devrites 3.2.16 → 3.2.18

package/engine/hooks_workspace.go

@@ -262,14 +262,15 @@ func hookStatusline(stdin io.Reader, stdout, stderr io.Writer) int {
 // insensitive, and FAIL/PASS scans are line oriented.
 // pack-scan-ignore: these are the hook's own red/green heuristics, not a payload.
 var (
-	redTestCmdRe = regexp.MustCompile(`(?i)(npm|pnpm|yarn|bun)([[:space:]]+run)?[[:space:]]+(test|build|lint|typecheck|check)|jest|vitest|pytest|go[[:space:]]+test|cargo[[:space:]]+(test|build|clippy)|\bmvn\b|gradle|eslint|ruff|mypy|\btsc\b|\bmake[[:space:]]+(test|build|check)`)
-	redFailRe    = regexp.MustCompile(`(?im)(^|[^A-Za-z])FAIL([^A-Za-z]|$)|[1-9][0-9]*[[:space:]]+(failed|failing|failures?|errors?)|not ok|panic:|error TS[0-9]|Traceback|AssertionError|✗|✘|BUILD FAILED|exit code [1-9]`)
-	redPassRe    = regexp.MustCompile(`(?im)PASS(ED)?|0[[:space:]]+(failed|failing|errors?)|all tests passed|BUILD SUCC(ESS|EEDED)|succeeded|no (errors|problems|issues)|(^|[^a-z])ok([^a-z]|$)|✓`)
+	redTestCmdRe            = regexp.MustCompile(`(?i)(npm|pnpm|yarn|bun)([[:space:]]+run)?[[:space:]]+(test|build|lint|typecheck|check)|jest|vitest|pytest|go[[:space:]]+test|cargo[[:space:]]+(test|build|clippy)|\bmvn\b|gradle|eslint|ruff|mypy|\btsc\b|\bmake[[:space:]]+(test|build|check)`)
+	redFailRe               = regexp.MustCompile(`(?im)(^|[^A-Za-z])FAIL([^A-Za-z]|$)|[1-9][0-9]*[[:space:]]+(failed|failing|failures?|errors?)|not ok|panic:|error TS[0-9]|Traceback|AssertionError|✗|✘|BUILD FAILED|exit code [1-9]`)
+	redPassRe               = regexp.MustCompile(`(?im)PASS(ED)?|0[[:space:]]+(failed|failing|errors?)|all tests passed|BUILD SUCC(ESS|EEDED)|succeeded|no (errors|problems|issues)|(^|[^a-z])ok([^a-z]|$)|✓`)
+	reconcileRestoreCheckRe = regexp.MustCompile(`^\s*(?:rtk\s+)?(?:[A-Za-z0-9_./-]+/)?devrites-engine\s+reconcile\s+restore-check(?:\s+[A-Za-z0-9._-]+)?\s*$`)
 )
 
 const redReasonFmt = "DevRites: tests/build are RED (%s). Fix to green or record the failure + next step in state.md before stopping: the Stop gate blocks an end-of-turn while .red is set."
 
