@stylusnexus/work-plan 2026.7.10 → 2026.7.15

package/skills/work-plan/tests/test_export.py

@@ -3,18 +3,44 @@ import sys, json, unittest
 from pathlib import Path
 from types import SimpleNamespace
 SKILL_ROOT = Path(__file__).resolve().parents[1]; sys.path.insert(0, str(SKILL_ROOT))
-from lib.export_model import build_export
+from lib.export_model import build_export, track_key
 import commands.export as export_cmd
 
 def _track(name, repo, issues, blockers=None, next_up=None, status="active", depends_on=None):
     return SimpleNamespace(name=name, repo=repo, tier="private",
-        path=Path(f"/tmp/notes/{name}.md"), folder="myrepo",
+        path=Path(f"/tmp/notes/{name}.md"), folder=repo,
         meta={"status": status, "launch_priority": "P2", "milestone_alignment": "v1",
               "blockers": blockers or [], "next_up": next_up or [],
               "depends_on": depends_on or [],
               "github": {"repo": repo, "issues": issues}})
 
 class BuildExportTest(unittest.TestCase):
+    def test_track_key_prefers_config_folder_over_repo_slug(self):
+        track = SimpleNamespace(name="alpha", repo="org/repo", folder="config-folder")
+        self.assertEqual(track_key(track), ("config-folder", "alpha"))
+
+    def test_track_key_falls_back_to_folder_without_repo(self):
+        track = SimpleNamespace(name="alpha", repo=None, folder="config-folder")
+        self.assertEqual(track_key(track), ("config-folder", "alpha"))
+
+    def test_folder_identity_is_shared_by_issue_hot_and_plan_maps(self):
+        track = _track("alpha", None, [7])
+        track.folder = "config-folder"
+        key = ("config-folder", "alpha")
+        badge = {"rel": "docs/plans/p.md", "resolved": False}
+        issues = [{"number": 7, "title": "folder-only", "state": "OPEN",
+                   "assignees": [], "labels": []}]
+
+        out = build_export(
+            [track], {key: issues}, {}, now="t",
+            plan_by_track={key: badge}, hot_by_track={key: {7}},
+        )
+
+        exported = out["tracks"][0]
+        self.assertEqual(exported["plan"], badge)
+        self.assertEqual(exported["issues"][0]["number"], 7)
+        self.assertTrue(exported["issues"][0]["in_progress"])
+
     def test_schema_and_shape(self):
         tracks = [_track("ph", "o/r", [1, 2], blockers=[9], next_up=[1])]
         issues_by_track = {("o/r", "ph"): [
@@ -31,7 +57,7 @@ class BuildExportTest(unittest.TestCase):
         # the platform — str(Path) yields backslashes on Windows.
         self.assertEqual(t["path"], str(Path("/tmp/notes/ph.md")))
         # Config repo key surfaces for the Plans view's --repo arg (#164).
-        self.assertEqual(t["folder"], "myrepo")
+        self.assertEqual(t["folder"], "o/r")
         self.assertEqual(t["blockers"], [9]); self.assertEqual(t["next_up"], [1])
         self.assertEqual(t["rollup"], {"open": 1, "closed": 1})
         self.assertEqual(t["issues"][0], {"number": 1, "title": "a", "state": "open", "assignee": "@eve", "milestone": None, "in_progress": False, "in_progress_label": False, "blocked_by": [], "blocking": []})
@@ -74,7 +100,7 @@ class BuildExportNextUpAutoTest(unittest.TestCase):
         if auto:
             meta["next_up_auto"] = True
         return SimpleNamespace(name="t", repo="o/r", tier="private",
-                               path=Path("/tmp/notes/t.md"), folder="myrepo", meta=meta)
+                               path=Path("/tmp/notes/t.md"), folder="o/r", meta=meta)
 
