@stylusnexus/work-plan 2026.7.10 → 2026.7.13

package/README.md

@@ -383,7 +383,10 @@ The installer:
 - **Copies** (not symlinks — for Windows compatibility) `skills/work-plan` and `skills/repo-activity-summary` into `~/.claude/skills/`
 - Installs the `work-plan` launcher (`bin/work-plan` + `bin/work-plan.cmd` on Windows) and copies the standalone dispatcher (`installer/work-plan.md`) into `~/.claude/commands/work-plan.md` (the per-verb suite is plugin-only)
 - **Self-seeds** `~/.claude/work-plan/config.yml` on first run if absent (one config home for every install mode), with `notes_root` at `~/.claude/work-plan/notes`
-- Drops a `.installed-from` marker so `uninstall` knows what's safe to remove
+- Drops `.installed-from` ownership markers. Skill copies retain their source
+  marker; launchers use a stable product marker plus a SHA-256 of the installed
+  bytes, so modified or unmanaged launchers are preserved by default on both
+  reinstall and uninstall
 
 External dependencies (verified by the installer): `gh`, `git`, `yq`, `python3`.
 
@@ -503,6 +506,9 @@ The bundled `notes/` folder stays empty until you run `/work-plan init-repo <key
 - **AI subcommands (`group`, `suggest-priorities`) send issue titles to Claude** via Claude Code's existing integration. Body content, code, and PR contents are NOT sent. If your repo is private and you're cautious about what reaches the model, skip these subcommands.
 - **`init-repo` writes to your config via `yq -i`.** Inputs are JSON-encoded before being passed to `yq`, so a maliciously crafted `--github=` value can't break out of the YAML edit.
 - **`install.sh` / `install.ps1` only touch user-owned dirs.** No `sudo`, no system-wide changes, no privilege escalation.
+- **Plan and shared-track paths are repository-contained.** Plan discovery, stamping, export badges, and the VS Code opener reject absolute, traversal, and symlink escapes; stamped docs are atomically replaced so a hard link cannot write through to an outside inode. Shared `.work-plan/` creation likewise refuses a symlinked or escaping tier root.
+- **Cross-repo identity stays explicit.** The export model and VS Code viewer qualify tracks and issues by repository, so same-named tracks and same-numbered issues in different repos cannot collide in graph state, selections, or write actions.
+- **Installer ownership is content-verified.** Script-installed launchers carry a stable product marker plus a SHA-256 of the installed bytes. Reinstall and uninstall preserve unmanaged or user-modified launchers by default, and an incomplete required-skill install or failed smoke test exits nonzero.
 - **Least-privilege tool access.** The `work-plan` and `repo-activity-summary` skills declare `allowed-tools` frontmatter, so Claude Code grants them a scoped allowlist — `work-plan` gets `Bash(work-plan:*)`, `Bash(python3:*)`, and `Write` (the two-step AI subcommands' JSON cache); `repo-activity-summary` gets `Bash(gh:*)` — rather than unrestricted shell.
 
 For vulnerability reporting, threat model, and past advisories, see [SECURITY.md](./SECURITY.md).

package/VERSION

@@ -1 +1 @@
-2026.07.10+92f8eef
+2026.07.13+6341563

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stylusnexus/work-plan",
-  "version": "2026.7.10",
+  "version": "2026.7.13",
   "description": "Track-aware daily work planning over GitHub issues. Shared tracks (git-synced .work-plan/ in each repo), AI clustering (group/auto-triage), VS Code viewer, Claude Code + Codex plugins. Pure Python stdlib.",
   "bin": {
     "work-plan": "bin/work-plan"

package/skills/work-plan/commands/export.py

@@ -1,11 +1,12 @@
 """export subcommand — emit the viewer-ready JSON read surface."""
 import json
 from datetime import datetime, date
+from pathlib import Path
 from lib.config import load_config, ConfigError, resolve_local_path_for_folder
 from lib.tracks import discover_tracks, discover_archived_tracks, find_tier_duplicates, issue_refs
 from lib.github_state import fetch_export_issues, fetch_open_issues, repo_visibility
 from lib.git_state import hot_issue_numbers
-from lib.export_model import build_export
+from lib.export_model import build_export, track_key
 from lib.prompts import parse_flags
 from lib import doc_discovery
 from lib import verdict as verdict_mod
@@ -25,11 +26,13 @@ def _plan_badge(track, cfg, today, dead_days, stall_days):
     if not isinstance(rel, str) or not rel.strip():
         return None
     rel = rel.strip()
+    if Path(rel).is_absolute():
+        return {"rel": rel, "resolved": False}
     local = resolve_local_path_for_folder(track.folder, cfg) if track.folder else None
     if not local or not local.exists():
         return {"rel": rel, "resolved": False}
     doc_path = local / rel
-    if not doc_path.is_file():
+    if not doc_discovery.is_safe_doc_path(doc_path, local):
         return {"rel": rel, "resolved": False}
     doc = doc_discovery.Doc(path=doc_path, rel=rel, kind=doc_discovery.classify_kind(rel))
     row = evaluate_doc(doc, local, today, dead_days, stall_days)
@@ -85,19 +88,19 @@ def run(args: list[str]) -> int:
     issue_map = fetch_export_issues(repo_to_numbers)
 