-// hookRedwatch handles PostToolUse Bash events for test, build, lint, and type
+// hookRedwatch handles PostToolUse shell events for test, build, lint, and type
 // checking commands. It sets or clears <featureDir>/.red so the Stop gate can
 // catch a known failing suite. Its command and output checks match
 // devrites-redwatch.sh, and uncertain input leaves state unchanged.
@@ -286,7 +287,7 @@ func hookRedwatch(h harness.Harness, stdin io.Reader, stdout, stderr io.Writer)
 		return exitOK
 	}
 	in := h.ParseGuardInput(bytes.NewReader(data))
-	if in.ToolName != "Bash" {
+	if !isShellTool(in.ToolName) {
 		return exitOK
 	}
 	// Ignore commands unrelated to tests, builds, linting, or type checking.
@@ -562,7 +563,8 @@ func hookWrightScope(h harness.Harness, stdin io.Reader, stdout, stderr io.Write
 		return exitOK
 	}
 	in := h.ParseGuardInput(bytes.NewReader(data))
-	kind := devritesAgentForGuard(h, in)
+	binding := devritesAgentBindingForGuard(h, in)
+	kind := binding.Kind
 	genericCompat := os.Getenv("DEVRITES_CODEX_GENERIC_AGENT_COMPAT") == "1"
 	if in.AgentType == "" && in.AgentID == "" {
 		if code, handled := guardRootBuildWindow(h, data, in, stdout, stderr); handled {
@@ -620,6 +622,21 @@ func hookWrightScope(h harness.Harness, stdin io.Reader, stdout, stderr io.Write
 		return exitOK
 	}
 	if genericWright && !forgeDeclared {
+		if binding.Role != "devrites-slice-wright" {
+			if wsIsFile(filepath.Join(dir, ".reconcile-base")) {
+				return denyOrObserveWright(
+					h,
+					stdout,
+					stderr,
+					dir,
+					true,
+					wrightForbiddenReason,
+					drvreason.HookWrightForbiddenDenied,
+					[]string{"unbound generic worker"},
+				)
+			}
+			return exitOK
+		}
 		if !wsIsFile(filepath.Join(dir, ".reconcile-base")) {
 			return exitOK
 		}
@@ -1044,6 +1061,9 @@ func classifyRootBuildWindowOperation(root string, data []byte, in harness.Guard
 	if isOpaqueExecutionTool(in.ToolName) {
 		return true, true, in.ToolName
 	}
+	if isShellTool(in.ToolName) && strings.Contains(in.Command, "reconcile restore-check") {
+		return true, !reconcileRestoreCheckRe.MatchString(in.Command), in.Command
+	}
 
 	projectDir := filepath.Dir(root)
 	targets, suspicious := rootMutationTargets(data, in)

package/engine/internal/devritespaths/paths.go

@@ -93,6 +93,86 @@ func FeatureDir(root, slug string) string {
 	return work
 }
 
+// ExistingFeatureDirChecked resolves an existing canonical feature workspace
+// without following a work/<slug> or features/<slug> symlink. Mutating
+// control-plane commands use this instead of FeatureDir so an attacker cannot
+// redirect archive/removal operations outside the selected DevRites root.
+func ExistingFeatureDirChecked(root, slug string) (string, error) {
+	if !validSlug(slug) {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: %q is not a feature slug", slug)
+	}
+	if ws, err := WorkspaceOverrideChecked(root, slug); err != nil {
+		return "", err
+	} else if ws != "" {
+		return ws, nil
+	}
+	for _, parent := range []string{"work", "features"} {
+		candidate := filepath.Join(root, parent, slug)
+		resolved, err := checkedCanonicalDir(root, candidate, parent, slug)
+		if err == nil {
+			return resolved, nil
+		}
+		if !errors.Is(err, os.ErrNotExist) {
+			return "", err
+		}
+	}
+	return "", os.ErrNotExist
+}
+
+// ArchiveDirChecked resolves (or safely prepares) the canonical archive
+// directory. Existing symlinked archive components are rejected before a
+// close-out can move a workspace through them.
+func ArchiveDirChecked(root string) (string, error) {
+	return checkedCanonicalDir(root, filepath.Join(root, "archive"), "archive", "")
+}
+
+func checkedCanonicalDir(root, candidate, parent, slug string) (string, error) {
+	resolvedRoot, err := safepath.ResolveExisting(root)
+	if err != nil {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DevRites root %q: %w", root, err)
+	}
+	info, err := os.Lstat(candidate)
+	if err != nil {
+		if !os.IsNotExist(err) || parent != "archive" {
+			return "", err
+		}
+		resolved, resolveErr := safepath.ResolveExisting(candidate)
+		if resolveErr != nil {
+			return "", fmt.Errorf("DRV-ARCHIVE-INVALID: resolve archive %q: %w", candidate, resolveErr)
+		}
+		if !safepath.WithinResolved(resolved, resolvedRoot) {
+			return "", fmt.Errorf("DRV-ARCHIVE-OUTSIDE-ROOT: archive %q escapes %q", candidate, root)
+		}
+		rel, relErr := filepath.Rel(resolvedRoot, resolved)
+		if relErr != nil || filepath.Clean(rel) != "archive" {
+			return "", fmt.Errorf("DRV-ARCHIVE-INVALID: archive %q is not the canonical archive directory", candidate)
+		}
+		return filepath.Clean(candidate), nil
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		return "", fmt.Errorf("DRV-WORKSPACE-SYMLINK: canonical directory %q must not be a symlink", candidate)
+	}
+	if !info.IsDir() {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: canonical directory %q is not a directory", candidate)
+	}
+	resolved, err := safepath.ResolveExisting(candidate)
+	if err != nil {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve canonical directory %q: %w", candidate, err)
+	}
+	if !safepath.WithinResolved(resolved, resolvedRoot) {
+		return "", fmt.Errorf("DRV-WORKSPACE-OUTSIDE-ROOT: canonical directory %q escapes %q", candidate, root)
+	}
+	want := parent
+	if slug != "" {
+		want = filepath.Join(parent, slug)
+	}
+	rel, err := filepath.Rel(resolvedRoot, resolved)
+	if err != nil || filepath.Clean(rel) != filepath.Clean(want) {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: canonical directory %q resolves to unexpected path %q", candidate, resolved)
+	}
+	return filepath.Clean(candidate), nil
+}
+
 // ActiveSlug reads and trims the active-feature pointer. A missing pointer file
 // is not an error; it yields the empty slug.
 func ActiveSlug(root string) (string, error) {

