daftari 1.30.0 → 1.31.0

package/CHANGELOG.md

@@ -7,6 +7,111 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.31.0] - 2026-07-22
+
+The self-hosted deployment release: one always-on `daftari serve` instance
+over Streamable HTTP with per-session identity (static tokens and/or OAuth
+2.1), plus durable object-storage backing (S3/Azure/GCS-interop) behind the
+canonical local git working copy. Design record:
+`docs/superpowers/specs/2026-07-20-self-hosted-server-mode-design.md`.
+
+### Added
+
+- **`daftari serve` — server mode over Streamable HTTP (#5).** One always-on
+  instance, many MCP clients, per-session RBAC identity resolved at session
+  open (zero tool changes — every existence-disclosure invariant applies per
+  connection). Static bearer tokens declared in config with values in env
+  vars. Fail-loud posture throughout: a non-loopback bind refuses without
+  auth AND an explicit `server.transport_security: external` declaration
+  (daftari never terminates TLS); with auth configured a bad credential is a
+  401 at session open, never a guest downgrade; loopback binds carry a
+  DNS-rebinding guard (Host/Origin validated before routing). The process
+  lock learns modes: a stray stdio invocation refuses against a live server,
+  a new serve refuses against any live holder, and deliberate replacement is
+  `daftari serve --takeover` (stdio-vs-stdio keeps its classic takeover;
+  stale locks are still overwritten silently).
+- **OAuth 2.1 resource-server auth for serve (#7).** Bearer JWTs verified
+  against your IdP's JWKS (issuer + audience + signature + expiry via
+  `jose`), with the subject claim mapped through a config-declared subjects
+  table. A valid token with an unmapped subject is 403 — authenticated, not
+  authorized — never a guest, never a default role. Composes with static
+  tokens (agents on tokens, humans through the IdP). Hardened: https-only
+  issuer/JWKS URLs (loopback http for test IdPs only), constant-time static
+  token matching, `Object.prototype`-collision-proof subject lookup.
+- **Pluggable storage backends as sync targets (#6).** The local git working
+  copy stays canonical; a backend is a dumb `get/put/list/delete` target.
+  Backends: `fs` (local/mounted directory), `s3` (S3, MinIO, R2, GCS via its
+  S3-interop endpoint), `azure` (Blob/ADLS Gen2) — cloud SDKs are optional
+  peer dependencies loaded on demand, credentials come only from the SDKs'
+  environment chains, custom endpoints must be https. `daftari sync` pushes
+  incrementally against a remote hash manifest (tree + `.git` + durable
+  `.daftari` journals; the rebuildable index/locks never sync) and
+  `daftari sync --restore` rebuilds a vault into an empty directory with
+  per-object hash verification and a reindex. `daftari serve` can push on a
+  cadence (`storage.sync_interval_minutes`). Security posture: `.git/config`
+  and `.git/hooks` are never synced or restored (git executes what they
+  declare — a backup channel must not deliver code), and restore re-enforces
+  every exclusion against the untrusted manifest.
+- **Agent-as-judge rerank pool on `vault_search` (#3).** Opt-in
+  `rerank_candidates`: the server prepares the fused candidate pool and the
+  protocol; the calling agent is the judge.
+- **Per-document theme distributions (#58).** True multi-theme membership via
+  chunk-level clustering.
+- **Configurable tool-exposure tiers (#103, #104).** `tools.tier`
+  (`core`/`standard`/`full`) plus `include`/`exclude` lists in config.
+- **Resumable reindex (#54).** Per-batch embedding commits so an interrupted
+  reindex resumes instead of restarting.
+- **`daftari eval prune` (#100)** — `results/` and `scores/` housekeeping —
+  and eval v1 polish (#102): honest exit codes, skipped-run reporting, resume
+  validation, tier-aware triviality, intra-call dedupe, `--max-nodes`.
+- **Advisory domain-boundary enforcement (#4)** and inline structural decay
+  checks (orphans, deprecated-still-linked) in the curation engine.
+- **Advisory supersede nudge** when overwriting an existing doc, and a YAML
+  config error hint for comment lines that lost their `#`.
+- **`daftari okf export|import` — Open Knowledge Format bridge.** OKF is Google
+  Cloud's vendor-neutral spec (v0.1) for the LLM-wiki pattern — a directory of
+  markdown files with YAML frontmatter — which is exactly Daftari's storage
+  model. `okf export` renders a vault as a portable OKF bundle: each doc becomes
+  an OKF concept doc carrying the core `type` / `title` / `description` /
+  `resource` / `tags` / `timestamp` fields plus a verbatim `daftari` sidecar for
+  lossless round-trip, alongside generated `index.md` and `log.md` reserved
+  files; the source vault is never mutated. `okf import` adopts an OKF bundle
+  into a vault — a bundle from `okf export` round-trips exactly via its sidecar,
+  while a foreign bundle is mapped conservatively (docs land as `draft` in the
+  `accumulation` domain, the source OKF `type` preserved in `okf_type`); writes
+  auto-commit and the index is rebuilt. `--dry-run` previews the import plan.
