=_raise), \
              patch("lib.prompts.prompt_input", side_effect=_raise):
             cfg = {"notes_root": "/tmp/fake-notes", "repos": {"ok": {"github": "ok/repo"}}}
@@ -280,7 +296,8 @@ class BatchSlotTest(unittest.TestCase):
                  patch("commands.batch_slot.discover_tracks", return_value=[source, target]), \
                  patch("commands.batch_slot.subprocess.run", return_value=gh_proc), \
                  patch("lib.write_guard.repo_visibility", return_value="PRIVATE"), \
-                 patch("commands.batch_slot.write_file"):
+                 patch("lib.membership_guard.parse_file", side_effect=fake_parse), \
+                 patch("lib.membership_guard.write_file"):
                 buf = io.StringIO()
                 with redirect_stdout(buf):
                     rc = batch_slot.run(["42", "beta", "--move"])

package/skills/work-plan/tests/test_brief_autoscope.py

@@ -0,0 +1,126 @@
+"""brief cwd auto-scope (#358 Phase 2).
+
+Exercises brief.run()'s scope resolution with the resolver, config loader,
+track discovery, and the archived-reopen pass all mocked — so no network/git.
+Tracks are inactive (status 'shipped') so the render loop stays trivial; we
+assert behavior through the banner text and the `repo_key` threaded into
+`_surface_archived_reopens` (which is exactly the value used to scope both the
+track list and the archived callouts).
+"""
+import io
+import sys
+import types
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+from unittest import mock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from commands import brief
+
+
+def _track(folder, repo):
+    return types.SimpleNamespace(
+        has_frontmatter=True,
+        meta={"status": "shipped"},   # inactive → no per-track render
+        needs_init=False,
+        needs_filing=False,
+        folder=folder,
+        repo=repo,
+        path=Path(f"/notes/{folder}/{folder}.md"),
+    )
+
+
+CFG = {"repos": {
+    "work-plan-toolkit": {"local": "/code/wpt", "github": "stylusnexus/work-plan-toolkit"},
+    "defect-scan": {"local": "/code/ds", "github": "stylusnexus/defect-scan"},
+}}
+
+TRACKS = [
+    _track("work-plan-toolkit", "stylusnexus/work-plan-toolkit"),
+    _track("defect-scan", "stylusnexus/defect-scan"),
+]
+
+BANNER = "Scoped to repo"
+
+
+def _run(args, cfg=None, resolve_return=mock.DEFAULT):
+    """Run brief.run(args) with collaborators mocked. Returns (stdout, archived_mock, resolve_mock)."""
+    cfg = CFG if cfg is None else cfg
+    buf = io.StringIO()
+    with mock.patch.object(brief, "load_config", return_value=cfg), \
+         mock.patch.object(brief, "discover_tracks", return_value=list(TRACKS)), \
+         mock.patch.object(brief, "_surface_archived_reopens") as archived, \
+         mock.patch.object(brief, "resolve_repo_for_dir") as resolve:
+        if resolve_return is not mock.DEFAULT:
+            resolve.return_value = resolve_return
+        with redirect_stdout(buf):
+            brief.run(args)
+    return buf.getvalue(), archived, resolve
+
+
+def _archived_repo_key(archived):
+    self_call = archived.call_args
+    return self_call.kwargs.get("repo_key")
+
+
+class BriefAutoScopeTest(unittest.TestCase):
+    # --- auto-detect on (default) -------------------------------------------
+
+    def test_autoscope_prints_banner_and_scopes(self):
+        out, archived, _ = _run(
+            [], resolve_return={"key": "work-plan-toolkit",
+                                "github": "stylusnexus/work-plan-toolkit",
+                                "matched_by": "local"})
+        self.assertIn(BANNER, out)
+        self.assertIn("work-plan-toolkit", out)
+        # archived-reopen pass scoped to the same detected key
+        self.assertEqual(_archived_repo_key(archived), "work-plan-toolkit")
