@stylusnexus/work-plan 2026.7.10 → 2026.7.15

package/skills/work-plan/commands/export.py

@@ -1,11 +1,12 @@
 """export subcommand — emit the viewer-ready JSON read surface."""
 import json
 from datetime import datetime, date
+from pathlib import Path
 from lib.config import load_config, ConfigError, resolve_local_path_for_folder
 from lib.tracks import discover_tracks, discover_archived_tracks, find_tier_duplicates, issue_refs
 from lib.github_state import fetch_export_issues, fetch_open_issues, repo_visibility
 from lib.git_state import hot_issue_numbers
-from lib.export_model import build_export
+from lib.export_model import build_export, track_key
 from lib.prompts import parse_flags
 from lib import doc_discovery
 from lib import verdict as verdict_mod
@@ -25,11 +26,13 @@ def _plan_badge(track, cfg, today, dead_days, stall_days):
     if not isinstance(rel, str) or not rel.strip():
         return None
     rel = rel.strip()
+    if Path(rel).is_absolute():
+        return {"rel": rel, "resolved": False}
     local = resolve_local_path_for_folder(track.folder, cfg) if track.folder else None
     if not local or not local.exists():
         return {"rel": rel, "resolved": False}
     doc_path = local / rel
-    if not doc_path.is_file():
+    if not doc_discovery.is_safe_doc_path(doc_path, local):
         return {"rel": rel, "resolved": False}
     doc = doc_discovery.Doc(path=doc_path, rel=rel, kind=doc_discovery.classify_kind(rel))
     row = evaluate_doc(doc, local, today, dead_days, stall_days)
@@ -85,19 +88,19 @@ def run(args: list[str]) -> int:
     issue_map = fetch_export_issues(repo_to_numbers)
 
     # Reassemble per-track lists, preserving each track's declared issue order.
-    # Keyed by (repo, name) so same-named tracks in different repos don't collide.
-    issues_by_track: dict[tuple, list] = {}
+    # Canonical track identity keeps same-named tracks in different repos apart.
+    issues_by_track: dict[tuple[str, str], list] = {}
     visibility: dict[str, object] = {}
     for t in tracks:
         nums = (t.meta.get("github", {}).get("issues")) or []
         if t.repo and nums:
-            issues_by_track[(t.repo, t.name)] = [
+            issues_by_track[track_key(t)] = [
                 issue_map[(t.repo, n)]
                 for n in nums
                 if (t.repo, n) in issue_map
             ]
         else:
-            issues_by_track[(t.repo, t.name)] = []
+            issues_by_track[track_key(t)] = []
         if t.repo and t.repo not in visibility:
             visibility[t.repo] = repo_visibility(t.repo)
 
@@ -140,14 +143,14 @@ def run(args: list[str]) -> int:
     today = date.today()
     cfg_stall = cfg.get("stall_days")
     stall_days = cfg_stall if isinstance(cfg_stall, int) else verdict_mod.STALL_DAYS
-    plan_by_track: dict[str, dict] = {}
+    plan_by_track: dict[tuple[str, str], dict] = {}
     for t in tracks:
         badge = _plan_badge(t, cfg, today, verdict_mod.DEAD_DAYS, stall_days)
         if badge is not None:
-            plan_by_track[t.name] = badge
+            plan_by_track[track_key(t)] = badge
 
-    # Per-track branch heat, keyed (repo, name) — track names collide across repos.
-    hot_by_track: dict = {}
+    # Per-track branch heat uses the same identity as issue rows and plan badges.
+    hot_by_track: dict[tuple[str, str], set] = {}
     for t in tracks:
         if not t.repo:
             continue
@@ -155,7 +158,7 @@ def run(args: list[str]) -> int:
         if local and local.exists():
             nums = hot_issue_numbers(local)
             if nums:
-                hot_by_track[(t.repo, t.name)] = nums
+                hot_by_track[track_key(t)] = nums
 