     # Reassemble per-track lists, preserving each track's declared issue order.
-    # Keyed by (repo, name) so same-named tracks in different repos don't collide.
-    issues_by_track: dict[tuple, list] = {}
+    # Canonical track identity keeps same-named tracks in different repos apart.
+    issues_by_track: dict[tuple[str, str], list] = {}
     visibility: dict[str, object] = {}
     for t in tracks:
         nums = (t.meta.get("github", {}).get("issues")) or []
         if t.repo and nums:
-            issues_by_track[(t.repo, t.name)] = [
+            issues_by_track[track_key(t)] = [
                 issue_map[(t.repo, n)]
                 for n in nums
                 if (t.repo, n) in issue_map
             ]
         else:
-            issues_by_track[(t.repo, t.name)] = []
+            issues_by_track[track_key(t)] = []
         if t.repo and t.repo not in visibility:
             visibility[t.repo] = repo_visibility(t.repo)
 
@@ -140,14 +143,14 @@ def run(args: list[str]) -> int:
     today = date.today()
     cfg_stall = cfg.get("stall_days")
     stall_days = cfg_stall if isinstance(cfg_stall, int) else verdict_mod.STALL_DAYS
-    plan_by_track: dict[str, dict] = {}
+    plan_by_track: dict[tuple[str, str], dict] = {}
     for t in tracks:
         badge = _plan_badge(t, cfg, today, verdict_mod.DEAD_DAYS, stall_days)
         if badge is not None:
-            plan_by_track[t.name] = badge
+            plan_by_track[track_key(t)] = badge
 
-    # Per-track branch heat, keyed (repo, name) — track names collide across repos.
-    hot_by_track: dict = {}
+    # Per-track branch heat uses the same identity as issue rows and plan badges.
+    hot_by_track: dict[tuple[str, str], set] = {}
     for t in tracks:
         if not t.repo:
             continue
@@ -155,7 +158,7 @@ def run(args: list[str]) -> int:
         if local and local.exists():
             nums = hot_issue_numbers(local)
             if nums:
-                hot_by_track[(t.repo, t.name)] = nums
+                hot_by_track[track_key(t)] = nums
 
     # Shared/private tier duplicates (#361): the viewer is otherwise blind to
     # them — discover_tracks drops the private copy with a stderr-only WARN. We

package/skills/work-plan/commands/new_track.py

@@ -17,7 +17,7 @@ from pathlib import Path
 from typing import Optional
 
 from lib.config import load_config, ConfigError, is_valid_git_repo
-from lib.plan_worktree import shared_tier_dir
+from lib.plan_worktree import resolve_shared_tier
 from lib.frontmatter import write_file
 from lib.prompts import parse_flags
 from lib.write_guard import needs_confirm, make_token, valid_token
@@ -158,7 +158,10 @@ def run(args: list[str]) -> int:
             if is_valid_git_repo(local_path):
                 # Worktree-aware (#260): plan_branch repos write into the
                 # worktree's .work-plan/; None → fall back to the private tier.
-                sd = shared_tier_dir(repo_entry)
+                sd, unsafe_reason = resolve_shared_tier(repo_entry)
+                if unsafe_reason:
+                    print(f"ERROR: {unsafe_reason}")
+                    return 1
                 if sd is not None:
                     shared_path = sd / f"{slug}.md"
 
@@ -197,8 +200,24 @@ def run(args: list[str]) -> int:
     # ------------------------------------------------------------------
     # Create folder if missing, then write the track file
     # ------------------------------------------------------------------
+    if is_shared:
+        # Re-resolve at the mutation boundary.  Discovery and confirmation can
+        # take time, during which an attacker could replace `.work-plan` with a
+        # symlink.  Refuse if the selected root changed or became unavailable.
+        current_shared, unsafe_reason = resolve_shared_tier(repo_entry)
+        if unsafe_reason or current_shared is None or current_shared != path.parent:
+            print(f"ERROR: {unsafe_reason or 'shared track directory changed before write'}")
+            return 1
     path.parent.mkdir(parents=True, exist_ok=True)
 
+    if is_shared:
+        # mkdir may have created the tier; validate that concrete directory once
+        # more before handing the file path to the frontmatter writer.
+        current_shared, unsafe_reason = resolve_shared_tier(repo_entry)
+        if unsafe_reason or current_shared is None or current_shared != path.parent:
+            print(f"ERROR: {unsafe_reason or 'shared track directory changed before write'}")
+            return 1
+
     now = datetime.now().strftime("%Y-%m-%dT%H:%M")
     meta = {
         "track": slug,

package/skills/work-plan/commands/plan_status.py

@@ -5,7 +5,10 @@ Phase 1: read-only. Reports a human table or --json. Never mutates a doc.
 Manifest-less (prose) docs are flagged 👻 for the Phase 1b LLM pass.
 """
 import json
+import os
+import stat
 import sys
+import tempfile
 from datetime import date, timedelta
 from pathlib import Path
 
@@ -247,21 +250,60 @@ def _render(rows, repo_root) -> None:
         print()
 
 
-def _stamp_docs(docs, rows, draft: bool) -> None:
+def _stamp_docs(docs, rows, repo_root, draft: bool) -> None:
     changed = []
     for doc, row in zip(docs, rows):
+        if not doc_discovery.is_safe_doc_path(doc.path, repo_root):
+            print(f"WARN: refusing to stamp unsafe path: {doc.rel}")
+            continue
         text = doc.path.read_text(encoding="utf-8", errors="replace")
         new = status_header.stamp(text, row)
         if new != text:
-            changed.append(doc.rel)
-            if not draft:
-                doc.path.write_text(new, encoding="utf-8")
+            if draft:
+                changed.append(doc.rel)
+            elif _replace_doc_text(doc.path, new, repo_root):
+                changed.append(doc.rel)
+            else:
+                print(f"WARN: refusing to stamp unsafe path: {doc.rel}")
     verb = "would stamp" if draft else "stamped"
     print(f"\n{verb} {len(changed)} doc(s):")
     for rel in changed:
         print(f"  {rel}")
 