+
+- **The compilation pipeline (#232–#236, #141, #217).** Edge provenance
+  classes with type-directed change dispatch (tier 1), structure-first tier-0
+  lint checks with a ratify gate, a semantic-review queue with typed verdicts
+  (tier 2), the compiled `consumes` dependency graph (run-correlated reads ×
+  writes, #233), edge staleness classes and the broken-read rate (#234),
+  proposal deltas (write action type, `run_id` provenance, inter-proposal
+  tension, a propose-only role, #235), write-protection tiers
+  (source/compiled/manual with a demote-then-write escape hatch, #141), a
+  review-throughput lint aggregate, and edge-graph existence disclosure
+  (blast B′, edges/lint omission) extending the 2026-07-14 RBAC spec (#217).
+- **`sleep` tension-scan dream-type (#228)** closing the day-0 detection gap,
+  a langgraph-store adapter with the dedup-is-not-epistemics demo (#227),
+  the daftari.dev landing page (#226), and MCP Registry metadata (#222).
+- **Dev maturity (#238–#242):** e2e gate on the built server, tag-driven npm
+  release via OIDC trusted publishing, automated code + security review on
+  PRs, an `@claude` mention responder, and a nightly maintenance loop.
+
+### Fixed
+
+- Canonical-path tension/provenance gates in `vault_status`, `vault_receipt`,
+  and precedent lookups (#216), and tier-1 anchors that are unreadable leak
+  neither provenance metadata nor existence (#252).
+- `daftari audit` no longer flags on-disk assets and unaudited siblings as
+  missing (#255); eval exit codes and resume validation honesty (#102).
+
+### Performance
+
+- SQL-authoritative edge reads with write-through and stat-marker self-heal
+  (#236), FTS5 `snippet()` for lexical excerpts on the chunk path, and the
+  file watcher filters non-markdown events at watch time (#107).
+
 ## [1.30.0] - 2026-07-13
 
 ### Added
@@ -1377,6 +1482,7 @@ vault to AI agents, exposing 13 tools over stdio.
   example documents, git history, search index); `daftari --vault` serves it.
 - 160 tests covering all 13 tools and their supporting modules.
 
+[1.31.0]: https://github.com/mavaali/daftari/releases/tag/v1.31.0
 [1.5.1]: https://github.com/mavaali/daftari/releases/tag/v1.5.1
 [1.4.0]: https://github.com/mavaali/daftari/releases/tag/v1.4.0
 [1.1.1]: https://github.com/mavaali/daftari/releases/tag/v1.1.1

package/README.md

@@ -116,6 +116,31 @@ The curation engine is advisory: `vault_lint` reports problems and
 `vault_tension_log` records contradictions. Neither auto-fixes anything. Every
 change is a deliberate, attributable act.
 
+### Tool tiers
+
+Every advertised tool costs the agent context tokens and a decision branch.
+The `tools` block in `.daftari/config.yaml` picks how much of the registry
+`tools/list` advertises:
+
+```yaml
+tools:
+  tier: standard   # core | standard | full (default: full)
+  include:         # add tools the tier omits
+    - vault_tension_log
+  exclude:         # remove tools the tier includes — exclude wins
+    - vault_status
+```
+
+`core` is the search-before-derive loop (`vault_search`, `vault_read`,
+`vault_write`, `vault_index`, `vault_lint`, `vault_status`); `standard` adds
+the full document lifecycle (append/promote/deprecate/supersede/merge,
+confidence and tier setters, propose/ratify) plus diagnostics; `full` is
+everything. `--tools <tier>` overrides the tier for one invocation. Filtering
+only changes what is *advertised* — calls to any registered tool still work,
+so an agent holding a cached tool name keeps working across a tier change.
+Unknown names in `include`/`exclude` warn at startup and are ignored, so a
+config written for a newer daftari still loads.
+
 **Evaluate (opt-in, requires an Anthropic API key):** `daftari eval` — scores how
 well an LLM can use the curation surface to answer multi-hop questions about the
 vault. See the [design spec](docs/superpowers/specs/2026-05-31-cortex-quality-metric-design.md)
@@ -243,6 +268,110 @@ daftari backfill --plan
 daftari backfill --apply --scope specs
 ```
 
+## Open Knowledge Format (OKF)
+
+[OKF](https://cloud.google.com/blog/products/data-analytics/how-the-open-knowledge-format-can-improve-data-sharing/)
+is Google Cloud's vendor-neutral spec (v0.1) for the LLM-wiki pattern: a
+directory of markdown files with YAML frontmatter that any producer can emit and
+any consumer can read without translation. A Daftari vault *is* that pattern, so
+`daftari okf` bridges the two directions.