     # Shared/private tier duplicates (#361): the viewer is otherwise blind to
     # them — discover_tracks drops the private copy with a stderr-only WARN. We

package/skills/work-plan/commands/init_repo.py

@@ -61,6 +61,8 @@ def _update_existing(key: str, github: str, local: "str | None", clear_local: bo
     while keeping github + every other field. Mutually exclusive with `local`
     (enforced in run() before this is called).
     """
+    from lib.config import write_repo_field
+
     updates = {}
     if clear_local:
         # JSON null → YAML null; the * merge overwrites local with null, leaving
@@ -77,13 +79,8 @@ def _update_existing(key: str, github: str, local: "str | None", clear_local: bo
     # `key` is validated against ^[a-z][a-z0-9-]*$ in run() before this is called,
     # so it's safe in the yq path. Field values travel as an OPAQUE env value via
     # env() (parsed as JSON), never interpolated — uniform with the add path.
-    env = {**os.environ, "WP_REPO_UPDATES": json.dumps(updates)}
-    yq_expr = f".repos.{key} = (.repos.{key} // {{}}) * env(WP_REPO_UPDATES)"
     try:
-        subprocess.run(
-            ["yq", "-i", yq_expr, str(DEFAULT_CONFIG_PATH)],
-            check=True, capture_output=True, text=True, env=env,
-        )
+        write_repo_field(key, updates)
     except subprocess.CalledProcessError as e:
         print(f"ERROR: yq failed to update config: {e.stderr}")
         return 1

package/skills/work-plan/commands/new_track.py

@@ -17,7 +17,7 @@ from pathlib import Path
 from typing import Optional
 
 from lib.config import load_config, ConfigError, is_valid_git_repo
-from lib.plan_worktree import shared_tier_dir
+from lib.plan_worktree import resolve_shared_tier
 from lib.frontmatter import write_file
 from lib.prompts import parse_flags
 from lib.write_guard import needs_confirm, make_token, valid_token
@@ -158,7 +158,10 @@ def run(args: list[str]) -> int:
             if is_valid_git_repo(local_path):
                 # Worktree-aware (#260): plan_branch repos write into the
                 # worktree's .work-plan/; None → fall back to the private tier.
-                sd = shared_tier_dir(repo_entry)
+                sd, unsafe_reason = resolve_shared_tier(repo_entry)
+                if unsafe_reason:
+                    print(f"ERROR: {unsafe_reason}")
+                    return 1
                 if sd is not None:
                     shared_path = sd / f"{slug}.md"
 
@@ -197,8 +200,24 @@ def run(args: list[str]) -> int:
     # ------------------------------------------------------------------
     # Create folder if missing, then write the track file
     # ------------------------------------------------------------------
+    if is_shared:
+        # Re-resolve at the mutation boundary.  Discovery and confirmation can
+        # take time, during which an attacker could replace `.work-plan` with a
+        # symlink.  Refuse if the selected root changed or became unavailable.
+        current_shared, unsafe_reason = resolve_shared_tier(repo_entry)
+        if unsafe_reason or current_shared is None or current_shared != path.parent:
+            print(f"ERROR: {unsafe_reason or 'shared track directory changed before write'}")
+            return 1
     path.parent.mkdir(parents=True, exist_ok=True)
 
+    if is_shared:
+        # mkdir may have created the tier; validate that concrete directory once
+        # more before handing the file path to the frontmatter writer.
+        current_shared, unsafe_reason = resolve_shared_tier(repo_entry)
+        if unsafe_reason or current_shared is None or current_shared != path.parent:
+            print(f"ERROR: {unsafe_reason or 'shared track directory changed before write'}")
+            return 1
+
     now = datetime.now().strftime("%Y-%m-%dT%H:%M")
     meta = {
         "track": slug,

package/skills/work-plan/commands/plan_status.py

@@ -5,7 +5,10 @@ Phase 1: read-only. Reports a human table or --json. Never mutates a doc.
 Manifest-less (prose) docs are flagged 👻 for the Phase 1b LLM pass.
 """
 import json
+import os
+import stat
 import sys
+import tempfile
 from datetime import date, timedelta
 from pathlib import Path
 
@@ -247,21 +250,60 @@ def _render(rows, repo_root) -> None:
         print()
 