 
+def _replace_doc_text(path: Path, text: str, repo_root: Path) -> bool:
+    """Atomically replace a validated doc without writing through hard links."""
+    path = Path(path)
+    tmp_path = None
+    try:
+        original_mode = stat.S_IMODE(path.stat().st_mode)
+        with tempfile.NamedTemporaryFile(
+                mode="w", encoding="utf-8", dir=str(path.parent),
+                prefix=f".{path.name}.", suffix=".tmp", delete=False) as tmp:
+            tmp.write(text)
+            tmp.flush()
+            os.fsync(tmp.fileno())
+            tmp_path = Path(tmp.name)
+        os.chmod(str(tmp_path), original_mode)
+
+        # Recheck immediately before replacement.  os.replace swaps the directory
+        # entry instead of following a final-component symlink and also breaks any
+        # hard-link relationship held by the original inode.
+        if not doc_discovery.is_safe_doc_path(path, repo_root):
+            return False
+        os.replace(str(tmp_path), str(path))
+        tmp_path = None
+        return True
+    except OSError:
+        return False
+    finally:
+        if tmp_path is not None:
+            try:
+                tmp_path.unlink()
+            except OSError:
+                pass
+
+
 _LLM_VERDICTS = {"shipped", "partial", "dead"}
 _LLM_GLYPH = {"shipped": "✅", "partial": "🟡", "dead": "💀"}
 
@@ -336,7 +378,7 @@ def _llm_apply(docs, rows, repo_root, stamp: bool, draft: bool) -> int:
 
     _render(rows, repo_root)
     if stamp:
-        _stamp_docs(docs, rows, draft=draft)
+        _stamp_docs(docs, rows, repo_root=repo_root, draft=draft)
     return 0
 
 
@@ -551,5 +593,5 @@ def run(args: list) -> int:
     if flags.get("--stamp"):
         live_docs = [d for d in docs if not d.archived]
         _stamp_docs(live_docs, [r for r in rows if not r.get("archived")],
-                    draft=bool(flags.get("--draft")))
+                    repo_root=repo_root, draft=bool(flags.get("--draft")))
     return 0

package/skills/work-plan/lib/doc_discovery.py

@@ -30,6 +30,26 @@ def classify_kind(rel: str) -> str:
     return "adhoc"
 
 
+def is_safe_doc_path(path: Path, repo_root: Path) -> bool:
+    """Return whether an existing doc resolves to a regular file inside the repo.
+
+    ``Path.is_file()`` follows symlinks, so it is not sufficient for paths that
+    may later be stamped.  Reject a symlink at the final component and require
+    the fully-resolved target to remain beneath the resolved repository root.
+    The write path calls this again to avoid trusting discovery-time state.
+    """
+    path = Path(path)
+    try:
+        if path.is_symlink():
+            return False
+        resolved_root = Path(repo_root).resolve(strict=True)
+        resolved_path = path.resolve(strict=True)
+        resolved_path.relative_to(resolved_root)
+        return resolved_path.is_file()
+    except (OSError, ValueError):
+        return False
+
+
 def discover_docs(repo_root: Path, globs: Optional[list] = None,
                   include_archived: bool = False) -> list:
     globs = globs or DEFAULT_GLOBS
@@ -38,7 +58,7 @@ def discover_docs(repo_root: Path, globs: Optional[list] = None,
     seen = set()
     for g in globs:
         for p in sorted(repo_root.glob(g)):
-            if not p.is_file() or p in seen:
+            if not is_safe_doc_path(p, repo_root) or p in seen:
                 continue
             seen.add(p)
             rel = p.relative_to(repo_root).as_posix()
@@ -48,7 +68,7 @@ def discover_docs(repo_root: Path, globs: Optional[list] = None,
             parent = g.rsplit("/", 1)[0]            # "docs/plans/*.md" -> "docs/plans"
             for sub, kind in ARCHIVE_SUBDIRS:
                 for p in sorted(repo_root.glob(f"{parent}/{sub}/*.md")):
-                    if not p.is_file() or p in seen:
+                    if not is_safe_doc_path(p, repo_root) or p in seen:
                         continue
                     seen.add(p)
                     rel = p.relative_to(repo_root).as_posix()

package/skills/work-plan/lib/export_model.py

@@ -5,6 +5,18 @@ from lib.next_up import resolve_next_up_order, suggest_next_up
 SCHEMA = 1
 
 
+def track_key(track) -> tuple[str, str]:
+    """Return the canonical internal identity for a track.
+
+    The config folder key is the CLI repo qualifier and keeps separately
+    configured sources distinct even when they point at the same GitHub repo.
+    Older/minimal tracks without a folder fall back to the GitHub slug. The key
+    is internal to export assembly and does not change the schema-1 JSON surface.
+    """
+    scope = getattr(track, "folder", None) or getattr(track, "repo", None) or ""
+    return (scope, track.name)
+
+
 def milestone_sort_key(issue: dict, milestone_alignment=None):
     """Sort key for an issue dict (must have 'number' and 'milestone').
 