+
+**Export** renders the vault as a portable OKF bundle — every doc becomes an OKF
+concept doc (the core `type` / `title` / `description` / `resource` / `tags` /
+`timestamp` fields, plus a verbatim `daftari` sidecar for lossless round-trip),
+with generated `index.md` (progressive-disclosure listing) and `log.md`
+(chronological history). The source vault is never mutated.
+
+```bash
+daftari okf export ./my-vault --out ./okf-bundle
+daftari okf export ./my-vault --out ./okf-bundle --collection pricing
+```
+
+**Import** adopts an OKF bundle into a vault. A bundle produced by `okf export`
+round-trips exactly via its sidecar; a foreign bundle is mapped conservatively
+(docs land as `draft` in the `accumulation` domain, the original OKF `type` is
+preserved in an `okf_type` field). Writes auto-commit and the index is rebuilt.
+
+```bash
+daftari okf import ./okf-bundle --into ./my-vault --dry-run
+daftari okf import ./okf-bundle --into ./my-vault
+```
+
+## Server mode (self-hosted)
+
+By default daftari is a per-user stdio process. `daftari serve` starts the
+same vault as **one always-on instance over Streamable HTTP** — for a team, or
+for clients that can't spawn a local process (claude.ai web/mobile, Cowork):
+
+```bash
+daftari serve --vault ./my-vault              # http://127.0.0.1:8787/mcp
+daftari serve --vault ./my-vault --bind 0.0.0.0 --port 9000
+```
+
+Identity is **per MCP session**, resolved when the session opens, so every
+RBAC and existence-disclosure rule applies per connection with zero tool
+changes. Two composable auth schemes, both declared in config:
+
+```yaml
+server:
+  transport_security: external   # required off-loopback: TLS terminates upstream
+  auth:
+    tokens:                      # static bearer tokens (agents, ETL)
+      - env: DAFTARI_TOKEN_ETL   # the VALUE lives in this env var, never in config
+        user: agent:etl
+        role: admin
+    oauth:                       # OAuth 2.1 resource server (humans via your IdP)
+      issuer: https://idp.example.com
+      audience: daftari
+      jwks_uri: https://idp.example.com/.well-known/jwks.json
+      subjects:
+        "alice@example.com": { user: human:alice, role: analyst }
+```
+
+The posture is fail-loud, never silent-downgrade: a non-loopback bind refuses
+to start without auth **and** the explicit `transport_security: external`
+acknowledgment (daftari never terminates TLS itself — put Caddy/nginx/a load
+balancer in front); with any auth configured, a bad or missing credential is
+a 401 at session open and a valid JWT whose subject isn't mapped is a 403 —
+neither ever becomes the guest. Guest sessions exist only in the no-auth
+loopback configuration. A running server also refuses to be silently killed:
+stray stdio invocations against the same vault refuse to start, and replacing
+a live holder requires a deliberate `daftari serve --takeover`.
+
+## Storage backing
+
+A self-hosted vault can push to durable object storage (#6). The local git
+working copy stays canonical — reads, writes, auto-commits, locks, and the
+index all stay exactly as above — and the backing is a dumb sync target:
+
+```yaml
+# .daftari/config.yaml
+storage:
+  backend: s3            # fs | s3 | azure
+  bucket: team-vault
+  region: us-east-1
+  # endpoint: https://…  # MinIO / R2 / GCS S3-interop endpoints
+  # sync_interval_minutes: 15   # daftari serve pushes on this cadence
+```
+
+```bash
+daftari sync --vault ./my-vault              # incremental push
+daftari sync --vault ./my-vault --dry-run    # show the diff only
+daftari sync --vault ./empty-dir --restore --backend s3 --bucket team-vault
+```
+
+The push covers the markdown tree, the `.git` directory, and durable
+`.daftari` journals; the rebuildable SQLite index and lock files never sync.
+Neither do `.git/config` and `.git/hooks` — git *executes* what those
+declare, and a backup channel must not deliver code (`git clone` refuses to
+transmit them for the same reason), so re-add remotes and local git config
+by hand after a restore.
+Cloud backends load their SDKs (`@aws-sdk/client-s3`, `@azure/storage-blob`)
+as optional dependencies — install the one you use; credentials come from the
+SDK's standard environment chain, never from vault config. GCS is reached via
+its S3-interoperability endpoint. Restore refuses non-empty directories and
+reindexes when done.