package/engine/internal/install/install.go

@@ -280,14 +280,20 @@ func newRunner(opts Options) (*runner, error) {
 		source = inferSourceDir()
 	}
 	if source != "" {
-		source, _ = filepath.Abs(source)
+		source, err = filepath.Abs(source)
+		if err != nil {
+			return nil, fmt.Errorf("resolve source %s: %w", opts.SourceDir, err)
+		}
 	}
 	payload := opts.PayloadDir
 	if payload == "" {
 		payload = inferPayloadDir(source)
 	}
 	if payload != "" {
-		payload, _ = filepath.Abs(payload)
+		payload, err = filepath.Abs(payload)
+		if err != nil {
+			return nil, fmt.Errorf("resolve payload %s: %w", opts.PayloadDir, err)
+		}
 	}
 	r := &runner{
 		opts:      opts,
@@ -304,7 +310,10 @@ func newRunner(opts Options) (*runner, error) {
 			return nil, fmt.Errorf("validate payload: %w", err)
 		}
 	}
-	r.prev = readManifest(filepath.Join(target, ManifestName))
+	r.prev, err = readManifest(filepath.Join(target, ManifestName))
+	if err != nil {
+		return nil, err
+	}
 	return r, nil
 }
 
@@ -737,13 +746,15 @@ func (r *runner) mergeMarkerFile(merge hostpack.MarkerMerge) error {
 	dest := filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))
 	if r.opts.DryRun {
 		verb := "create DevRites block"
-		if exists(dest) {
-			current, _ := os.ReadFile(dest)
+		current, readErr := os.ReadFile(dest)
+		if readErr == nil {
 			if bytes.Contains(current, []byte(merge.Begin)) {
 				verb = "refresh DevRites block"
 			} else {
 				verb = "append DevRites block"
 			}
+		} else if !errors.Is(readErr, fs.ErrNotExist) {
+			return fmt.Errorf("cannot read %s: %w", merge.TargetRel, readErr)
 		}
 		fmt.Fprintf(r.opts.Stdout, "  [merge] %s (%s)\n", merge.TargetRel, verb)
 	} else {
@@ -751,8 +762,11 @@ func (r *runner) mergeMarkerFile(merge hostpack.MarkerMerge) error {
 			return err
 		}
 		next := block
-		if current, err := os.ReadFile(dest); err == nil {
+		current, readErr := os.ReadFile(dest)
+		if readErr == nil {
 			next = hostpack.MergeMarkerBlock(current, block, merge.Begin, merge.End)
+		} else if !errors.Is(readErr, fs.ErrNotExist) {
+			return fmt.Errorf("cannot read %s: %w", merge.TargetRel, readErr)
 		}
 		if err := fsutil.WriteFileAtomic(dest, next, 0o644); err != nil {
 			return fmt.Errorf("cannot write %s: %w", merge.TargetRel, err)
@@ -974,7 +988,10 @@ func (r *runner) flagsString() string {
 
 func (r *runner) uninstall() error {
 	mf := filepath.Join(r.target, ManifestName)
-	entries := readManifestList(mf)
+	entries, err := readManifestList(mf)
+	if err != nil {
+		return err
+	}
 	if len(entries) == 0 {
 		return fmt.Errorf("no DevRites manifest at %s - nothing to uninstall", mf)
 	}
@@ -1922,20 +1939,23 @@ func readEngineVersion(path string, timeout time.Duration) (string, error) {
 	return line, nil
 }
 