@@ -92,8 +104,9 @@ def build_export(tracks, issues_by_track, visibility, now: str,
     out = {"schema": SCHEMA, "generated_at": now, "tracks": []}
     for t in tracks:
         from lib.in_progress import issue_in_progress, IN_PROGRESS_LABEL
-        hot = hot_by_track.get((t.repo, t.name), set())
-        raw = issues_by_track.get((t.repo, t.name), [])
+        key = track_key(t)
+        hot = hot_by_track.get(key, set())
+        raw = issues_by_track.get(key, [])
         issues = [
             normalize_issue(
                 i,
@@ -158,7 +171,7 @@ def build_export(tracks, issues_by_track, visibility, now: str,
             # The track's declared plan/spec doc + its execution badge (#285), or
             # null when the track declares no `plan:`. `{rel, resolved:false}` when
             # the link can't be resolved (no local clone / file absent).
-            "plan": plan_by_track.get(t.name),
+            "plan": plan_by_track.get(key),
             # Effective next_up ranking preset for this track (#326 Phase 2).
             "next_up_preset": next_up_preset_name,
             # True when the track has `next_up_auto: true` set in its frontmatter,

package/skills/work-plan/lib/plan_worktree.py

@@ -190,6 +190,51 @@ def commit_shared_tier(worktree: Path, message: str, paths) -> Optional[str]:
     return head.stdout.strip() or None
 
 
+def _contained_shared_tier(root: Path) -> tuple:
+    """Return ``(<root>/.work-plan, None)`` when the tier is safely contained.
+
+    The shared-tier directory itself is never allowed to be a symlink, even if
+    it currently points back inside ``root``.  Refusing the indirection keeps a
+    later retarget from changing the write destination after validation.
+    ``resolve(strict=False)`` also catches symlinked ancestors and proves that
+    the resulting directory remains below the resolved repository/worktree.
+    """
+    candidate = root / ".work-plan"
+    try:
+        resolved_root = root.resolve(strict=True)
+        if not resolved_root.is_dir():
+            return None, f"shared track root is not a directory: {root}"
+        if candidate.is_symlink():
+            return None, f"unsafe shared track directory is a symlink: {candidate}"
+        if candidate.exists() and not candidate.is_dir():
+            return None, f"unsafe shared track path is not a directory: {candidate}"
+        resolved_candidate = candidate.resolve(strict=False)
+        resolved_candidate.relative_to(resolved_root)
+    except (OSError, RuntimeError, ValueError):
+        return None, f"unsafe shared track directory escapes its root: {candidate}"
+    return candidate, None
+
+
+def resolve_shared_tier(entry: dict) -> tuple:
+    """Resolve a repo's shared tier as ``(path, unsafe_reason)``.
+
+    ``unsafe_reason`` is populated only when a candidate root exists but fails
+    containment validation.  Operational absence (no local path, unavailable
+    plan branch) remains ``(None, None)`` so read-only callers retain the
+    existing graceful-degradation behaviour.
+    """
+    if not entry or not entry.get("local"):
+        return None, None
+    local_path = Path(entry["local"]).expanduser()
+    branch = entry.get("plan_branch")
+    if branch:
+        worktree = ensure_worktree(local_path, branch)
+        if worktree is None:
+            return None, None
+        return _contained_shared_tier(worktree)
+    return _contained_shared_tier(local_path)
+
+
 def shared_tier_dir(entry: dict) -> Optional[Path]:
     """The `.work-plan/` directory to read/write for a repo config `entry`.
 
@@ -199,14 +244,8 @@ def shared_tier_dir(entry: dict) -> Optional[Path]:
 
     Returns None when the entry has no `local` path. Never raises.
     """
-    if not entry or not entry.get("local"):
-        return None
-    local_path = Path(entry["local"]).expanduser()
-    branch = entry.get("plan_branch")
-    if branch:
-        worktree = ensure_worktree(local_path, branch)
-        return (worktree / ".work-plan") if worktree else None
-    return local_path / ".work-plan"
+    path, _unsafe_reason = resolve_shared_tier(entry)
+    return path
 
 
 # ---------------------------------------------------------------------------

package/skills/work-plan/tests/test_discover_archived.py

@@ -42,6 +42,21 @@ class DiscoverArchivedTest(unittest.TestCase):
                 by_rel["docs/plans/archive/abandoned/dead.md"].archive_kind, "abandoned")
             self.assertFalse(by_rel["docs/plans/live.md"].archived)
 
+    def test_include_archived_skips_symlinked_doc_outside_repo(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = _repo(d)
+            victim = Path(d) / "outside.md"
+            victim.write_text("# outside\n")
+            link = root / "docs/plans/archive/shipped/linked.md"
+            link.symlink_to(victim)
+
+            docs = doc_discovery.discover_docs(root, include_archived=True)
+
+            self.assertNotIn(
+                "docs/plans/archive/shipped/linked.md",
+                {doc.rel for doc in docs},
+            )
+
 
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_doc_discovery.py

@@ -46,6 +46,17 @@ class DiscoverDocsTest(unittest.TestCase):
             self.assertEqual(kinds["docs/superpowers/plans/2026-03-16-a.md"], "plan")
             self.assertEqual(kinds["docs/plans/2026-02-17-b-design.md"], "spec")
 
+    def test_skips_symlinked_doc_that_resolves_outside_repo(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/plans"
+            plans.mkdir(parents=True)
+            victim = Path(d) / "victim.md"
+            victim.write_text("# outside\n")
+            (plans / "evil.md").symlink_to(victim)
+
+            self.assertEqual(discover_docs(root), [])
+
 