+
+    def test_archived_reopens_scoped_to_detected_repo(self):
+        _, archived, _ = _run(
+            [], resolve_return={"key": "defect-scan",
+                                "github": "stylusnexus/defect-scan",
+                                "matched_by": "local"})
+        self.assertEqual(_archived_repo_key(archived), "defect-scan")
+
+    def test_banner_printed_exactly_once(self):
+        out, _, _ = _run(
+            [], resolve_return={"key": "work-plan-toolkit",
+                                "github": "stylusnexus/work-plan-toolkit",
+                                "matched_by": "local"})
+        self.assertEqual(out.count(BANNER), 1)
+
+    def test_no_match_shows_all_no_banner(self):
+        out, archived, _ = _run([], resolve_return=None)
+        self.assertNotIn(BANNER, out)
+        self.assertIsNone(_archived_repo_key(archived))
+
+    # --- explicit --repo / escape hatch -------------------------------------
+
+    def test_repo_all_shows_everything_no_banner_no_autodetect(self):
+        out, archived, resolve = _run(["--repo=all"])
+        self.assertNotIn(BANNER, out)
+        self.assertIsNone(_archived_repo_key(archived))
+        resolve.assert_not_called()   # --repo=all must short-circuit auto-detect
+
+    def test_explicit_repo_scopes_without_banner_or_autodetect(self):
+        out, archived, resolve = _run(["--repo=defect-scan"])
+        self.assertNotIn(BANNER, out)
+        self.assertEqual(_archived_repo_key(archived), "defect-scan")
+        resolve.assert_not_called()
+
+    # --- opt-out -------------------------------------------------------------
+
+    def test_optout_disables_autoscope(self):
+        cfg = {"repos": CFG["repos"], "brief_auto_scope": False}
+        out, archived, resolve = _run([], cfg=cfg)
+        self.assertNotIn(BANNER, out)
+        self.assertIsNone(_archived_repo_key(archived))
+        resolve.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/skills/work-plan/tests/test_cwd_repo.py

@@ -0,0 +1,164 @@
+"""cwd → configured-repo resolution (#358/#357 Phase 1).
+
+All git calls are mocked, so these run offline. The resolver shells `git` via
+`lib.git_state._git`, imported into `lib.cwd_repo`'s namespace — so we patch
+`lib.cwd_repo._git`.
+"""
+import sys
+import types
+import unittest
+from pathlib import Path
+from unittest import mock
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from lib import cwd_repo
+from lib.cwd_repo import resolve_repo_for_dir, _normalize_remote_url
+
+
+def _proc(stdout="", returncode=0):
+    """A stand-in for subprocess.CompletedProcess as `_git` returns it."""
+    return types.SimpleNamespace(stdout=stdout, returncode=returncode)
+
+
+def _fake_git(toplevel=None, origin=None):
+    """Build a `_git` replacement keyed on the git subcommand.
+
+    `toplevel` / `origin` are raw stdout strings (or None → non-zero exit, i.e.
+    git failed / not a repo / no remote).
+    """
+    def _g(repo_path, *args, **kwargs):
+        if args[:2] == ("rev-parse", "--show-toplevel"):
+            return _proc(toplevel, 0) if toplevel is not None else _proc("", 128)
+        if args[:2] == ("remote", "get-url"):
+            return _proc(origin, 0) if origin is not None else _proc("", 2)
+        return _proc("", 0)
+    return _g
+
+
+# Absolute, non-symlinked paths so .resolve() is a no-op-equal on both sides.
+CFG = {
+    "repos": {
+        "work-plan-toolkit": {
+            "local": "/code/work-plan-toolkit",
+            "github": "stylusnexus/work-plan-toolkit",
+        },
+        "defect-scan": {
+            "local": "/code/defect-scan",
+            "github": "stylusnexus/defect-scan",
+        },
+        # A repo with no local clone — only a remote can match it.
+        "remote-only": {
+            "local": None,
+            "github": "stylusnexus/remote-only",
+        },
+    }
+}
+
+
+class NormalizeRemoteUrlTest(unittest.TestCase):
+    def test_scp_form(self):
+        self.assertEqual(
+            _normalize_remote_url("git@github.com:Org/Repo.git"), "org/repo")
+
+    def test_https_with_git_suffix(self):
+        self.assertEqual(
+            _normalize_remote_url("https://github.com/org/repo.git"), "org/repo")
+
+    def test_https_without_suffix(self):
+        self.assertEqual(
+            _normalize_remote_url("https://github.com/org/repo"), "org/repo")
+
+    def test_ssh_url_form(self):
+        self.assertEqual(
+            _normalize_remote_url("ssh://git@github.com/org/repo.git"), "org/repo")
+
+    def test_all_forms_land_on_same_slug(self):
+        forms = [
+            "git@github.com:org/repo.git",
+            "https://github.com/org/repo.git",
+            "https://github.com/org/repo",
+            "ssh://git@github.com/org/repo.git",
+        ]
+        slugs = {_normalize_remote_url(f) for f in forms}
+        self.assertEqual(slugs, {"org/repo"})
+
+    def test_garbage_returns_none(self):
+        self.assertIsNone(_normalize_remote_url(""))
+        self.assertIsNone(_normalize_remote_url("not-a-url"))
+
+
+class ResolveRepoForDirTest(unittest.TestCase):
+    def test_local_match_at_clone_root(self):
+        with mock.patch.object(cwd_repo, "_git",
+                               _fake_git(toplevel="/code/work-plan-toolkit")):
+            got = resolve_repo_for_dir(CFG, "/code/work-plan-toolkit")
+        self.assertEqual(got, {
+            "key": "work-plan-toolkit",
+            "github": "stylusnexus/work-plan-toolkit",
+            "matched_by": "local",
+        })
+
+    def test_local_match_from_nested_subdir(self):
+        # cwd is deep inside the clone; toplevel still resolves to the root.
+        with mock.patch.object(cwd_repo, "_git",
+                               _fake_git(toplevel="/code/work-plan-toolkit")):
+            got = resolve_repo_for_dir(
+                CFG, "/code/work-plan-toolkit/skills/work-plan/lib")
+        self.assertIsNotNone(got)
+        self.assertEqual(got["key"], "work-plan-toolkit")
+        self.assertEqual(got["matched_by"], "local")
+
+    def test_remote_match_when_local_is_null(self):
+        # Not a configured local path, but origin matches the remote-only repo.
+        with mock.patch.object(cwd_repo, "_git",
+                               _fake_git(toplevel="/somewhere/else",
+                                         origin="git@github.com:stylusnexus/remote-only.git")):
+            got = resolve_repo_for_dir(CFG, "/somewhere/else")
+        self.assertEqual(got, {
+            "key": "remote-only",
+            "github": "stylusnexus/remote-only",
+            "matched_by": "remote",
+        })
+
+    def test_local_wins_over_remote_when_they_disagree(self):
+        # toplevel == defect-scan's clone, but origin points at work-plan-toolkit.
+        # The local-path key must win.
+        with mock.patch.object(cwd_repo, "_git",
+                               _fake_git(toplevel="/code/defect-scan",
+                                         origin="git@github.com:stylusnexus/work-plan-toolkit.git")):
+            got = resolve_repo_for_dir(CFG, "/code/defect-scan")
+        self.assertEqual(got["key"], "defect-scan")
+        self.assertEqual(got["matched_by"], "local")
+
+    def test_no_match_inside_unconfigured_repo(self):
+        with mock.patch.object(cwd_repo, "_git",
+                               _fake_git(toplevel="/code/unknown",
+                                         origin="git@github.com:someone/unknown.git")):
+            self.assertIsNone(resolve_repo_for_dir(CFG, "/code/unknown"))
+
+    def test_no_match_when_not_a_git_repo(self):
+        # git rev-parse fails AND no remote — resolver returns None, no raise.
+        with mock.patch.object(cwd_repo, "_git",
+                               _fake_git(toplevel=None, origin=None)):
+            self.assertIsNone(resolve_repo_for_dir(CFG, "/tmp/plain-dir"))
+
+    def test_none_when_two_repos_share_a_local_path(self):
+        # Pathological config: two keys point at the same clone. Refuse to guess.
+        cfg = {"repos": {
+            "a": {"local": "/code/dup", "github": "org/a"},
+            "b": {"local": "/code/dup", "github": "org/b"},
+        }}
+        with mock.patch.object(cwd_repo, "_git",
+                               _fake_git(toplevel="/code/dup")):
+            self.assertIsNone(resolve_repo_for_dir(cfg, "/code/dup"))
+
+    def test_none_when_no_repos_configured(self):
+        with mock.patch.object(cwd_repo, "_git",
+                               _fake_git(toplevel="/code/x")):
+            self.assertIsNone(resolve_repo_for_dir({"repos": {}}, "/code/x"))
+
+
+if __name__ == "__main__":
+    unittest.main()