-func readManifest(path string) map[string]managedRecord {
-	records, _ := parseManifest(path)
-	return records
+func readManifest(path string) (map[string]managedRecord, error) {
+	records, _, err := parseManifest(path)
+	return records, err
 }
 
-func readManifestList(path string) []string {
-	_, entries := parseManifest(path)
-	return entries
+func readManifestList(path string) ([]string, error) {
+	_, entries, err := parseManifest(path)
+	return entries, err
 }
 
-func parseManifest(path string) (map[string]managedRecord, []string) {
+func parseManifest(path string) (map[string]managedRecord, []string, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
-		return map[string]managedRecord{}, nil
+		if errors.Is(err, fs.ErrNotExist) {
+			return map[string]managedRecord{}, nil, nil
+		}
+		return nil, nil, fmt.Errorf("read manifest %s: %w", path, err)
 	}
 	hashes := map[string]string{}
 	var out []string
@@ -1967,7 +1987,7 @@ func parseManifest(path string) (map[string]managedRecord, []string) {
 	for _, rel := range out {
 		records[rel] = managedRecord{Hash: hashes[rel]}
 	}
-	return records, out
+	return records, out, nil
 }
 
 func validManagedHash(hash string) bool {

package/engine/internal/install/install_test.go

@@ -18,6 +18,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/devrites/devrites/internal/hostpack"
 	"github.com/devrites/devrites/internal/testutil"
 )
 
@@ -188,6 +189,50 @@ func TestMarkerMergeAndUninstallPreserveUserContent(t *testing.T) {
 	}
 }
 
+func TestMarkerMergeDryRunReportsUnreadableTarget(t *testing.T) {
+	payload := t.TempDir()
+	if err := os.WriteFile(filepath.Join(payload, "block.md"), []byte("DevRites\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	target := t.TempDir()
+	if err := os.Mkdir(filepath.Join(target, "AGENTS.md"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	r := runner{
+		opts:      Options{DryRun: true, Stdout: &bytes.Buffer{}},
+		target:    target,
+		payloadFS: os.DirFS(payload),
+	}
+	err := r.mergeMarkerFile(hostpack.MarkerMerge{
+		TargetRel:  "AGENTS.md",
+		PayloadRel: "block.md",
+		Begin:      "<!-- BEGIN -->",
+		End:        "<!-- END -->",
+	})
+	if err == nil || !strings.Contains(err.Error(), "cannot read AGENTS.md") {
+		t.Fatalf("mergeMarkerFile error = %v, want target read error", err)
+	}
+}
+
+func TestUninstallReportsUnreadableManifest(t *testing.T) {
+	target := t.TempDir()
+	if err := os.Mkdir(filepath.Dir(filepath.Join(target, ManifestName)), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(filepath.Join(target, ManifestName), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	opts := DefaultOptions(ModeUninstall)
+	opts.Target = target
+	err := Apply(opts)
+	if err == nil || !strings.Contains(err.Error(), "read manifest") {
+		t.Fatalf("Apply error = %v, want manifest read error", err)
+	}
+	if info, statErr := os.Stat(filepath.Join(target, ManifestName)); statErr != nil || !info.IsDir() {
+		t.Fatalf("manifest was replaced: info=%v err=%v", info, statErr)
+	}
+}
+
 func TestInstallMergesClaudeHooksIntoExistingSettings(t *testing.T) {
 	t.Setenv("DEVRITES_NO_BINARY", "1")
 	payload := testPayload(t)
@@ -259,7 +304,11 @@ func TestInstallKeepsClaudeMergeOwnershipAcrossReinstall(t *testing.T) {
 	if !exists(filepath.Join(target, filepath.FromSlash(markerRel))) {
 		t.Fatal("first install did not create the Claude hook merge marker")
 	}
-	if _, ok := readManifest(filepath.Join(target, ManifestName))[markerRel]; !ok {
+	manifestRecords, err := readManifest(filepath.Join(target, ManifestName))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := manifestRecords[markerRel]; !ok {
 		t.Fatalf("first install did not record the Claude hook merge marker:\n%s", testutil.ReadFile(t, filepath.Join(target, ManifestName)))
 	}
 	runInstall(t, target, payload, func(o *Options) {})

package/engine/internal/iohooks/iohooks.go

@@ -690,9 +690,9 @@ func repoChangedSince(root, stamp string) bool {
 	}
 	stampTime := info.ModTime()
 	changed := false
-	_ = filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
+	if err := filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
 		if err != nil {
-			return nil
+			return err
 		}
 		if d.IsDir() {
 			if path != root && refreshExcludedDirs[d.Name()] {
@@ -705,7 +705,9 @@ func repoChangedSince(root, stamp string) bool {
 			return filepath.SkipAll
 		}
 		return nil
-	})
+	}); err != nil {
+		return true
+	}
 	return changed
 }
 

package/engine/internal/iohooks/iohooks_test.go

@@ -548,3 +548,14 @@ func TestRefreshStateAndChangeScan(t *testing.T) {
 		t.Fatalf("repoChangedSince=false after tracked file write, want true")
 	}
 }
+
+func TestRepoChangedSinceTreatsScanFailureAsChanged(t *testing.T) {
+	base := t.TempDir()
+	stamp := filepath.Join(base, "stamp")
+	if err := os.WriteFile(stamp, nil, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if !repoChangedSince(filepath.Join(base, "missing"), stamp) {
+		t.Fatal("repoChangedSince=false after repository scan failure, want conservative refresh")
+	}
+}

package/engine/internal/lib/adoption.go

@@ -414,7 +414,12 @@ func SecretScan(root string, args []string, stdout, stderr io.Writer) int {
 	for i := 0; i < len(args); i++ {
 		switch args[i] {
 		case "--staged":
-			paths = append(paths, gitStagedNames(project)...)
+			staged, err := gitStagedNames(project)
+			if err != nil {
+				fmt.Fprintf(stderr, "secret-scan: cannot inspect staged paths: %v\n", err)
+				return 2
+			}
+			paths = append(paths, staged...)
 		case "--text":
 			i++
 			if i < len(args) {
@@ -433,7 +438,12 @@ func SecretScan(root string, args []string, stdout, stderr io.Writer) int {
 		paths = append(paths, touchedFiles(root, slug)...)
 	}
 	if len(paths) == 0 {
-		paths = append(paths, gitDiffNames(project)...)
+		changed, err := gitDiffNames(project)
+		if err != nil {
+			fmt.Fprintf(stderr, "secret-scan: cannot inspect changed paths: %v\n", err)
+			return 2
+		}
+		paths = append(paths, changed...)
 	}
 	findings := []secretFinding{}
 	seen := map[string]bool{}
@@ -484,12 +494,12 @@ func scanSecrets(path, text string) []secretFinding {
 	return out
 }
 
-func gitStagedNames(project string) []string {
-	out, err := boundedCommandOutput(15*time.Second, "", "git", "-C", project, "diff", "--cached", "--name-only")
+func gitStagedNames(project string) ([]string, error) {
+	out, err := runGitCommand(project, nil, "diff", "--cached", "--name-only")
 	if err != nil {
-		return nil
+		return nil, err
 	}
-	return splitLinesNoTrailing(out)
+	return splitLinesNoTrailing(out), nil
 }
 