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_export.py

@@ -3,18 +3,44 @@ import sys, json, unittest
 from pathlib import Path
 from types import SimpleNamespace
 SKILL_ROOT = Path(__file__).resolve().parents[1]; sys.path.insert(0, str(SKILL_ROOT))
-from lib.export_model import build_export
+from lib.export_model import build_export, track_key
 import commands.export as export_cmd
 
 def _track(name, repo, issues, blockers=None, next_up=None, status="active", depends_on=None):
     return SimpleNamespace(name=name, repo=repo, tier="private",
-        path=Path(f"/tmp/notes/{name}.md"), folder="myrepo",
+        path=Path(f"/tmp/notes/{name}.md"), folder=repo,
         meta={"status": status, "launch_priority": "P2", "milestone_alignment": "v1",
               "blockers": blockers or [], "next_up": next_up or [],
               "depends_on": depends_on or [],
               "github": {"repo": repo, "issues": issues}})
 
 class BuildExportTest(unittest.TestCase):
+    def test_track_key_prefers_config_folder_over_repo_slug(self):
+        track = SimpleNamespace(name="alpha", repo="org/repo", folder="config-folder")
+        self.assertEqual(track_key(track), ("config-folder", "alpha"))
+
+    def test_track_key_falls_back_to_folder_without_repo(self):
+        track = SimpleNamespace(name="alpha", repo=None, folder="config-folder")
+        self.assertEqual(track_key(track), ("config-folder", "alpha"))
+
+    def test_folder_identity_is_shared_by_issue_hot_and_plan_maps(self):
+        track = _track("alpha", None, [7])
+        track.folder = "config-folder"
+        key = ("config-folder", "alpha")
+        badge = {"rel": "docs/plans/p.md", "resolved": False}
+        issues = [{"number": 7, "title": "folder-only", "state": "OPEN",
+                   "assignees": [], "labels": []}]
+
+        out = build_export(
+            [track], {key: issues}, {}, now="t",
+            plan_by_track={key: badge}, hot_by_track={key: {7}},
+        )
+
+        exported = out["tracks"][0]
+        self.assertEqual(exported["plan"], badge)
+        self.assertEqual(exported["issues"][0]["number"], 7)
+        self.assertTrue(exported["issues"][0]["in_progress"])
+
     def test_schema_and_shape(self):
         tracks = [_track("ph", "o/r", [1, 2], blockers=[9], next_up=[1])]
         issues_by_track = {("o/r", "ph"): [
@@ -31,7 +57,7 @@ class BuildExportTest(unittest.TestCase):
         # the platform — str(Path) yields backslashes on Windows.
         self.assertEqual(t["path"], str(Path("/tmp/notes/ph.md")))
         # Config repo key surfaces for the Plans view's --repo arg (#164).
-        self.assertEqual(t["folder"], "myrepo")
+        self.assertEqual(t["folder"], "o/r")
         self.assertEqual(t["blockers"], [9]); self.assertEqual(t["next_up"], [1])
         self.assertEqual(t["rollup"], {"open": 1, "closed": 1})
         self.assertEqual(t["issues"][0], {"number": 1, "title": "a", "state": "open", "assignee": "@eve", "milestone": None, "in_progress": False, "in_progress_label": False, "blocked_by": [], "blocking": []})
@@ -74,7 +100,7 @@ class BuildExportNextUpAutoTest(unittest.TestCase):
         if auto:
             meta["next_up_auto"] = True
         return SimpleNamespace(name="t", repo="o/r", tier="private",
-                               path=Path("/tmp/notes/t.md"), folder="myrepo", meta=meta)
+                               path=Path("/tmp/notes/t.md"), folder="o/r", meta=meta)
 
     def _issues(self):
         # P0 #3, P1 #2, P2 #1 — flow ranks by priority within the same milestone.
@@ -113,7 +139,7 @@ class BuildExportNextUpAutoTest(unittest.TestCase):
         from types import SimpleNamespace
         from pathlib import Path
         t = SimpleNamespace(name="t", repo="o/r", tier="private",
-                            path=Path("/tmp/notes/t.md"), folder="myrepo", meta=meta)
+                            path=Path("/tmp/notes/t.md"), folder="o/r", meta=meta)
         out = build_export([t],
                            {("o/r", "t"): []},           # zero issues fetched
                            {"o/r": "PRIVATE"}, now="t")
@@ -381,13 +407,13 @@ class BuildExportPlanTest(unittest.TestCase):
                  "checkboxes_done": 0, "checkboxes_total": 24, "lie_gap": False,
                  "stalled": False, "override": "shipped"}
         out = build_export(tracks, {("o/r", "alpha"): []}, {"o/r": "PRIVATE"}, now="t",
-                           plan_by_track={"alpha": badge})
+                           plan_by_track={("o/r", "alpha"): badge})
         self.assertEqual(out["tracks"][0]["plan"], badge)
 
     def test_unresolved_badge_passed_through(self):
         tracks = [_track("alpha", "o/r", [1])]
         out = build_export(tracks, {("o/r", "alpha"): []}, {"o/r": "PRIVATE"}, now="t",
-                           plan_by_track={"alpha": {"rel": "docs/plans/p.md", "resolved": False}})
+                           plan_by_track={("o/r", "alpha"): {"rel": "docs/plans/p.md", "resolved": False}})
         self.assertEqual(out["tracks"][0]["plan"], {"rel": "docs/plans/p.md", "resolved": False})
 