+
 ## How it compares
 
 |                    |AGENTS.md        |RAG                          |Daftari                              |
@@ -257,12 +386,18 @@ daftari backfill --apply --scope specs
 
 Deliberately deferred to keep the surface tight:
 
-- **Cloud-hosted multi-tenant server** with S3/GCS backend and token auth
-- **Remote MCP transport** for claude.ai web, mobile, and Cowork (v1 is a local desktop extension for Claude Desktop and Claude Code)
+- **Cloud-hosted multi-tenant SaaS** (self-hosted server mode HAS shipped —
+  see [Server mode](#server-mode-self-hosted) and
+  [Storage backing](#storage-backing); the project itself hosts nothing)
 - **Conflict resolution beyond file-level locks** (CRDTs, semantic merge)
 - **Background curation agent** running lint on a cadence
-- **LLM reranking** of search results
-- **Enforced domain separation** (v1 documents the convention; v2 enforces it)
+- **Enforced domain separation** (v1 documents the convention; v2 enforces it —
+  advisory boundary warnings shipped in the meantime: `vault_lint`'s
+  `domainLeaks` check and write-time `domain_warnings`)
+
+(LLM reranking, deferred here originally, has since shipped as the opt-in
+agent-as-judge `rerank_candidates` on `vault_search`: the server prepares the
+fused candidate pool and the protocol; the calling agent is the judge.)
 
 Each is a clean increment on a surface that already works.
 

package/dist/access/rbac.d.ts

@@ -12,6 +12,7 @@ export declare function canRead(role: RoleConfig | null, collection: string): bo
 export declare function canWrite(role: RoleConfig | null, collection: string): boolean;
 export declare function canPromote(role: RoleConfig | null): boolean;
 export declare function canRatify(role: RoleConfig | null): boolean;
+export declare function isProposeOnly(role: RoleConfig | null): boolean;
 export declare function hasAnyRead(role: RoleConfig | null): boolean;
 export declare function filterByReadPermission<T extends {
     collection: string;

package/dist/access/rbac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/access/rbac.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEpE,eAAO,MAAM,UAAU,UAAU,CAAC;AAClC,eAAO,MAAM,QAAQ,MAAM,CAAC;AAI5B,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAKD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,aAAa,CAEf;AAID,wBAAgB,WAAW,CAAC,IAAI,SAAU,GAAG,aAAa,CAEzD;AAOD,wBAAgB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE5E;AAGD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE7E;AAGD,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE3D;AAMD,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE1D;AAID,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE3D;AAID,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,EACrE,IAAI,EAAE,UAAU,GAAG,IAAI,EACvB,KAAK,EAAE,CAAC,EAAE,GACT,CAAC,EAAE,CAEL"}
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/access/rbac.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEpE,eAAO,MAAM,UAAU,UAAU,CAAC;AAClC,eAAO,MAAM,QAAQ,MAAM,CAAC;AAI5B,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAKD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,aAAa,CAEf;AAID,wBAAgB,WAAW,CAAC,IAAI,SAAU,GAAG,aAAa,CAEzD;AAOD,wBAAgB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE5E;AAGD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE7E;AAGD,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE3D;AAMD,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE1D;AAMD,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE9D;AAID,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE3D;AAID,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,EACrE,IAAI,EAAE,UAAU,GAAG,IAAI,EACvB,KAAK,EAAE,CAAC,EAAE,GACT,CAAC,EAAE,CAEL"}

package/dist/access/rbac.js

@@ -42,6 +42,13 @@ export function canPromote(role) {
 export function canRatify(role) {
     return role?.ratify ?? false;
 }
+// True if the role is propose-only (#235): its writes must land as staged
+// `write` proposals, never as direct mutations. vault_write coerces; every
+// other write tool denies. The write grant still scopes WHICH collections the
+// role may propose into.
+export function isProposeOnly(role) {
+    return role?.proposeOnly ?? false;
+}
 // True if the role has read access to at least one collection. Curation tools
 // (lint, tension log, provenance) are open to anyone with any read grant.
 export function hasAnyRead(role) {

package/dist/access/rbac.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/access/rbac.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAI1E,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAClC,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAU5B,+EAA+E;AAC/E,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,IAAY,EACZ,QAAgB;IAEhB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,0BAA0B;AAC1B,MAAM,UAAU,WAAW,CAAC,IAAI,GAAG,OAAO;IACxC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,UAAkB;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC9D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,OAAO,CAAC,IAAuB,EAAE,UAAkB;IACjE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,QAAQ,CAAC,IAAuB,EAAE,UAAkB;IAClE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,wEAAwE;AACxE,kDAAkD;AAClD,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,OAAO,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,UAAU,sBAAsB,CACpC,IAAuB,EACvB,KAAU;IAEV,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/access/rbac.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAI1E,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAClC,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAU5B,+EAA+E;AAC/E,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,IAAY,EACZ,QAAgB;IAEhB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,0BAA0B;AAC1B,MAAM,UAAU,WAAW,CAAC,IAAI,GAAG,OAAO;IACxC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,UAAkB;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC9D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,OAAO,CAAC,IAAuB,EAAE,UAAkB;IACjE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,QAAQ,CAAC,IAAuB,EAAE,UAAkB;IAClE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,wEAAwE;AACxE,kDAAkD;AAClD,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,OAAO,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;AAC/B,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,8EAA8E;AAC9E,yBAAyB;AACzB,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,OAAO,IAAI,EAAE,WAAW,IAAI,KAAK,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,UAAU,sBAAsB,CACpC,IAAuB,EACvB,KAAU;IAEV,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/audit/checks/broken_refs.d.ts