     def _issues(self):
         # P0 #3, P1 #2, P2 #1 — flow ranks by priority within the same milestone.
@@ -113,7 +139,7 @@ class BuildExportNextUpAutoTest(unittest.TestCase):
         from types import SimpleNamespace
         from pathlib import Path
         t = SimpleNamespace(name="t", repo="o/r", tier="private",
-                            path=Path("/tmp/notes/t.md"), folder="myrepo", meta=meta)
+                            path=Path("/tmp/notes/t.md"), folder="o/r", meta=meta)
         out = build_export([t],
                            {("o/r", "t"): []},           # zero issues fetched
                            {"o/r": "PRIVATE"}, now="t")
@@ -381,13 +407,13 @@ class BuildExportPlanTest(unittest.TestCase):
                  "checkboxes_done": 0, "checkboxes_total": 24, "lie_gap": False,
                  "stalled": False, "override": "shipped"}
         out = build_export(tracks, {("o/r", "alpha"): []}, {"o/r": "PRIVATE"}, now="t",
-                           plan_by_track={"alpha": badge})
+                           plan_by_track={("o/r", "alpha"): badge})
         self.assertEqual(out["tracks"][0]["plan"], badge)
 
     def test_unresolved_badge_passed_through(self):
         tracks = [_track("alpha", "o/r", [1])]
         out = build_export(tracks, {("o/r", "alpha"): []}, {"o/r": "PRIVATE"}, now="t",
-                           plan_by_track={"alpha": {"rel": "docs/plans/p.md", "resolved": False}})
+                           plan_by_track={("o/r", "alpha"): {"rel": "docs/plans/p.md", "resolved": False}})
         self.assertEqual(out["tracks"][0]["plan"], {"rel": "docs/plans/p.md", "resolved": False})
 
 
@@ -583,7 +609,7 @@ class BuildExportNextUpPresetTest(unittest.TestCase):
         if track_meta_override:
             meta.update(track_meta_override)
         t = SimpleNamespace(name="alpha", repo="o/r", tier="private",
-                            path=Path("/tmp/notes/alpha.md"), folder="myrepo",
+                            path=Path("/tmp/notes/alpha.md"), folder="o/r",
                             meta=meta)
         out = build_export([t], {("o/r", "alpha"): []}, {"o/r": "PRIVATE"},
                            now="2026-06-14T00:00", next_up_default=next_up_default)

package/skills/work-plan/tests/test_export_command.py

@@ -263,6 +263,53 @@ class ExportRunJsonTest(unittest.TestCase):
         # repoB: issue 1 — once
         self.assertEqual(repo_to_numbers[repo_b], [1])
 
+    def test_same_name_tracks_in_different_repos_keep_distinct_plan_badges(self):
+        """Plan badges must follow track identity, not collide on track name."""
+        repo_a = "org/repoA"
+        repo_b = "org/repoB"
+        track_a = _track("shared-name", repo_a, [])
+        track_b = _track("shared-name", repo_b, [])
+        track_a.folder = "repo-a"
+        track_b.folder = "repo-b"
+        track_a.meta["plan"] = "docs/plans/a.md"
+        track_b.meta["plan"] = "docs/plans/b.md"
+
+        def _badge(track, *_args):
+            return {"rel": track.meta["plan"], "resolved": False}
+
+        with patch("commands.export._plan_badge", side_effect=_badge):
+            rc, out, _ = self._run_with_mocks(
+                [track_a, track_b], {}, vis={repo_a: "PUBLIC", repo_b: "PRIVATE"}
+            )
+
+        self.assertEqual(rc, 0)
+        by_repo = {track["repo"]: track for track in out["tracks"]}
+        self.assertEqual(by_repo[repo_a]["plan"]["rel"], "docs/plans/a.md")
+        self.assertEqual(by_repo[repo_b]["plan"]["rel"], "docs/plans/b.md")
+
+    def test_same_repo_alias_folders_keep_distinct_plan_badges(self):
+        """Folder keys remain distinct even when aliases share a GitHub slug."""
+        repo = "org/shared"
+        track_a = _track("shared-name", repo, [])
+        track_b = _track("shared-name", repo, [])
+        track_a.folder = "alias-a"
+        track_b.folder = "alias-b"
+        track_a.meta["plan"] = "docs/plans/a.md"
+        track_b.meta["plan"] = "docs/plans/b.md"
+
+        def _badge(track, *_args):
+            return {"rel": track.meta["plan"], "resolved": False}
+
+        with patch("commands.export._plan_badge", side_effect=_badge):
+            rc, out, _ = self._run_with_mocks(
+                [track_a, track_b], {}, vis={repo: "PRIVATE"}
+            )
+
+        self.assertEqual(rc, 0)
+        by_folder = {track["folder"]: track for track in out["tracks"]}
+        self.assertEqual(by_folder["alias-a"]["plan"]["rel"], "docs/plans/a.md")
+        self.assertEqual(by_folder["alias-b"]["plan"]["rel"], "docs/plans/b.md")
+
 