 
@@ -583,7 +609,7 @@ class BuildExportNextUpPresetTest(unittest.TestCase):
         if track_meta_override:
             meta.update(track_meta_override)
         t = SimpleNamespace(name="alpha", repo="o/r", tier="private",
-                            path=Path("/tmp/notes/alpha.md"), folder="myrepo",
+                            path=Path("/tmp/notes/alpha.md"), folder="o/r",
                             meta=meta)
         out = build_export([t], {("o/r", "alpha"): []}, {"o/r": "PRIVATE"},
                            now="2026-06-14T00:00", next_up_default=next_up_default)

package/skills/work-plan/tests/test_export_command.py

@@ -263,6 +263,53 @@ class ExportRunJsonTest(unittest.TestCase):
         # repoB: issue 1 — once
         self.assertEqual(repo_to_numbers[repo_b], [1])
 
+    def test_same_name_tracks_in_different_repos_keep_distinct_plan_badges(self):
+        """Plan badges must follow track identity, not collide on track name."""
+        repo_a = "org/repoA"
+        repo_b = "org/repoB"
+        track_a = _track("shared-name", repo_a, [])
+        track_b = _track("shared-name", repo_b, [])
+        track_a.folder = "repo-a"
+        track_b.folder = "repo-b"
+        track_a.meta["plan"] = "docs/plans/a.md"
+        track_b.meta["plan"] = "docs/plans/b.md"
+
+        def _badge(track, *_args):
+            return {"rel": track.meta["plan"], "resolved": False}
+
+        with patch("commands.export._plan_badge", side_effect=_badge):
+            rc, out, _ = self._run_with_mocks(
+                [track_a, track_b], {}, vis={repo_a: "PUBLIC", repo_b: "PRIVATE"}
+            )
+
+        self.assertEqual(rc, 0)
+        by_repo = {track["repo"]: track for track in out["tracks"]}
+        self.assertEqual(by_repo[repo_a]["plan"]["rel"], "docs/plans/a.md")
+        self.assertEqual(by_repo[repo_b]["plan"]["rel"], "docs/plans/b.md")
+
+    def test_same_repo_alias_folders_keep_distinct_plan_badges(self):
+        """Folder keys remain distinct even when aliases share a GitHub slug."""
+        repo = "org/shared"
+        track_a = _track("shared-name", repo, [])
+        track_b = _track("shared-name", repo, [])
+        track_a.folder = "alias-a"
+        track_b.folder = "alias-b"
+        track_a.meta["plan"] = "docs/plans/a.md"
+        track_b.meta["plan"] = "docs/plans/b.md"
+
+        def _badge(track, *_args):
+            return {"rel": track.meta["plan"], "resolved": False}
+
+        with patch("commands.export._plan_badge", side_effect=_badge):
+            rc, out, _ = self._run_with_mocks(
+                [track_a, track_b], {}, vis={repo: "PRIVATE"}
+            )
+
+        self.assertEqual(rc, 0)
+        by_folder = {track["folder"]: track for track in out["tracks"]}
+        self.assertEqual(by_folder["alias-a"]["plan"]["rel"], "docs/plans/a.md")
+        self.assertEqual(by_folder["alias-b"]["plan"]["rel"], "docs/plans/b.md")
+
 
 class ExportCommandUntrackedTest(unittest.TestCase):
     """Verify export.run computes untracked = open issues minus tracked ones."""
@@ -435,6 +482,60 @@ class ExportPlanBadgeTest(unittest.TestCase):
             badge = self._badge(self._track_with_plan(rel="docs/plans/missing.md"), root)
             self.assertEqual(badge, {"rel": "docs/plans/missing.md", "resolved": False})
 
+    def test_unresolved_when_plan_traverses_outside_repo(self):
+        import tempfile
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            root.mkdir()
+            outside = Path(d) / "outside.md"
+            outside.write_text(self.BODY)
+            rel = "../outside.md"
+
+            badge = self._badge(self._track_with_plan(rel=rel), root)
+
+            self.assertEqual(badge, {"rel": rel, "resolved": False})
+
+    def test_unresolved_when_plan_is_absolute_path(self):
+        import tempfile
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            root.mkdir()
+            outside = Path(d) / "outside.md"
+            outside.write_text(self.BODY)
+            rel = str(outside)
+
+            badge = self._badge(self._track_with_plan(rel=rel), root)
+
+            self.assertEqual(badge, {"rel": rel, "resolved": False})
+
+    def test_unresolved_when_plan_is_absolute_path_inside_repo(self):
+        import tempfile
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo_with_plan(d, self.BODY)
+            rel = str(root / "docs/plans/p.md")
+
+            badge = self._badge(self._track_with_plan(rel=rel), root)
+
+            self.assertEqual(badge, {"rel": rel, "resolved": False})
+
+    def test_unresolved_when_plan_symlink_resolves_outside_repo(self):
+        import tempfile
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/plans"
+            plans.mkdir(parents=True)
+            outside = Path(d) / "outside.md"
+            outside.write_text(self.BODY)
+            link = plans / "p.md"
+            link.symlink_to(outside)
+
+            badge = self._badge(self._track_with_plan(), root)
+
+            self.assertEqual(
+                badge,
+                {"rel": "docs/plans/p.md", "resolved": False},
+            )
+
     def test_no_folder_is_unresolved(self):
         t = self._track_with_plan(folder=None)
         from datetime import date