 
-def _stamp_docs(docs, rows, draft: bool) -> None:
+def _stamp_docs(docs, rows, repo_root, draft: bool) -> None:
     changed = []
     for doc, row in zip(docs, rows):
+        if not doc_discovery.is_safe_doc_path(doc.path, repo_root):
+            print(f"WARN: refusing to stamp unsafe path: {doc.rel}")
+            continue
         text = doc.path.read_text(encoding="utf-8", errors="replace")
         new = status_header.stamp(text, row)
         if new != text:
-            changed.append(doc.rel)
-            if not draft:
-                doc.path.write_text(new, encoding="utf-8")
+            if draft:
+                changed.append(doc.rel)
+            elif _replace_doc_text(doc.path, new, repo_root):
+                changed.append(doc.rel)
+            else:
+                print(f"WARN: refusing to stamp unsafe path: {doc.rel}")
     verb = "would stamp" if draft else "stamped"
     print(f"\n{verb} {len(changed)} doc(s):")
     for rel in changed:
         print(f"  {rel}")
 
 
+def _replace_doc_text(path: Path, text: str, repo_root: Path) -> bool:
+    """Atomically replace a validated doc without writing through hard links."""
+    path = Path(path)
+    tmp_path = None
+    try:
+        original_mode = stat.S_IMODE(path.stat().st_mode)
+        with tempfile.NamedTemporaryFile(
+                mode="w", encoding="utf-8", dir=str(path.parent),
+                prefix=f".{path.name}.", suffix=".tmp", delete=False) as tmp:
+            tmp.write(text)
+            tmp.flush()
+            os.fsync(tmp.fileno())
+            tmp_path = Path(tmp.name)
+        os.chmod(str(tmp_path), original_mode)
+
+        # Recheck immediately before replacement.  os.replace swaps the directory
+        # entry instead of following a final-component symlink and also breaks any
+        # hard-link relationship held by the original inode.
+        if not doc_discovery.is_safe_doc_path(path, repo_root):
+            return False
+        os.replace(str(tmp_path), str(path))
+        tmp_path = None
+        return True
+    except OSError:
+        return False
+    finally:
+        if tmp_path is not None:
+            try:
+                tmp_path.unlink()
+            except OSError:
+                pass
+
+
 _LLM_VERDICTS = {"shipped", "partial", "dead"}
 _LLM_GLYPH = {"shipped": "✅", "partial": "🟡", "dead": "💀"}
 
@@ -336,7 +378,7 @@ def _llm_apply(docs, rows, repo_root, stamp: bool, draft: bool) -> int:
 
     _render(rows, repo_root)
     if stamp:
-        _stamp_docs(docs, rows, draft=draft)
+        _stamp_docs(docs, rows, repo_root=repo_root, draft=draft)
     return 0
 
 
@@ -551,5 +593,5 @@ def run(args: list) -> int:
     if flags.get("--stamp"):
         live_docs = [d for d in docs if not d.archived]
         _stamp_docs(live_docs, [r for r in rows if not r.get("archived")],
-                    draft=bool(flags.get("--draft")))
+                    repo_root=repo_root, draft=bool(flags.get("--draft")))
     return 0

package/skills/work-plan/lib/config.py

@@ -1,5 +1,6 @@
 """Load + validate ~/.claude/work-plan/config.yml."""
 import json
+import os
 import subprocess
 from pathlib import Path
 from typing import Optional
@@ -57,9 +58,11 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH,
     if "notes_root" not in cfg:
         raise ConfigError("config.yml missing required key 'notes_root'.")
     cfg.setdefault("repos", {})
+    scalar_shape_keys = set()
     # Normalize string-shape entries to dict shape
     for folder, val in list(cfg["repos"].items()):
         if isinstance(val, str):
+            scalar_shape_keys.add(folder)
             cfg["repos"][folder] = {"github": val, "local": None}
         elif isinstance(val, dict):
             val.setdefault("local", None)
@@ -67,6 +70,7 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH,
                 raise ConfigError(f"repo '{folder}' missing 'github' key")
         else:
             raise ConfigError(f"repo '{folder}' must be string or dict, got {type(val).__name__}")
+    cfg["_scalar_shape_keys"] = scalar_shape_keys
     return cfg
 
 
@@ -97,3 +101,28 @@ def resolve_local_path_for_folder(folder_name: str, cfg: dict) -> Optional[Path]
     if not entry or not entry.get("local"):
         return None
     return Path(entry["local"]).expanduser()
+
+
+def write_repo_field(key: str, updates: dict, path: Path = DEFAULT_CONFIG_PATH) -> None:
+    """Merge `updates` into `repos.<key>` in config.yml via an opaque-env `yq`
+    merge — the same mechanic `init_repo.py::_update_existing` already used
+    (extracted here so `doctor` and `init-repo` share one implementation).
+
+    `updates` values travel as JSON through an env var, never interpolated
+    into the yq expression, so they can't break out of the merge. `key` is
+    interpolated directly into the yq path — callers MUST validate it against
+    a safe-key pattern (e.g. `^[a-z][a-z0-9-]*$`) before calling this; this
+    function does not re-validate, matching `_update_existing`'s existing
+    contract (its caller already validates via `init-repo`'s own regex check).
+
+    Raises `subprocess.CalledProcessError` on any yq failure — including the
+    known case of `repos.<key>` being a scalar string on disk (yq cannot
+    multiply a string with a map). Callers must catch this and treat it as
+    "entry not fixable this way", not crash the whole command.
+    """
+    env = {**os.environ, "WP_REPO_UPDATES": json.dumps(updates)}
+    yq_expr = f".repos.{key} = (.repos.{key} // {{}}) * env(WP_REPO_UPDATES)"
+    subprocess.run(
+        ["yq", "-i", yq_expr, str(path)],
+        check=True, capture_output=True, text=True, env=env,
+    )

package/skills/work-plan/lib/doc_discovery.py

@@ -30,6 +30,26 @@ def classify_kind(rel: str) -> str:
     return "adhoc"
 
 
+def is_safe_doc_path(path: Path, repo_root: Path) -> bool:
+    """Return whether an existing doc resolves to a regular file inside the repo.
+
+    ``Path.is_file()`` follows symlinks, so it is not sufficient for paths that
+    may later be stamped.  Reject a symlink at the final component and require
+    the fully-resolved target to remain beneath the resolved repository root.
+    The write path calls this again to avoid trusting discovery-time state.
+    """
+    path = Path(path)
+    try:
+        if path.is_symlink():
+            return False
+        resolved_root = Path(repo_root).resolve(strict=True)
+        resolved_path = path.resolve(strict=True)
+        resolved_path.relative_to(resolved_root)
+        return resolved_path.is_file()
+    except (OSError, ValueError):
+        return False
+
+
 def discover_docs(repo_root: Path, globs: Optional[list] = None,
                   include_archived: bool = False) -> list:
     globs = globs or DEFAULT_GLOBS
@@ -38,7 +58,7 @@ def discover_docs(repo_root: Path, globs: Optional[list] = None,
     seen = set()
     for g in globs:
         for p in sorted(repo_root.glob(g)):
-            if not p.is_file() or p in seen:
+            if not is_safe_doc_path(p, repo_root) or p in seen:
                 continue
             seen.add(p)
             rel = p.relative_to(repo_root).as_posix()
@@ -48,7 +68,7 @@ def discover_docs(repo_root: Path, globs: Optional[list] = None,
             parent = g.rsplit("/", 1)[0]            # "docs/plans/*.md" -> "docs/plans"
             for sub, kind in ARCHIVE_SUBDIRS:
                 for p in sorted(repo_root.glob(f"{parent}/{sub}/*.md")):
-                    if not p.is_file() or p in seen:
+                    if not is_safe_doc_path(p, repo_root) or p in seen:
                         continue
                     seen.add(p)
                     rel = p.relative_to(repo_root).as_posix()

package/skills/work-plan/lib/export_model.py

@@ -5,6 +5,18 @@ from lib.next_up import resolve_next_up_order, suggest_next_up
 SCHEMA = 1
 
 
+def track_key(track) -> tuple[str, str]:
+    """Return the canonical internal identity for a track.
+
+    The config folder key is the CLI repo qualifier and keeps separately
+    configured sources distinct even when they point at the same GitHub repo.
+    Older/minimal tracks without a folder fall back to the GitHub slug. The key
+    is internal to export assembly and does not change the schema-1 JSON surface.
+    """
+    scope = getattr(track, "folder", None) or getattr(track, "repo", None) or ""
+    return (scope, track.name)
+
+
 def milestone_sort_key(issue: dict, milestone_alignment=None):
     """Sort key for an issue dict (must have 'number' and 'milestone').
 
@@ -92,8 +104,9 @@ def build_export(tracks, issues_by_track, visibility, now: str,
     out = {"schema": SCHEMA, "generated_at": now, "tracks": []}
     for t in tracks:
         from lib.in_progress import issue_in_progress, IN_PROGRESS_LABEL
-        hot = hot_by_track.get((t.repo, t.name), set())
-        raw = issues_by_track.get((t.repo, t.name), [])
+        key = track_key(t)
+        hot = hot_by_track.get(key, set())
+        raw = issues_by_track.get(key, [])
         issues = [
             normalize_issue(
                 i,
@@ -158,7 +171,7 @@ def build_export(tracks, issues_by_track, visibility, now: str,
             # The track's declared plan/spec doc + its execution badge (#285), or
             # null when the track declares no `plan:`. `{rel, resolved:false}` when
             # the link can't be resolved (no local clone / file absent).
-            "plan": plan_by_track.get(t.name),
+            "plan": plan_by_track.get(key),
             # Effective next_up ranking preset for this track (#326 Phase 2).
             "next_up_preset": next_up_preset_name,
             # True when the track has `next_up_auto: true` set in its frontmatter,

package/skills/work-plan/lib/github_state.py

@@ -433,6 +433,31 @@ def repo_visibility(repo: str) -> Optional[str]:
     return vis
 
 
+def repo_full_name(slug: str) -> Optional[str]:
+    """Live GitHub identity check via `gh api repos/<slug> --jq .full_name`.
+
+    Returns the repo's current canonical `owner/repo` — following GitHub's own
+    rename redirect if `slug` was renamed and the redirect is still live — or
+    None on any failure (404, no access, rate-limited, offline, bad slug
+    shape). Never raises. Used by `doctor` to detect a GitHub-confirmed rename;
+    NOT a stable identity check (see doctor's own docs) — a slug that was
+    reused by an unrelated repo after the redirect lapses is indistinguishable
+    from a genuine rename here.
+    """
+    if not _valid_repo(slug):
+        return None
+    try:
+        proc = subprocess.run(
+            ["gh", "api", f"repos/{slug}", "--jq", ".full_name"],
+            capture_output=True, text=True, timeout=GH_TIMEOUT,
+        )
+    except Exception:
+        return None
+    if proc.returncode != 0:
+        return None
+    return proc.stdout.strip() or None
+
+
 def extract_priority(labels: list[dict]) -> str:
     label_names = {lbl["name"] for lbl in labels}
     for p in PRIORITY_LABELS:

package/skills/work-plan/lib/notes_vcs.py

@@ -132,26 +132,38 @@ def head_parent_sha(notes_root: Path) -> Optional[str]:
     return proc.stdout.strip()
 
 
-def dirty_paths(notes_root: Path) -> set:
-    """Set of work-tree paths with staged/unstaged changes (raw, quotepath off).
-
-    Empty set on any failure. Renames collapse to the destination path. Used by
-    the dispatcher to commit ONLY what a command changed, leaving pre-existing
-    dirty files untouched.
+def dirty_paths_checked(notes_root: Path) -> tuple:
+    """Like `dirty_paths`, but distinguishes "clean tree" from "the git status
+    call itself failed" (timeout, spawn error, not a repo) — both of which
+    `dirty_paths` alone reports as an empty set. Returns (call_succeeded, paths).
+
+    Callers that need to know WHETHER they can trust an empty result (e.g.
+    doctor's dirty-file safety check, which must not treat "couldn't check" as
+    "definitely clean") should call this instead of `dirty_paths`.
     """
     proc = _git(notes_root, "-c", "core.quotepath=false", "status", "--porcelain")
     if proc is None or proc.returncode != 0:
-        return set()
+        return (False, set())
     paths = set()
     for line in proc.stdout.splitlines():
         if len(line) < 4:
             continue
         path = line[3:]
-        if " -> " in path:  # rename / copy → the destination path
+        if " -> " in path:
             path = path.split(" -> ", 1)[1]
         if path:
             paths.add(path)
-    return paths
+    return (True, paths)
+
+
+def dirty_paths(notes_root: Path) -> set:
+    """Set of work-tree paths with staged/unstaged changes (raw, quotepath off).
+
+    Empty set on any failure. Renames collapse to the destination path. Used by
+    the dispatcher to commit ONLY what a command changed, leaving pre-existing
+    dirty files untouched.
+    """
+    return dirty_paths_checked(notes_root)[1]
 
 
 def last_commit_summary(notes_root: Path) -> Optional[str]:

package/skills/work-plan/lib/plan_worktree.py

@@ -190,6 +190,51 @@ def commit_shared_tier(worktree: Path, message: str, paths) -> Optional[str]:
     return head.stdout.strip() or None
 
 
+def _contained_shared_tier(root: Path) -> tuple:
+    """Return ``(<root>/.work-plan, None)`` when the tier is safely contained.
+
+    The shared-tier directory itself is never allowed to be a symlink, even if
+    it currently points back inside ``root``.  Refusing the indirection keeps a
+    later retarget from changing the write destination after validation.
+    ``resolve(strict=False)`` also catches symlinked ancestors and proves that
+    the resulting directory remains below the resolved repository/worktree.
+    """
+    candidate = root / ".work-plan"
+    try:
+        resolved_root = root.resolve(strict=True)
+        if not resolved_root.is_dir():
+            return None, f"shared track root is not a directory: {root}"
+        if candidate.is_symlink():
+            return None, f"unsafe shared track directory is a symlink: {candidate}"
+        if candidate.exists() and not candidate.is_dir():
+            return None, f"unsafe shared track path is not a directory: {candidate}"
+        resolved_candidate = candidate.resolve(strict=False)
+        resolved_candidate.relative_to(resolved_root)
+    except (OSError, RuntimeError, ValueError):
+        return None, f"unsafe shared track directory escapes its root: {candidate}"
+    return candidate, None
+
+
+def resolve_shared_tier(entry: dict) -> tuple:
+    """Resolve a repo's shared tier as ``(path, unsafe_reason)``.
+
+    ``unsafe_reason`` is populated only when a candidate root exists but fails
+    containment validation.  Operational absence (no local path, unavailable
+    plan branch) remains ``(None, None)`` so read-only callers retain the
+    existing graceful-degradation behaviour.
+    """
+    if not entry or not entry.get("local"):
+        return None, None
+    local_path = Path(entry["local"]).expanduser()
+    branch = entry.get("plan_branch")
+    if branch:
+        worktree = ensure_worktree(local_path, branch)
+        if worktree is None:
+            return None, None
+        return _contained_shared_tier(worktree)
+    return _contained_shared_tier(local_path)
+
+
 def shared_tier_dir(entry: dict) -> Optional[Path]:
     """The `.work-plan/` directory to read/write for a repo config `entry`.
 
@@ -199,14 +244,8 @@ def shared_tier_dir(entry: dict) -> Optional[Path]:
 
     Returns None when the entry has no `local` path. Never raises.
     """
-    if not entry or not entry.get("local"):
-        return None
-    local_path = Path(entry["local"]).expanduser()
-    branch = entry.get("plan_branch")
-    if branch:
-        worktree = ensure_worktree(local_path, branch)
-        return (worktree / ".work-plan") if worktree else None
-    return local_path / ".work-plan"
+    path, _unsafe_reason = resolve_shared_tier(entry)
+    return path
 
 
 # ---------------------------------------------------------------------------

package/skills/work-plan/lib/tracks.py

@@ -327,15 +327,29 @@ def _build_shared_track(md_path: Path, folder_key: str,
     )
 
 
-def _walk(notes_root: Path, cfg: dict, include_archive: bool) -> list[Track]:
+def iter_private_track_paths(notes_root: Path, include_archive: bool) -> list:
+    """Eligible track markdown paths under `notes_root`, in sorted order.
+
+    Recursive. Skips `archive/` subtrees unless `include_archive` is True.
+    Skips filenames starting with '.', '_', or '-' (dotfiles, drafts, and
+    dash-led names that would otherwise misparse as a CLI flag, #194). This is
+    the single shared definition of "which private track files count" — both
+    `_walk` (track discovery) and `doctor` (drift scanning) call this, so they
+    cannot diverge on which files are in scope.
+    """
     out = []
     for md_path in sorted(notes_root.rglob("*.md")):
         if not include_archive and "archive" in md_path.parts:
             continue
-        # '-' prefix rejected so a `--repo.md` file can't become a `--repo`
-        # track that the CLI misparses as a flag (#194).
         if md_path.name.startswith((".", "_", "-")):
             continue
+        out.append(md_path)
+    return out
+
+
+def _walk(notes_root: Path, cfg: dict, include_archive: bool) -> list[Track]:
+    out = []
+    for md_path in iter_private_track_paths(notes_root, include_archive):
         out.append(_build_track(md_path, notes_root, cfg))
     return out
 

package/skills/work-plan/tests/test_config.py

@@ -2,6 +2,7 @@
 import unittest
 import tempfile
 import sys
+import subprocess
 from pathlib import Path
 
 SKILL_ROOT = Path(__file__).resolve().parents[1]
@@ -10,6 +11,7 @@ sys.path.insert(0, str(SKILL_ROOT))
 from lib.config import (
     load_config, ConfigError,
     resolve_github_for_folder, resolve_local_path_for_folder,
+    write_repo_field,
 )
 
 
@@ -81,5 +83,62 @@ class ResolveTest(unittest.TestCase):
         self.assertIsNone(resolve_local_path_for_folder("unknown", self.cfg))
 
 
+class BaseConfigWriteTest(unittest.TestCase):
+    """Base class for tests that need to write and read config files."""
+    def _write_config(self, content):
+        """Write content to a temporary config file and return its path."""
+        d = tempfile.mkdtemp()
+        path = Path(d) / "config.yml"
+        path.write_text(content, encoding="utf-8")
+        return path
+
+
+class TestScalarShapeKeys(BaseConfigWriteTest):
+    def test_scalar_entry_is_tracked(self):
+        cfg_path = self._write_config(
+            "notes_root: /tmp/notes\n"
+            "repos:\n"
+            "  foo: org/foo\n"
+            "  bar:\n"
+            "    github: org/bar\n"
+        )
+        cfg = load_config(path=cfg_path, notes_root=Path("/tmp/notes"))
+        self.assertEqual(cfg["_scalar_shape_keys"], {"foo"})
+
+    def test_no_scalar_entries_is_empty_set(self):
+        cfg_path = self._write_config(
+            "notes_root: /tmp/notes\n"
+            "repos:\n"
+            "  bar:\n"
+            "    github: org/bar\n"
+        )
+        cfg = load_config(path=cfg_path, notes_root=Path("/tmp/notes"))
+        self.assertEqual(cfg["_scalar_shape_keys"], set())
+
+
+class TestWriteRepoField(BaseConfigWriteTest):
+    def test_writes_only_the_given_fields(self):
+        cfg_path = self._write_config(
+            "notes_root: /tmp/notes\n"
+            "repos:\n"
+            "  bar:\n"
+            "    github: org/bar\n"
+            "    local: /code/bar\n"
+        )
+        write_repo_field("bar", {"github": "org/bar-renamed"}, path=cfg_path)
+        cfg = load_config(path=cfg_path, notes_root=Path("/tmp/notes"))
+        self.assertEqual(cfg["repos"]["bar"]["github"], "org/bar-renamed")
+        self.assertEqual(cfg["repos"]["bar"]["local"], "/code/bar")
+
+    def test_raises_on_scalar_entry(self):
+        cfg_path = self._write_config(
+            "notes_root: /tmp/notes\n"
+            "repos:\n"
+            "  foo: org/foo\n"
+        )
+        with self.assertRaises(subprocess.CalledProcessError):
+            write_repo_field("foo", {"github": "org/foo-renamed"}, path=cfg_path)
+
+
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_discover_archived.py

@@ -42,6 +42,21 @@ class DiscoverArchivedTest(unittest.TestCase):
                 by_rel["docs/plans/archive/abandoned/dead.md"].archive_kind, "abandoned")
             self.assertFalse(by_rel["docs/plans/live.md"].archived)
 
+    def test_include_archived_skips_symlinked_doc_outside_repo(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = _repo(d)
+            victim = Path(d) / "outside.md"
+            victim.write_text("# outside\n")
+            link = root / "docs/plans/archive/shipped/linked.md"
+            link.symlink_to(victim)
+
+            docs = doc_discovery.discover_docs(root, include_archived=True)
+
+            self.assertNotIn(
+                "docs/plans/archive/shipped/linked.md",
+                {doc.rel for doc in docs},
+            )
+
 
 if __name__ == "__main__":
     unittest.main()