 class ExportCommandUntrackedTest(unittest.TestCase):
     """Verify export.run computes untracked = open issues minus tracked ones."""
@@ -435,6 +482,60 @@ class ExportPlanBadgeTest(unittest.TestCase):
             badge = self._badge(self._track_with_plan(rel="docs/plans/missing.md"), root)
             self.assertEqual(badge, {"rel": "docs/plans/missing.md", "resolved": False})
 
+    def test_unresolved_when_plan_traverses_outside_repo(self):
+        import tempfile
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            root.mkdir()
+            outside = Path(d) / "outside.md"
+            outside.write_text(self.BODY)
+            rel = "../outside.md"
+
+            badge = self._badge(self._track_with_plan(rel=rel), root)
+
+            self.assertEqual(badge, {"rel": rel, "resolved": False})
+
+    def test_unresolved_when_plan_is_absolute_path(self):
+        import tempfile
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            root.mkdir()
+            outside = Path(d) / "outside.md"
+            outside.write_text(self.BODY)
+            rel = str(outside)
+
+            badge = self._badge(self._track_with_plan(rel=rel), root)
+
+            self.assertEqual(badge, {"rel": rel, "resolved": False})
+
+    def test_unresolved_when_plan_is_absolute_path_inside_repo(self):
+        import tempfile
+        with tempfile.TemporaryDirectory() as d:
+            root = self._repo_with_plan(d, self.BODY)
+            rel = str(root / "docs/plans/p.md")
+
+            badge = self._badge(self._track_with_plan(rel=rel), root)
+
+            self.assertEqual(badge, {"rel": rel, "resolved": False})
+
+    def test_unresolved_when_plan_symlink_resolves_outside_repo(self):
+        import tempfile
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/plans"
+            plans.mkdir(parents=True)
+            outside = Path(d) / "outside.md"
+            outside.write_text(self.BODY)
+            link = plans / "p.md"
+            link.symlink_to(outside)
+
+            badge = self._badge(self._track_with_plan(), root)
+
+            self.assertEqual(
+                badge,
+                {"rel": "docs/plans/p.md", "resolved": False},
+            )
+
     def test_no_folder_is_unresolved(self):
         t = self._track_with_plan(folder=None)
         from datetime import date

package/skills/work-plan/tests/test_github_state.py

@@ -12,7 +12,8 @@ from lib.github_state import (
     fetch_issues, fetch_issue, fetch_issues_concurrent,
     fetch_repo_issues_graphql, fetch_export_issues, _normalize_gql_node,
     extract_priority, fetch_recent_issues, short_milestone,
-    repo_visibility, _VIS_CACHE, fetch_open_issues,
+    repo_visibility, _VIS_CACHE, fetch_open_issues, repo_full_name,
+    gh_auth_status,
     _GQL_FIELDS_LEAN, _GQL_FIELDS_FULL,
     _gql_query, _GQL_ISSUE_DEPS,
 )
@@ -608,5 +609,44 @@ class NormalizeDepsTest(unittest.TestCase):
         self.assertFalse(out["deps_truncated"])
 
 
+class TestRepoFullName(unittest.TestCase):
+    def test_returns_full_name_on_success(self):
+        fake = MagicMock(returncode=0, stdout="org/repo-renamed\n", stderr="")
+        with patch("lib.github_state.subprocess.run", return_value=fake) as m:
+            result = repo_full_name("org/repo-old")
+        self.assertEqual(result, "org/repo-renamed")
+        args = m.call_args[0][0]
+        self.assertEqual(args, ["gh", "api", "repos/org/repo-old", "--jq", ".full_name"])
+
+    def test_none_on_nonzero_exit(self):
+        fake = MagicMock(returncode=1, stdout="", stderr="not found")
+        with patch("lib.github_state.subprocess.run", return_value=fake):
+            self.assertIsNone(repo_full_name("org/gone"))
+
+    def test_none_on_invalid_slug(self):
+        self.assertIsNone(repo_full_name("not-a-slug"))
+
+    def test_none_on_subprocess_exception(self):
+        with patch("lib.github_state.subprocess.run", side_effect=OSError("boom")):
+            self.assertIsNone(repo_full_name("org/repo"))
+
+
+def _gh_authenticated():
+    return gh_auth_status()["authenticated"]
+
+
+class TestRepoFullNameLiveRedirect(unittest.TestCase):
+    def test_musical_family_trees_redirect_is_still_live(self):
+        # The actual repo this whole design's incident was about. If this ever
+        # stops returning the renamed slug, the redirect has lapsed and the
+        # design's core "gh api repos/<slug> follows GitHub's own rename
+        # redirect" assumption needs re-verifying before trusting doctor's
+        # output on real data.
+        if not _gh_authenticated():
+            self.skipTest("gh not authenticated — skipping live network check")
+        result = repo_full_name("evemcgivern/musical-family-trees")
+        self.assertEqual(result, "evemcgivern/soundstellation")
+
+
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_group_apply.py

@@ -77,6 +77,8 @@ def _drive_apply(args, *, cfg, batch, answers, vis="PRIVATE"):
              patch("commands.group.load_config", return_value=cfg), \
              patch("lib.write_guard.repo_visibility", return_value=vis), \
              patch("commands.group.is_valid_git_repo", return_value=True), \
+             patch("commands.group.shared_tier_dir",
+                   return_value=Path(cfg["repos"]["myrepo"]["local"]) / ".work-plan"), \
              patch("commands.group.write_file") as mw, \
              patch("commands.group.parse_file", return_value=({}, "")), \
              patch("commands.group.seed_readme") as mseed, \
@@ -193,6 +195,8 @@ class GroupApplyTierRoutingTest(unittest.TestCase):
                  patch("commands.group.load_config", return_value=cfg), \
                  patch("lib.write_guard.repo_visibility", return_value="PRIVATE"), \
                  patch("commands.group.is_valid_git_repo", return_value=True), \
+                 patch("commands.group.shared_tier_dir",
+                       return_value=Path(cfg["repos"]["myrepo"]["local"]) / ".work-plan"), \
                  patch("commands.group.write_file"), \
                  patch("commands.group.parse_file", return_value=({}, "")), \
                  patch("commands.group.seed_readme") as mseed, \

package/skills/work-plan/tests/test_new_track.py

@@ -20,6 +20,7 @@ import io
 import json
 import subprocess
 import sys
+import tempfile
 import unittest
 from contextlib import redirect_stdout
 from pathlib import Path
@@ -441,6 +442,82 @@ class NewTrackCommandTest(unittest.TestCase):
         self.assertEqual(rc, 0)
         mw.assert_called_once()
 
+    def test_refuses_shared_track_when_work_plan_root_is_symlinked_outside_repo(self):
+        """A repo-controlled shared root must not redirect creation elsewhere."""
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            clone = base / "clone"
+            outside = base / "outside"
+            notes = base / "notes"
+            (clone / ".git").mkdir(parents=True)
+            outside.mkdir()
+            notes.mkdir()
+            try:
+                (clone / ".work-plan").symlink_to(outside, target_is_directory=True)
+            except OSError as exc:
+                self.skipTest(f"directory symlinks unavailable: {exc}")
+            cfg = {
+                "notes_root": str(notes),
+                "repos": {
+                    "myrepo": {"github": "org/myrepo", "local": str(clone)},
+                },
+            }
+
+            with patch("commands.new_track.load_config", return_value=cfg), \
+                 patch("lib.write_guard.repo_visibility", return_value="PRIVATE"):
+                buf = io.StringIO()
+                with redirect_stdout(buf):
+                    rc = new_track.run(["myrepo", "escaped"])
+
+            self.assertEqual(rc, 1)
+            self.assertFalse((outside / "escaped.md").exists())
+            self.assertIn("unsafe shared track directory", buf.getvalue())
+
+    def test_rechecks_shared_root_after_directory_creation_before_write(self):
+        """A root swapped after mkdir is rejected before write_file opens it."""
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            clone = base / "clone"
+            outside = base / "outside"
+            notes = base / "notes"
+            (clone / ".git").mkdir(parents=True)
+            outside.mkdir()
+            notes.mkdir()
+            cfg = {
+                "notes_root": str(notes),
+                "repos": {
+                    "myrepo": {"github": "org/myrepo", "local": str(clone)},
+                },
+            }
+            real_resolve = new_track.resolve_shared_tier
+            calls = 0
+
+            def _swap_after_mkdir(entry):
+                nonlocal calls
+                calls += 1
+                if calls == 3:
+                    shared = clone / ".work-plan"
+                    shared.rmdir()
+                    try:
+                        shared.symlink_to(outside, target_is_directory=True)
+                    except OSError as exc:
+                        self.skipTest(f"directory symlinks unavailable: {exc}")
+                return real_resolve(entry)
+
+            with patch("commands.new_track.load_config", return_value=cfg), \
+                 patch("commands.new_track.resolve_shared_tier",
+                       side_effect=_swap_after_mkdir), \
+                 patch("commands.new_track.write_file") as write, \
+                 patch("lib.write_guard.repo_visibility", return_value="PRIVATE"):
+                buf = io.StringIO()
+                with redirect_stdout(buf):
+                    rc = new_track.run(["myrepo", "escaped"])
+
+            self.assertEqual(rc, 1)
+            write.assert_not_called()
+            self.assertFalse((outside / "escaped.md").exists())
+            self.assertIn("unsafe shared track directory", buf.getvalue())
+
 
 # ---------------------------------------------------------------------------
 # Phase D: --commit flag tests
@@ -504,6 +581,8 @@ class NewTrackCommitFlagTest(unittest.TestCase):
 
         with patch("commands.new_track.load_config", return_value=cfg), \
              patch("commands.new_track.write_file") as mw, \
+             patch("commands.new_track.resolve_shared_tier",
+                   return_value=(Path(CLONE_ROOT) / ".work-plan", None)), \
              patch("lib.write_guard.repo_visibility", return_value="PRIVATE"), \
              patch("pathlib.Path.exists", _path_exists), \
              patch("pathlib.Path.is_dir", _is_dir), \

package/skills/work-plan/tests/test_notes_vcs.py

@@ -188,6 +188,36 @@ class RemoteAndOwnershipTest(unittest.TestCase):
                 self.assertTrue(notes_vcs.is_owned(Path(d)))
 
 
+class DirtyPathsCheckedTest(unittest.TestCase):
+    def test_ok_true_on_clean_tree(self):
+        with tempfile.TemporaryDirectory() as d:
+            with patch.object(notes_vcs, "_git", _FakeGit(porcelain="")):
+                ok, paths = notes_vcs.dirty_paths_checked(Path(d))
+        self.assertTrue(ok)
+        self.assertEqual(paths, set())
+
+    def test_ok_true_with_dirty_paths(self):
+        with tempfile.TemporaryDirectory() as d:
+            with patch.object(notes_vcs, "_git",
+                                _FakeGit(porcelain=" M foo.md\n?? bar.md\n")):
+                ok, paths = notes_vcs.dirty_paths_checked(Path(d))
+        self.assertTrue(ok)
+        self.assertEqual(paths, {"foo.md", "bar.md"})
+
+    def test_ok_false_on_git_call_failure(self):
+        with tempfile.TemporaryDirectory() as d:
+            with patch.object(notes_vcs, "_git", _FakeGit(missing=True)):
+                ok, paths = notes_vcs.dirty_paths_checked(Path(d))
+        self.assertFalse(ok)
+        self.assertEqual(paths, set())
+
+    def test_dirty_paths_thin_wrapper_matches_checked(self):
+        with tempfile.TemporaryDirectory() as d:
+            with patch.object(notes_vcs, "_git",
+                                _FakeGit(porcelain=" M foo.md\n")):
+                self.assertEqual(notes_vcs.dirty_paths(Path(d)), {"foo.md"})
+
+
 class DirtyPathsTest(unittest.TestCase):
     def test_parses_porcelain_into_path_set(self):
         body = " M alpha.md\n?? beta.md\n D gone.md\n"

package/skills/work-plan/tests/test_plan_status_stamp.py

@@ -1,5 +1,6 @@
 """Stamp / draft behaviour for plan-status (offline)."""
 import io
+import os
 import unittest
 import sys
 import tempfile
@@ -11,6 +12,7 @@ SKILL_ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(SKILL_ROOT))
 
 from commands import plan_status
+from lib.doc_discovery import Doc
 from lib.status_header import BEGIN
 
 PLAN = (
@@ -21,6 +23,14 @@ PLAN = (
     "- [ ] Step 1\n"
 )
 
+ROW = {
+    "glyph": "✅",
+    "verdict": "shipped",
+    "files_present": 1,
+    "files_declared": 1,
+    "last_touched": "2026-07-12",
+}
+
 
 class StampBehaviourTest(unittest.TestCase):
     def _repo(self, d):
@@ -65,6 +75,64 @@ class StampBehaviourTest(unittest.TestCase):
             self._run(root, ["--stamp"])
             self.assertEqual(first, self.plan_path.read_text())
 
+    def test_stamp_rechecks_symlink_before_write(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/plans"
+            plans.mkdir(parents=True)
+            victim = Path(d) / "victim.md"
+            victim.write_text("# outside\n")
+            link = plans / "evil.md"
+            link.symlink_to(victim)
+            doc = Doc(path=link, rel="docs/plans/evil.md", kind="plan")
+
+            buf = io.StringIO()
+            with redirect_stdout(buf):
+                plan_status._stamp_docs([doc], [ROW], repo_root=root, draft=False)
+
+            self.assertEqual(victim.read_text(), "# outside\n")
+            self.assertIn("refusing to stamp unsafe path", buf.getvalue())
+
+    def test_stamp_cli_does_not_modify_outside_symlink_target(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/superpowers/plans"
+            plans.mkdir(parents=True)
+            victim = Path(d) / "victim.md"
+            victim.write_text(PLAN)
+            before = victim.read_bytes()
+            (plans / "evil.md").symlink_to(victim)
+
+            rc, out = self._run(root, ["--stamp"])
+
+            self.assertEqual(rc, 0)
+            self.assertEqual(victim.read_bytes(), before)
+            self.assertNotIn(BEGIN, victim.read_text())
+            self.assertIn("stamped 0 doc(s)", out)
+
+    def test_stamp_replaces_hard_link_without_modifying_outside_inode(self):
+        with tempfile.TemporaryDirectory() as d:
+            root = Path(d) / "repo"
+            plans = root / "docs/superpowers/plans"
+            plans.mkdir(parents=True)
+            victim = Path(d) / "victim.md"
+            victim.write_text(PLAN)
+            linked_plan = plans / "linked.md"
+            try:
+                os.link(str(victim), str(linked_plan))
+            except OSError as exc:
+                self.skipTest(f"hard links unavailable: {exc}")
+            original_inode = victim.stat().st_ino
+
+            rc, out = self._run(root, ["--stamp"])
+
+            self.assertEqual(rc, 0)
+            self.assertEqual(victim.read_text(), PLAN)
+            self.assertEqual(victim.stat().st_ino, original_inode)
+            self.assertNotEqual(linked_plan.stat().st_ino, original_inode)
+            self.assertIn(BEGIN, linked_plan.read_text())
+            self.assertIn("stamped 1 doc(s)", out)
+
 
 if __name__ == "__main__":
     unittest.main()

package/skills/work-plan/tests/test_plan_worktree.py

@@ -97,6 +97,20 @@ class SharedTierDirTest(unittest.TestCase):
             got = pw.shared_tier_dir({"local": d})
             self.assertEqual(got, Path(d).expanduser() / ".work-plan")
 
+    def test_no_plan_branch_refuses_symlinked_work_plan_root(self):
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            clone = base / "clone"
+            outside = base / "outside"
+            clone.mkdir()
+            outside.mkdir()
+            try:
+                (clone / ".work-plan").symlink_to(outside, target_is_directory=True)
+            except OSError as exc:
+                self.skipTest(f"directory symlinks unavailable: {exc}")
+
+            self.assertIsNone(pw.shared_tier_dir({"local": str(clone)}))
+
     def test_plan_branch_uses_worktree_when_present(self):
         with tempfile.TemporaryDirectory() as d:
             dest = Path(d) / "wt"
@@ -107,6 +121,23 @@ class SharedTierDirTest(unittest.TestCase):
                 got = pw.shared_tier_dir({"local": d, "plan_branch": "plan"})
             self.assertEqual(got, dest / ".work-plan")
 
+    def test_plan_branch_refuses_symlinked_work_plan_root(self):
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            dest = base / "wt"
+            outside = base / "outside"
+            dest.mkdir()
+            outside.mkdir()
+            (dest / ".git").write_text("gitdir: ...\n")
+            try:
+                (dest / ".work-plan").symlink_to(outside, target_is_directory=True)
+            except OSError as exc:
+                self.skipTest(f"directory symlinks unavailable: {exc}")
+            with patch.object(pw, "_worktree_dir", return_value=dest), \
+                 patch.object(pw, "_git", _FakeGit()):
+                got = pw.shared_tier_dir({"local": d, "plan_branch": "plan"})
+            self.assertIsNone(got)
+
     def test_plan_branch_none_when_branch_missing(self):
         with tempfile.TemporaryDirectory() as d:
             dest = Path(d) / "wt"  # no .git → must be created, but branch missing

package/skills/work-plan/tests/test_tracks.py

@@ -9,7 +9,7 @@ from unittest.mock import patch
 SKILL_ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(SKILL_ROOT))
 
-from lib.tracks import discover_tracks, discover_archived_tracks
+from lib.tracks import discover_tracks, discover_archived_tracks, iter_private_track_paths
 
 FIXTURES = Path(__file__).parent / "fixtures" / "notes_root"
 
@@ -120,6 +120,23 @@ class SharedTrackDiscoveryTest(unittest.TestCase):
             shared = next(t for t in tracks if t.name == "feat-x")
             self.assertEqual(shared.tier, "shared")
 
+    def test_symlinked_shared_root_outside_repo_is_not_discovered(self):
+        with tempfile.TemporaryDirectory() as d:
+            base = Path(d)
+            clone = _make_git_repo(base / "clone")
+            outside = base / "outside"
+            _write_track_md(outside / "escaped.md", "escaped", "org/myrepo")
+            try:
+                (clone / ".work-plan").symlink_to(outside, target_is_directory=True)
+            except OSError as exc:
+                self.skipTest(f"directory symlinks unavailable: {exc}")
+            notes = base / "notes"
+            notes.mkdir()
+
+            tracks = discover_tracks(self._make_cfg(clone, notes))
+
+            self.assertNotIn("escaped", [track.name for track in tracks])
+
     def test_shared_track_repo_from_folder_config(self):
         """repo and local_path on a shared track come from folder config, not frontmatter."""
         with tempfile.TemporaryDirectory() as d:
@@ -446,5 +463,42 @@ class DiscoverArchivedSharedTest(unittest.TestCase):
             self.assertNotIn("WARN:", stderr_buf.getvalue())
 
 
+class TestIterPrivateTrackPaths(unittest.TestCase):
+    def _make_tree(self, root: Path):
+        (root / "proj-a").mkdir(parents=True)
+        (root / "proj-a" / "track-one.md").write_text("---\n---\nbody")
+        (root / "proj-a" / "_draft.md").write_text("---\n---\nbody")
+        (root / "proj-a" / "archive").mkdir()
+        (root / "proj-a" / "archive" / "old-track.md").write_text("---\n---\nbody")
+        (root / "proj-a" / ".hidden.md").write_text("---\n---\nbody")
+
+    def test_excludes_archive_by_default(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            self._make_tree(root)
+            paths = iter_private_track_paths(root, include_archive=False)
+            names = {p.name for p in paths}
+            self.assertEqual(names, {"track-one.md"})
+
+    def test_includes_archive_when_requested(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            self._make_tree(root)
+            paths = iter_private_track_paths(root, include_archive=True)
+            names = {p.name for p in paths}
+            self.assertEqual(names, {"track-one.md", "old-track.md"})
+
+    def test_skips_dotfile_underscore_dash_prefixed_names_in_both_modes(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            self._make_tree(root)
+            (root / "proj-a" / "-dash.md").write_text("---\n---\nbody")
+            for include_archive in (False, True):
+                names = {p.name for p in iter_private_track_paths(root, include_archive)}
+                self.assertNotIn("_draft.md", names)
+                self.assertNotIn(".hidden.md", names)
+                self.assertNotIn("-dash.md", names)
+
+
 if __name__ == "__main__":
     unittest.main()