package/skills/work-plan/tests/test_group_apply.py

@@ -77,6 +77,8 @@ def _drive_apply(args, *, cfg, batch, answers, vis="PRIVATE"):
              patch("commands.group.load_config", return_value=cfg), \
              patch("lib.write_guard.repo_visibility", return_value=vis), \
              patch("commands.group.is_valid_git_repo", return_value=True), \
+             patch("commands.group.shared_tier_dir",
+                   return_value=Path(cfg["repos"]["myrepo"]["local"]) / ".work-plan"), \
              patch("commands.group.write_file") as mw, \
              patch("commands.group.parse_file", return_value=({}, "")), \
              patch("commands.group.seed_readme") as mseed, \
@@ -193,6 +195,8 @@ class GroupApplyTierRoutingTest(unittest.TestCase):
                  patch("commands.group.load_config", return_value=cfg), \
                  patch("lib.write_guard.repo_visibility", return_value="PRIVATE"), \
                  patch("commands.group.is_valid_git_repo", return_value=True), \
+                 patch("commands.group.shared_tier_dir",
+                       return_value=Path(cfg["repos"]["myrepo"]["local"]) / ".work-plan"), \
                  patch("commands.group.write_file"), \
                  patch("commands.group.parse_file", return_value=({}, "")), \
                  patch("commands.group.seed_readme") as mseed, \

package/skills/work-plan/tests/test_new_track.py

@@ -20,6 +20,7 @@ import io
 import json
 import subprocess
 import sys
+import tempfile
 import unittest
 from contextlib import redirect_stdout
 from pathlib import Path
@@ -441,6 +442,82 @@ class NewTrackCommandTest(unittest.TestCase):
         self.assertEqual(rc, 0)
         mw.assert_called_once()
 
+    def test_refuses_shared_track_when_work_plan_root_is_symlinked_outside_repo(self):
+        """A repo-controlled shared root must not redirect creation elsewhere."""
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            clone = base / "clone"
+            outside = base / "outside"
+            notes = base / "notes"
+            (clone / ".git").mkdir(parents=True)
+            outside.mkdir()
+            notes.mkdir()
+            try:
+                (clone / ".work-plan").symlink_to(outside, target_is_directory=True)
+            except OSError as exc:
+                self.skipTest(f"directory symlinks unavailable: {exc}")
+            cfg = {
+                "notes_root": str(notes),
+                "repos": {
+                    "myrepo": {"github": "org/myrepo", "local": str(clone)},
+                },
+            }
+
+            with patch("commands.new_track.load_config", return_value=cfg), \
+                 patch("lib.write_guard.repo_visibility", return_value="PRIVATE"):
+                buf = io.StringIO()
+                with redirect_stdout(buf):
+                    rc = new_track.run(["myrepo", "escaped"])
+
+            self.assertEqual(rc, 1)
+            self.assertFalse((outside / "escaped.md").exists())
+            self.assertIn("unsafe shared track directory", buf.getvalue())
+
+    def test_rechecks_shared_root_after_directory_creation_before_write(self):
+        """A root swapped after mkdir is rejected before write_file opens it."""
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            clone = base / "clone"
+            outside = base / "outside"
+            notes = base / "notes"
+            (clone / ".git").mkdir(parents=True)
+            outside.mkdir()
+            notes.mkdir()
+            cfg = {
+                "notes_root": str(notes),
+                "repos": {
+                    "myrepo": {"github": "org/myrepo", "local": str(clone)},
+                },
+            }
+            real_resolve = new_track.resolve_shared_tier
+            calls = 0
+
+            def _swap_after_mkdir(entry):
+                nonlocal calls
+                calls += 1
+                if calls == 3:
+                    shared = clone / ".work-plan"
+                    shared.rmdir()
+                    try:
+                        shared.symlink_to(outside, target_is_directory=True)
+                    except OSError as exc:
+                        self.skipTest(f"directory symlinks unavailable: {exc}")
+                return real_resolve(entry)
+
+            with patch("commands.new_track.load_config", return_value=cfg), \
+                 patch("commands.new_track.resolve_shared_tier",
+                       side_effect=_swap_after_mkdir), \
+                 patch("commands.new_track.write_file") as write, \
+                 patch("lib.write_guard.repo_visibility", return_value="PRIVATE"):
+                buf = io.StringIO()
+                with redirect_stdout(buf):
+                    rc = new_track.run(["myrepo", "escaped"])
+
+            self.assertEqual(rc, 1)
+            write.assert_not_called()
+            self.assertFalse((outside / "escaped.md").exists())
+            self.assertIn("unsafe shared track directory", buf.getvalue())
+
 
 # ---------------------------------------------------------------------------
 # Phase D: --commit flag tests
@@ -504,6 +581,8 @@ class NewTrackCommitFlagTest(unittest.TestCase):
 
         with patch("commands.new_track.load_config", return_value=cfg), \
              patch("commands.new_track.write_file") as mw, \
+             patch("commands.new_track.resolve_shared_tier",
+                   return_value=(Path(CLONE_ROOT) / ".work-plan", None)), \
              patch("lib.write_guard.repo_visibility", return_value="PRIVATE"), \
              patch("pathlib.Path.exists", _path_exists), \
              patch("pathlib.Path.is_dir", _is_dir), \

package/skills/work-plan/tests/test_plan_status_stamp.py

@@ -1,5 +1,6 @@
 """Stamp / draft behaviour for plan-status (offline)."""
 import io
+import os
 import unittest
 import sys
 import tempfile
@@ -11,6 +12,7 @@ SKILL_ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(SKILL_ROOT))
 
 from commands import plan_status
+from lib.doc_discovery import Doc
 from lib.status_header import BEGIN
 
 PLAN = (
@@ -21,6 +23,14 @@ PLAN = (
     "- [ ] Step 1\n"
 )
 