@@ -1,3 +1,3 @@
 import type { BrokenRefFinding, LinkEdge, RepoSnapshot } from "../types.js";
-export declare function checkBrokenRefs(snapshots: RepoSnapshot[], edges: LinkEdge[]): BrokenRefFinding[];
+export declare function checkBrokenRefs(snapshots: RepoSnapshot[], edges: LinkEdge[], existsWithin?: (rootAbs: string, targetAbs: string) => boolean): BrokenRefFinding[];
 //# sourceMappingURL=broken_refs.d.ts.map

package/dist/audit/checks/broken_refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broken_refs.d.ts","sourceRoot":"","sources":["../../../src/audit/checks/broken_refs.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE5E,wBAAgB,eAAe,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,CA0DhG"}
+{"version":3,"file":"broken_refs.d.ts","sourceRoot":"","sources":["../../../src/audit/checks/broken_refs.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS5E,wBAAgB,eAAe,CAC7B,SAAS,EAAE,YAAY,EAAE,EACzB,KAAK,EAAE,QAAQ,EAAE,EAIjB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,GAC7D,gBAAgB,EAAE,CAiGpB"}

package/dist/audit/checks/broken_refs.js

@@ -1,32 +1,72 @@
 // src/audit/checks/broken_refs.ts
 // Pure function: given snapshots and classified edges, return every broken
-// reference as a BrokenRefFinding. No throws. No classes.
+// reference as a BrokenRefFinding. No throws. No classes. Disk access enters
+// ONLY through the injected `existsWithin` oracle — the orchestrator passes
+// collect.ts's symlink-safe implementation; tests pass a fake; omitting it
+// reproduces the index-only behavior. The oracle receives the CONTAINMENT
+// ROOT alongside the target because existence and confinement must be
+// decided together: a lexical check here plus a bare exists() there would
+// let a committed symlink (repo/escape -> /) walk the probe back out.
 //
 // Resolution logic:
 //   1. Look up target repo by name; if not found → missing_file.
 //   2. Look up targetPath in that repo's docs Map.
 //   3. If not found and targetPath lacks a ".md" extension, try targetPath +
 //      ".md" (spec §7 bare-path fallback).
-//   4. If still not found → missing_file.
-//   5. If found and targetAnchor is set: check DocSnapshot.headings. If absent
+//   4. Still not found, edge escaped every configured repo (outOfScope):
+//      existing on disk → out_of_scope_target (the audit can't vouch for it,
+//      but the link is not broken — #133); absent → missing_file.
+//   5. Still not found, in-scope: existing on disk → NOT a finding — the doc
+//      index only holds glob-matched markdown, and references to real assets
+//      (.png, .pdf, .dagitty, …) are legitimate (#132). Anchors into such
+//      files are unverifiable and deliberately not flagged.
+//   6. Otherwise → missing_file.
+//   7. If found and targetAnchor is set: check DocSnapshot.headings. If absent
 //      → missing_anchor.
-export function checkBrokenRefs(snapshots, edges) {
+import { isAbsolute, relative as nodeRelative, resolve as nodeResolve } from "node:path";
+// True iff `abs` sits at or under `root` (lexical containment; both sides are
+// already-resolved absolute paths).
+function within(root, abs) {
+    const rel = nodeRelative(root, abs);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+export function checkBrokenRefs(snapshots, edges, 
+// Must return true only when targetAbs exists on disk AND its REAL
+// (symlink-resolved) location sits under rootAbs. See
+// collect.ts#symlinkSafeExistsWithin for the production implementation.
+existsWithin) {
     // Index snapshots by repo name for O(1) lookup.
     const byRepo = new Map();
     for (const snap of snapshots) {
         byRepo.set(snap.config.name, snap);
     }
+    // The existence oracle is CONFINED (security review on #255): probing an
+    // arbitrary resolvedAbs would let anyone who can author a doc turn the
+    // audit report into a host-filesystem existence probe
+    // ([x](../../../../etc/shadow) → out_of_scope_target vs missing_file).
+    // #133's actual case is UNAUDITED SIBLINGS, so out-of-scope probes are
+    // allowed only under the parent directories of the configured repo roots;
+    // anything further out is reported missing_file without ever touching
+    // disk — exactly the pre-oracle behavior. A repo mounted directly under
+    // the filesystem root gets NO sibling scope: its "parent" would be the
+    // entire filesystem and the confinement would collapse to none, so
+    // out-of-scope refs from such a repo stay unprobed.
+    const siblingScopes = snapshots.flatMap((s) => {
+        const parent = nodeResolve(s.config.path, "..");
+        return nodeResolve(parent, "..") === parent ? [] : [parent];
+    });
     const findings = [];
     for (const edge of edges) {
+        const finding = (kind, path) => ({
+            kind,
+            source: { repo: edge.sourceRepo, path: edge.sourcePath },
+            target: { repo: edge.targetRepo, path, anchor: edge.targetAnchor },
+            rawHref: edge.rawHref,
+        });
         const targetSnap = byRepo.get(edge.targetRepo);
         if (!targetSnap) {
             // Target repo itself is unknown — treat as missing file.
-            findings.push({
-                kind: "missing_file",
-                source: { repo: edge.sourceRepo, path: edge.sourcePath },
-                target: { repo: edge.targetRepo, path: edge.targetPath, anchor: edge.targetAnchor },
-                rawHref: edge.rawHref,
-            });
+            findings.push(finding("missing_file", edge.targetPath));
             continue;
         }
         // Resolve the target doc: exact match, then .md fallback.
@@ -41,24 +81,39 @@ export function checkBrokenRefs(snapshots, edges) {
             }
         }
         if (resolvedPath === null) {
-            findings.push({
-                kind: "missing_file",
-                source: { repo: edge.sourceRepo, path: edge.sourcePath },
-                target: { repo: edge.targetRepo, path: edge.targetPath, anchor: edge.targetAnchor },
-                rawHref: edge.rawHref,
-            });
+            if (edge.outOfScope) {
+                // The href escaped every audited repo (#133). A file that exists out
+                // there is not a broken link — but it stays VISIBLE with its own
+                // kind, never silently passed: the audit cannot vouch for a target
+                // it does not scan. The probe runs only inside the sibling scopes
+                // (see above); a target beyond them is missing_file, unprobed.
+                const resolvedAbs = edge.resolvedAbs;
+                // Lexical pre-filter picks the candidate scope without touching
+                // disk; the oracle then re-verifies containment on REAL paths.
+                const scope = resolvedAbs !== undefined ? siblingScopes.find((s) => within(s, resolvedAbs)) : undefined;
+                findings.push(finding(resolvedAbs !== undefined && scope !== undefined && existsWithin?.(scope, resolvedAbs)
+                    ? "out_of_scope_target"
+                    : "missing_file", edge.targetPath));
+                continue;
+            }
+            // In-scope miss: the docs map only holds glob-matched markdown, but a
+            // reference to a real on-disk asset is legitimate (#132) — one
+            // existence probe, no finding. Anchors into assets are unverifiable.
+            // The probe is confined to the target repo root: a URL-derived
+            // targetPath can carry ../ segments, and escaping paths must not be
+            // probed (same oracle concern as above).
+            const abs = nodeResolve(targetSnap.config.path, edge.targetPath);
+            if (within(targetSnap.config.path, abs) && existsWithin?.(targetSnap.config.path, abs)) {
+                continue;
+            }
+            findings.push(finding("missing_file", edge.targetPath));
             continue;
         }
         // File found. Check anchor if present.
         if (edge.targetAnchor !== null) {
             const doc = targetSnap.docs.get(resolvedPath);
             if (doc && !doc.headings.has(edge.targetAnchor)) {
-                findings.push({
-                    kind: "missing_anchor",
-                    source: { repo: edge.sourceRepo, path: edge.sourcePath },
-                    target: { repo: edge.targetRepo, path: resolvedPath, anchor: edge.targetAnchor },
-                    rawHref: edge.rawHref,
-                });
+                findings.push(finding("missing_anchor", resolvedPath));
             }
         }
     }

package/dist/audit/checks/broken_refs.js.map

@@ -1 +1 @@
-{"version":3,"file":"broken_refs.js","sourceRoot":"","sources":["../../../src/audit/checks/broken_refs.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,2EAA2E;AAC3E,0DAA0D;AAC1D,EAAE;AACF,oBAAoB;AACpB,iEAAiE;AACjE,mDAAmD;AACnD,6EAA6E;AAC7E,2CAA2C;AAC3C,0CAA0C;AAC1C,+EAA+E;AAC/E,yBAAyB;AAIzB,MAAM,UAAU,eAAe,CAAC,SAAyB,EAAE,KAAiB;IAC1E,gDAAgD;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,yDAAyD;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;gBACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;gBACnF,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,0DAA0D;QAC1D,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,KAAK,CAAC;YACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,YAAY,GAAG,MAAM,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;gBACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;gBACnF,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;oBACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;oBAChF,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"broken_refs.js","sourceRoot":"","sources":["../../../src/audit/checks/broken_refs.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,0EAA0E;AAC1E,sEAAsE;AACtE,EAAE;AACF,oBAAoB;AACpB,iEAAiE;AACjE,mDAAmD;AACnD,6EAA6E;AAC7E,2CAA2C;AAC3C,yEAAyE;AACzE,6EAA6E;AAC7E,kEAAkE;AAClE,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,4DAA4D;AAC5D,iCAAiC;AACjC,+EAA+E;AAC/E,yBAAyB;AAEzB,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAGzF,8EAA8E;AAC9E,oCAAoC;AACpC,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAyB,EACzB,KAAiB;AACjB,mEAAmE;AACnE,sDAAsD;AACtD,wEAAwE;AACxE,YAA8D;IAE9D,gDAAgD;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,sDAAsD;IACtD,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,oDAAoD;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,IAA8B,EAAE,IAAY,EAAoB,EAAE,CAAC,CAAC;YACnF,IAAI;YACJ,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;YAClE,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,yDAAyD;YACzD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QAED,0DAA0D;QAC1D,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,KAAK,CAAC;YACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,YAAY,GAAG,MAAM,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,qEAAqE;gBACrE,iEAAiE;gBACjE,mEAAmE;gBACnE,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;gBACrC,gEAAgE;gBAChE,+DAA+D;gBAC/D,MAAM,KAAK,GACT,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5F,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC;oBACpF,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,cAAc,EAClB,IAAI,CAAC,UAAU,CAChB,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,sEAAsE;YACtE,+DAA+D;YAC/D,qEAAqE;YACrE,+DAA+D;YAC/D,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACvF,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/audit/collect.d.ts

@@ -1,4 +1,5 @@
 import { type Result } from "../frontmatter/types.js";
 import type { AuditConfig, AuditError, RepoSnapshot } from "./types.js";
+export declare function symlinkSafeExistsWithin(rootAbs: string, targetAbs: string): boolean;
 export declare function collectRepos(config: AuditConfig): Promise<Result<RepoSnapshot[], AuditError>>;
 //# sourceMappingURL=collect.d.ts.map

package/dist/audit/collect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/audit/collect.ts"],"names":[],"mappings":"AAWA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAA2B,YAAY,EAAE,MAAM,YAAY,CAAC;AAqKjG,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC,CAa7C"}
+{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/audit/collect.ts"],"names":[],"mappings":"AAWA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAA2B,YAAY,EAAE,MAAM,YAAY,CAAC;AAYjG,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CASnF;AAoKD,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC,CAa7C"}

package/dist/audit/collect.js

@@ -3,14 +3,34 @@
 // frontmatter, extract headings (GitHub-slugged) and links, then batch
 // git log to populate mtimes; on any git failure, fall back to fs mtime.
 import { execFileSync } from "node:child_process";
-import { statSync } from "node:fs";
+import { realpathSync, statSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import { resolve as nodeResolve } from "node:path";
+import { isAbsolute, relative as nodeRelative, resolve as nodeResolve } from "node:path";
 import { glob } from "glob";
 import matter from "gray-matter";
 import { err, ok } from "../frontmatter/types.js";
 import { extractLinksFromBody } from "./links.js";
 import { runtimeError } from "./types.js";
+// The disk oracle for checkBrokenRefs (#132/#133): true iff targetAbs
+// exists AND its REAL location sits under rootAbs. realpathSync resolves
+// every component, so a symlink committed inside an audited repo
+// (escape -> /) cannot route the probe outside the containment root — a
+// lexical check plus a bare existsSync would (security review on #255).
+// rootAbs is expected to be already-real: repo roots are realpathSync'd at
+// config load, and the parent prefix of a real path is itself real.
+// A nonexistent target makes realpathSync throw ENOENT → false, which is
+// exactly the "missing" answer.
+export function symlinkSafeExistsWithin(rootAbs, targetAbs) {
+    let real;
+    try {
+        real = realpathSync(targetAbs);
+    }
+    catch {
+        return false;
+    }
+    const rel = nodeRelative(rootAbs, real);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
 function slugify(heading) {
     // GitHub slug: lowercase, strip non-alphanumeric (keep `-_`), whitespace -> `-`.
     return heading

package/dist/audit/collect.js.map

@@ -1 +1 @@
-{"version":3,"file":"collect.js","sourceRoot":"","sources":["../../src/audit/collect.ts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AAEzE,OAAO,EAA4B,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,SAAS,OAAO,CAAC,OAAe;IAC9B,iFAAiF;IACjF,OAAO,OAAO;SACX,WAAW,EAAE;SACb,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACjD,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,QAAgB;IACnD,MAAM,IAAI,GAAwB;QAChC,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;QAC5B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CAAC;IACF,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC;QAC7E,GAAG,GAAG,YAAY,CAChB,KAAK,EACL,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,CAAC,EAC7E,IAAI,CACL,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,SAAS;QACnC,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,QAAgB,EAChB,OAAe,EACf,YAAgC;IAEhC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;IAE5B,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,YAAY,GAAI,MAAM,CAAC,IAAgC,CAAC,SAAS,CAAC;IACxE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,KAAa,CAAC;IAClB,IAAI,WAAyB,CAAC;IAC9B,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,GAAG,YAAY,CAAC;QACrB,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9C,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzC,OAAO;QACP,KAAK;QACL,WAAW;QACX,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC;QAC/B,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC;QACjC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,+EAA+E;AAC/E,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAE7C,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,6DAA6D;AAC7D,KAAK,UAAU,eAAe,CAAC,MAAkB;IAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;QACxC,GAAG,EAAE,MAAM,CAAC,IAAI;QAChB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;YACjB,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC3C,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,IAAI,GAAG,EAAE;YACnB,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAkB;IAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;QACxC,GAAG,EAAE,MAAM,CAAC,IAAI;QAChB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB;IAEnB,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;AACjB,CAAC"}
+{"version":3,"file":"collect.js","sourceRoot":"","sources":["../../src/audit/collect.ts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,sEAAsE;AACtE,uEAAuE;AACvE,yEAAyE;AAEzE,OAAO,EAA4B,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,sEAAsE;AACtE,yEAAyE;AACzE,iEAAiE;AACjE,wEAAwE;AACxE,wEAAwE;AACxE,2EAA2E;AAC3E,oEAAoE;AACpE,yEAAyE;AACzE,gCAAgC;AAChC,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,SAAiB;IACxE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,iFAAiF;IACjF,OAAO,OAAO;SACX,WAAW,EAAE;SACb,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACjD,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,QAAgB;IACnD,MAAM,IAAI,GAAwB;QAChC,GAAG,EAAE,QAAQ;QACb,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;QAC5B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CAAC;IACF,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC;QAC7E,GAAG,GAAG,YAAY,CAChB,KAAK,EACL,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,CAAC,EAC7E,IAAI,CACL,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,SAAS;QACnC,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,QAAgB,EAChB,OAAe,EACf,YAAgC;IAEhC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;IAE5B,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,YAAY,GAAI,MAAM,CAAC,IAAgC,CAAC,SAAS,CAAC;IACxE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,KAAa,CAAC;IAClB,IAAI,WAAyB,CAAC;IAC9B,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,GAAG,YAAY,CAAC;QACrB,WAAW,GAAG,KAAK,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9C,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzC,OAAO;QACP,KAAK;QACL,WAAW;QACX,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC;QAC/B,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC;QACjC,SAAS;KACV,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,+EAA+E;AAC/E,uEAAuE;AACvE,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAE7C,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,6DAA6D;AAC7D,KAAK,UAAU,eAAe,CAAC,MAAkB;IAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;QACxC,GAAG,EAAE,MAAM,CAAC,IAAI;QAChB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;YACjB,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC3C,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,IAAI,GAAG,EAAE;YACnB,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAkB;IAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;QACxC,GAAG,EAAE,MAAM,CAAC,IAAI;QAChB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,KAAK;KACX,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB;IAEnB,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;AACjB,CAAC"}

package/dist/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAqBvE,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAqED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,GAAE,cAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8H9F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAqBvE,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAqED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,GAAE,cAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoI9F"}

package/dist/audit/index.js

@@ -11,7 +11,7 @@ import { createAnthropicClient } from "../eval/llm.js";
 import { checkBrokenRefs } from "./checks/broken_refs.js";
 import { checkDescribesRefs } from "./checks/describes_refs.js";
 import { checkStaleness } from "./checks/staleness.js";
-import { collectRepos } from "./collect.js";
+import { collectRepos, symlinkSafeExistsWithin } from "./collect.js";
 import { parseAuditConfig } from "./config.js";
 import { classifyDescribesEdges } from "./describes.js";
 import { computeExitCode } from "./exit.js";
@@ -135,7 +135,10 @@ export async function runAudit(argv, overrides = {}) {
     }
     const snapshots = collected.value;
     const edges = classifyEdges(snapshots);
-    const brokenRefs = checkBrokenRefs(snapshots, edges);
+    // The disk oracle lets the pure check distinguish real breaks from
+    // references to on-disk assets (#132) and unaudited siblings (#133) —
+    // symlink-safe, so a committed link cannot route the probe off-scope.
+    const brokenRefs = checkBrokenRefs(snapshots, edges, symlinkSafeExistsWithin);
     const staleness = checkStaleness(snapshots, edges, config.staleness.thresholdDays, new Date());
     const describesEdges = classifyDescribesEdges(snapshots);
     const describesRefs = checkDescribesRefs(snapshots, describesEdges);
@@ -162,7 +165,10 @@ export async function runAudit(argv, overrides = {}) {
         docsScanned: snapshots
             .filter((s) => s.config.type !== "code")
             .reduce((n, s) => n + s.docs.size, 0),
-        brokenRefs: brokenRefs.length,
+        // Out-of-scope targets are visibility, not breakage (#133): their own
+        // total, excluded from brokenRefs so the failOn gate never trips on them.
+        brokenRefs: brokenRefs.filter((f) => f.kind !== "out_of_scope_target").length,
+        outOfScopeTargets: brokenRefs.filter((f) => f.kind === "out_of_scope_target").length,
         directlyStale: staleness.filter((f) => f.kind === "direct").length,
         transitivelyStale: staleness.filter((f) => f.kind === "transitive").length,
         brokenDescribes: describesRefs.length,