 func touchedFiles(root, slug string) []string {
@@ -515,7 +525,12 @@ func DocsStale(root string, args []string, stdout, stderr io.Writer) int {
 	slug := slugOrActive(root, args)
 	changed := touchedFiles(root, slug)
 	if len(changed) == 0 {
-		changed = gitDiffNames(project)
+		var err error
+		changed, err = gitDiffNames(project)
+		if err != nil {
+			fmt.Fprintf(stderr, "docs-stale: cannot inspect changed paths: %v\n", err)
+			return 2
+		}
 	}
 	docsTouched, surfaceTouched := false, []string{}
 	for _, p := range changed {
@@ -569,8 +584,11 @@ func SpecDedupe(root string, args []string, stdout, stderr io.Writer) int {
 	}
 	var hits []hit
 	for _, base := range targets {
-		_ = filepath.WalkDir(base, func(p string, d os.DirEntry, err error) error {
-			if err != nil || d.IsDir() || !strings.HasSuffix(strings.ToLower(p), ".md") {
+		err := filepath.WalkDir(base, func(p string, d os.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if d.IsDir() || !strings.HasSuffix(strings.ToLower(p), ".md") {
 				return nil
 			}
 			lowName := strings.ToLower(filepath.Base(p))
@@ -579,7 +597,7 @@ func SpecDedupe(root string, args []string, stdout, stderr io.Writer) int {
 			}
 			b, err := os.ReadFile(p) // #nosec G122 -- scoring walk over the project's own .scratch tree; a symlink race requires an attacker already writing to the checkout
 			if err != nil {
-				return nil
+				return err
 			}
 			text := strings.ToLower(string(b))
 			score := 0
@@ -589,11 +607,18 @@ func SpecDedupe(root string, args []string, stdout, stderr io.Writer) int {
 				}
 			}
 			if score >= 2 || score == len(terms) {
-				rel, _ := filepath.Rel(project, p)
+				rel, err := filepath.Rel(project, p)
+				if err != nil {
+					return err
+				}
 				hits = append(hits, hit{score: score, path: filepath.ToSlash(rel), line: firstLine(string(b))})
 			}
 			return nil
 		})
+		if err != nil && !os.IsNotExist(err) {
+			fmt.Fprintf(stderr, "spec-dedupe: search %s: %v\n", base, err)
+			return 1
+		}
 	}
 	sort.Slice(hits, func(i, j int) bool {
 		if hits[i].score == hits[j].score {

package/engine/internal/lib/adoption_test.go

@@ -53,6 +53,36 @@ func TestSecretScanBlocksHighSeverityTouchedFile(t *testing.T) {
 	}
 }
 
+func TestSecretScanFailsClosedWhenGitIsUnavailable(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	t.Chdir(project)
+	t.Setenv("PATH", t.TempDir())
+
+	var out, err bytes.Buffer
+	if code := SecretScan(root, nil, &out, &err); code != 2 {
+		t.Fatalf("want rc=2 got %d stdout=%s stderr=%s", code, out.String(), err.String())
+	}
+	if !strings.Contains(err.String(), "cannot inspect changed paths") {
+		t.Fatalf("missing fail-closed diagnostic: %s", err.String())
+	}
+}
+
+func TestDocsStaleFailsClosedWhenGitIsUnavailable(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	t.Chdir(project)
+	t.Setenv("PATH", t.TempDir())
+
+	var out, err bytes.Buffer
+	if code := DocsStale(root, nil, &out, &err); code != 2 {
+		t.Fatalf("want rc=2 got %d stdout=%s stderr=%s", code, out.String(), err.String())
+	}
+	if !strings.Contains(err.String(), "cannot inspect changed paths") {
+		t.Fatalf("missing fail-closed diagnostic: %s", err.String())
+	}
+}
+
 func TestSpecDedupeSearchesScratchPRDs(t *testing.T) {
 	project := t.TempDir()
 	root := filepath.Join(project, ".devrites")

package/engine/internal/lib/analyze.go

@@ -53,8 +53,16 @@ func Analyze(root string, args []string, stdout, stderr io.Writer) int {
 		return 2
 	}
 
-	specData, _ := os.ReadFile(spec)
-	tasksData, _ := os.ReadFile(tasks)
+	specData, err := os.ReadFile(spec)
+	if err != nil {
+		fmt.Fprintf(stderr, "analyze: read spec.md: %v\n", err)
+		return 2
+	}
+	tasksData, err := os.ReadFile(tasks)
+	if err != nil {
+		fmt.Fprintf(stderr, "analyze: read tasks.md: %v\n", err)
+		return 2
+	}
 
 	specACs := sortedACIDs(acIDRe, specData, true) // legacy brackets stripped: "[AC1]" -> "AC1"
 	taskACs := sortedACIDs(taskACRe, tasksData, false)

package/engine/internal/lib/archivesearch.go

@@ -1,8 +1,10 @@
 package lib
 
 import (
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"sort"
@@ -11,11 +13,11 @@ import (
 
 // ArchiveSearch surfaces shipped features whose spec.md overlaps a query, so
 // /rite-spec can spot prior art before writing a new spec: an extension, a
-// conflict, or a re-spec of solved work. It is advisory, not a gate: it always
-// exits 0 when it runs (empty output means no overlap), and reserves exit 2 for
-// a missing query. The query is the feature's key nouns, one or many args; a
-// quoted phrase is split on whitespace. Ranking is by the count of distinct query
-// terms a spec contains, highest first, ties broken by slug.
+// conflict, or a re-spec of solved work. It is advisory, not a gate: empty
+// output means no overlap. Exit 2 means a missing query; exit 3 means the
+// archive could not be read. The query is the feature's key nouns, one or many
+// args; a quoted phrase is split on whitespace. Ranking is by the count of
+// distinct query terms a spec contains, highest first, ties broken by slug.
 //
 // args is `<term>...`. Terms shorter than three characters are dropped as noise.
 func ArchiveSearch(root string, args []string, stdout, stderr io.Writer) int {
@@ -34,10 +36,24 @@ func ArchiveSearch(root string, args []string, stdout, stderr io.Writer) int {
 		return 2 // usage
 	}
 
-	entries, err := os.ReadDir(filepath.Join(root, "archive"))
+	archive := filepath.Join(root, "archive")
+	info, err := os.Stat(archive)
 	if err != nil {
-		// No archive yet: no prior art to surface. Silent, successful no-op.
-		return 0
+		if errors.Is(err, fs.ErrNotExist) {
+			// No archive yet: no prior art to surface. Silent, successful no-op.
+			return 0
+		}
+		fmt.Fprintf(stderr, "archive-search: read archive: %v\n", err)
+		return 3
+	}
+	if !info.IsDir() {
+		fmt.Fprintf(stderr, "archive-search: read archive: %s is not a directory\n", archive)
+		return 3
+	}
+	entries, err := os.ReadDir(archive)
+	if err != nil {
+		fmt.Fprintf(stderr, "archive-search: read archive: %v\n", err)
+		return 3
 	}
 
 	type hit struct {
@@ -51,9 +67,25 @@ func ArchiveSearch(root string, args []string, stdout, stderr io.Writer) int {
 			continue
 		}
 		spec := filepath.Join(root, "archive", e.Name(), "spec.md")
+		info, err := os.Stat(spec)
+		if err != nil {
+			if errors.Is(err, fs.ErrNotExist) {
+				continue
+			}
+			fmt.Fprintf(stderr, "archive-search: read %s: %v\n", spec, err)
+			return 3
+		}
+		if !info.Mode().IsRegular() {
+			fmt.Fprintf(stderr, "archive-search: read %s: not a regular file\n", spec)
+			return 3
+		}
 		b, err := os.ReadFile(spec)
 		if err != nil {
-			continue
+			if errors.Is(err, fs.ErrNotExist) {
+				continue
+			}
+			fmt.Fprintf(stderr, "archive-search: read %s: %v\n", spec, err)
+			return 3
 		}
 		body := strings.ToLower(string(b))
 		n := 0

package/engine/internal/lib/archivesearch_test.go

@@ -98,6 +98,34 @@ func TestArchiveSearchNoArchive(t *testing.T) {
 	}
 }
 
+func TestArchiveSearchReportsUnreadableArchive(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "archive"), []byte("not a directory"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	if code := ArchiveSearch(root, []string{"anything"}, stdout, stderr); code != 3 {
+		t.Fatalf("code=%d, want 3; stderr=%q", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "read archive") {
+		t.Fatalf("stderr=%q, want archive read error", stderr.String())
+	}
+}
+
+func TestArchiveSearchReportsUnreadableSpec(t *testing.T) {
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "archive", "broken", "spec.md"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	if code := ArchiveSearch(root, []string{"anything"}, stdout, stderr); code != 3 {
+		t.Fatalf("code=%d, want 3; stderr=%q", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "archive-search: read") {
+		t.Fatalf("stderr=%q, want spec read error", stderr.String())
+	}
+}
+
 func writeArchiveSpec(t *testing.T, root, slug, content string) {
 	t.Helper()
 	dir := filepath.Join(root, "archive", slug)

package/engine/internal/lib/buildreadiness.go

@@ -32,7 +32,11 @@ func BuildReadiness(root string, args []string, stdout, stderr io.Writer) int {
 		return readinessCode("workspace-missing")
 	}
 
-	data, _ := os.ReadFile(s)
+	data, err := os.ReadFile(s)
+	if err != nil {
+		fmt.Fprintf(stderr, "readiness: cannot read state.md: %v\n", err)
+		return readinessCode("workspace-missing")
+	}
 	lines := splitLinesNoTrailing(data)
 
 	status := readinessField(lines, "Status")