+ROW = {
+    "glyph": "✅",
+    "verdict": "shipped",
+    "files_present": 1,
+    "files_declared": 1,
+    "last_touched": "2026-07-12",
+}
+
 
 class StampBehaviourTest(unittest.TestCase):
     def _repo(self, d):
@@ -65,6 +75,64 @@ class StampBehaviourTest(unittest.TestCase):
             self._run(root, ["--stamp"])
             self.assertEqual(first, self.plan_path.read_text())
 
+    def test_stamp_rechecks_symlink_before_write(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/plans"
+            plans.mkdir(parents=True)
+            victim = Path(d) / "victim.md"
+            victim.write_text("# outside\n")
+            link = plans / "evil.md"
+            link.symlink_to(victim)
+            doc = Doc(path=link, rel="docs/plans/evil.md", kind="plan")
+
+            buf = io.StringIO()
+            with redirect_stdout(buf):
+                plan_status._stamp_docs([doc], [ROW], repo_root=root, draft=False)
+
+            self.assertEqual(victim.read_text(), "# outside\n")
+            self.assertIn("refusing to stamp unsafe path", buf.getvalue())
+
+    def test_stamp_cli_does_not_modify_outside_symlink_target(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/superpowers/plans"
+            plans.mkdir(parents=True)
+            victim = Path(d) / "victim.md"
+            victim.write_text(PLAN)
+            before = victim.read_bytes()
+            (plans / "evil.md").symlink_to(victim)
+
+            rc, out = self._run(root, ["--stamp"])
+
+            self.assertEqual(rc, 0)
+            self.assertEqual(victim.read_bytes(), before)
+            self.assertNotIn(BEGIN, victim.read_text())
+            self.assertIn("stamped 0 doc(s)", out)
+
+    def test_stamp_replaces_hard_link_without_modifying_outside_inode(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/superpowers/plans"
+            plans.mkdir(parents=True)
+            victim = Path(d) / "victim.md"
+            victim.write_text(PLAN)
+            linked_plan = plans / "linked.md"
+            try:
+                os.link(str(victim), str(linked_plan))
+            except OSError as exc:
+                self.skipTest(f"hard links unavailable: {exc}")
+            original_inode = victim.stat().st_ino
+
+            rc, out = self._run(root, ["--stamp"])
+
+            self.assertEqual(rc, 0)
+            self.assertEqual(victim.read_text(), PLAN)
+            self.assertEqual(victim.stat().st_ino, original_inode)
+            self.assertNotEqual(linked_plan.stat().st_ino, original_inode)
+            self.assertIn(BEGIN, linked_plan.read_text())
+            self.assertIn("stamped 1 doc(s)", out)
+
 
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_plan_worktree.py

@@ -97,6 +97,20 @@ class SharedTierDirTest(unittest.TestCase):
             got = pw.shared_tier_dir({"local": d})
             self.assertEqual(got, Path(d).expanduser() / ".work-plan")
 
+    def test_no_plan_branch_refuses_symlinked_work_plan_root(self):
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            clone = base / "clone"
+            outside = base / "outside"
+            clone.mkdir()
+            outside.mkdir()
+            try:
+                (clone / ".work-plan").symlink_to(outside, target_is_directory=True)
+            except OSError as exc:
+                self.skipTest(f"directory symlinks unavailable: {exc}")
+
+            self.assertIsNone(pw.shared_tier_dir({"local": str(clone)}))
+
     def test_plan_branch_uses_worktree_when_present(self):
         with tempfile.TemporaryDirectory() as d:
             dest = Path(d) / "wt"
@@ -107,6 +121,23 @@ class SharedTierDirTest(unittest.TestCase):
                 got = pw.shared_tier_dir({"local": d, "plan_branch": "plan"})
             self.assertEqual(got, dest / ".work-plan")
 
+    def test_plan_branch_refuses_symlinked_work_plan_root(self):
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            dest = base / "wt"
+            outside = base / "outside"
+            dest.mkdir()
+            outside.mkdir()
+            (dest / ".git").write_text("gitdir: ...\n")
+            try:
+                (dest / ".work-plan").symlink_to(outside, target_is_directory=True)
+            except OSError as exc:
+                self.skipTest(f"directory symlinks unavailable: {exc}")
+            with patch.object(pw, "_worktree_dir", return_value=dest), \
+                 patch.object(pw, "_git", _FakeGit()):
+                got = pw.shared_tier_dir({"local": d, "plan_branch": "plan"})
+            self.assertIsNone(got)
+
     def test_plan_branch_none_when_branch_missing(self):
         with tempfile.TemporaryDirectory() as d:
             dest = Path(d) / "wt"  # no .git → must be created, but branch missing

package/skills/work-plan/tests/test_tracks.py

@@ -120,6 +120,23 @@ class SharedTrackDiscoveryTest(unittest.TestCase):
             shared = next(t for t in tracks if t.name == "feat-x")
             self.assertEqual(shared.tier, "shared")
 
+    def test_symlinked_shared_root_outside_repo_is_not_discovered(self):
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            clone = _make_git_repo(base / "clone")
+            outside = base / "outside"
+            _write_track_md(outside / "escaped.md", "escaped", "org/myrepo")
+            try:
+                (clone / ".work-plan").symlink_to(outside, target_is_directory=True)
+            except OSError as exc:
+                self.skipTest(f"directory symlinks unavailable: {exc}")
+            notes = base / "notes"
+            notes.mkdir()
+
+            tracks = discover_tracks(self._make_cfg(clone, notes))
+
+            self.assertNotIn("escaped", [track.name for track in tracks])
+
     def test_shared_track_repo_from_folder_config(self):
         """repo and local_path on a shared track come from folder config, not frontmatter."""
         with tempfile.TemporaryDirectory() as d: