devrites 3.2.23 → 3.2.25

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.25](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.24...v3.2.25) (2026-07-28)
+
+### Fixed
+
+* **devrites:** close review safety gaps ([178a43e](https://github.com/ViktorsBaikers/DevRites/commit/178a43e5a25a7b0825c0e16aa76c402e6b48a3aa))
+
+## [3.2.24](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.23...v3.2.24) (2026-07-28)
+
+### Fixed
+
+* **devrites:** close review safety gaps ([33e736a](https://github.com/ViktorsBaikers/DevRites/commit/33e736a3d9d69fd166827235ed1ce2310aeca75a))
+
 ## [3.2.23](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.22...v3.2.23) (2026-07-28)
 
 ### Fixed

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.23`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.23): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.25`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.25): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/engine/hooks.go

@@ -389,18 +389,37 @@ func safeReadonlyShellSegment(segment string) bool {
 	base := strings.ToLower(filepath.Base(strings.Trim(fields[0], `"'`)))
 	args := fields[1:]
 	switch base {
-	case "true", "false", "pwd", "ls", "cat", "head", "tail", "less", "more",
-		"grep", "rg", "wc", "sort", "uniq", "cut", "tr", "stat", "file",
-		"readlink", "realpath", "basename", "dirname", "cmp", "diff", "jq", "yq",
-		"tree", "du", "df", "printenv", "which", "date", "uname", "id", "whoami",
+	case "true", "false", "pwd", "ls", "cat", "head", "tail", "more",
+		"grep", "wc", "uniq", "cut", "tr", "stat", "file",
+		"readlink", "realpath", "basename", "dirname", "cmp", "jq",
+		"du", "df", "printenv", "which", "date", "uname", "id", "whoami",
 		"ps", "echo", "printf", "test", "[", "cd", "sha256sum", "shasum":
 		return true
+	case "less":
+		return !hasShellOption(args, "oO", "--log-file")
+	case "rg":
+		return !hasShellOption(args, "", "--pre", "--hostname-bin")
+	case "sort":
+		return !hasShellOption(args, "o", "--output", "--compress-program")
+	case "diff":
+		return !hasShellOption(args, "", "--output")
+	case "yq":
+		return !hasShellOption(args, "i", "--inplace", "--in-place")
+	case "tree":
+		return !hasShellOption(args, "o", "--output")
 	case "find":
-		return !hasAnyArg(args, "-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprintf")
+		return !hasArgPrefix(args, "-delete") &&
+			!hasArgPrefix(args, "-exec") &&
+			!hasArgPrefix(args, "-ok") &&
+			!hasArgPrefix(args, "-fprint") &&
+			!hasArgPrefix(args, "-fprintf") &&
+			!hasArgPrefix(args, "-fls")
 	case "sed":
-		return !hasArgPrefix(args, "-i")
+		return !hasShellOption(args, "i", "--in-place", "--inplace")
 	case "git":
-		return len(args) > 0 && hasAnyArg(args[:1], "diff", "status", "show", "log", "rev-parse", "ls-files", "grep", "blame")
+		return len(args) > 0 &&
+			hasAnyArg(args[:1], "diff", "status", "show", "log", "rev-parse", "ls-files", "grep", "blame") &&
+			!hasShellOption(args[1:], "", "--output", "--ext-diff", "--textconv", "--open-files-in-pager")
 	case "go":
 		if len(args) == 0 || !hasAnyArg(args[:1], "test", "vet", "list", "version", "env") {
 			return false
@@ -453,6 +472,7 @@ func safePackageProof(args []string) bool {
 
 func hasAnyArg(args []string, wants ...string) bool {
 	for _, arg := range args {
+		arg = strings.Trim(arg, `"'`)
 		for _, want := range wants {
 			if arg == want {
 				return true
@@ -464,6 +484,7 @@ func hasAnyArg(args []string, wants ...string) bool {
 
 func hasArgPrefix(args []string, prefix string) bool {
 	for _, arg := range args {
+		arg = strings.Trim(arg, `"'`)
 		if strings.HasPrefix(arg, prefix) {
 			return true
 		}
@@ -471,6 +492,27 @@ func hasArgPrefix(args []string, prefix string) bool {
 	return false
 }
 
+func hasShellOption(args []string, shortOptions string, longOptions ...string) bool {
+	for _, arg := range args {
+		arg = strings.Trim(arg, `"'`)
+		if arg == "--" {
+			return false
+		}
+		if strings.HasPrefix(arg, "--") {
+			for _, option := range longOptions {
+				if arg == option || strings.HasPrefix(arg, option+"=") {
+					return true
+				}
+			}
+			continue
+		}
+		if strings.HasPrefix(arg, "-") && strings.ContainsAny(strings.TrimPrefix(arg, "-"), shortOptions) {
+			return true
+		}
+	}
+	return false
+}
+
 // hookReviewerReadonly keeps every DevRites leaf except slice-wright read only.
 // It always enforces declared DevRites runs. Undeclared runs keep the legacy
 // observe mode.

package/engine/internal/lib/reconcile.go

@@ -327,12 +327,12 @@ func Reconcile(root string, args []string, stdout, stderr io.Writer) int {
 		if pendingReceipt != "" {
 			defer func() { _ = os.Remove(pendingReceipt) }()
 		}
-		if err := closeWindow(); err != nil {
-			fmt.Fprintf(stderr, "reconcile: source baseline restored, but cannot close rejected slice window: %v\n", err)
+		if err := commitContentAddressedReceipt(receiptPath, pendingReceipt, receiptData); err != nil {
+			fmt.Fprintf(stderr, "reconcile: source baseline restored, but cannot persist abort receipt; retained window left open: %v\n", err)
 			return 6
 		}
-		if err := commitContentAddressedReceipt(receiptPath, pendingReceipt, receiptData); err != nil {
-			fmt.Fprintf(stderr, "reconcile: source baseline restored and window closed, but cannot persist abort receipt: %v\n", err)
+		if err := closeWindow(); err != nil {
+			fmt.Fprintf(stderr, "reconcile: source baseline restored and receipt persisted, but cannot close rejected slice window: %v\n", err)
 			return 6
 		}
 		fmt.Fprintf(stdout, "reconcile: aborted rejected slice window for %s; restored %d source path(s); receipt %s.\n", slug, len(changed), receiptName)
@@ -962,25 +962,17 @@ func restoreTreePaths(gitRoot string, env []string, targetTree string, changed [
 		return fmt.Errorf("create restore directory: %w", err)
 	}
 	defer func() { _ = os.RemoveAll(materialized) }()
-	index := filepath.Join(materialized, "index")
-	restoreEnv := append(append([]string{}, env...), "GIT_INDEX_FILE="+index)
-	if _, err := reconcileGitOutput(gitRoot, restoreEnv, "read-tree", targetTree); err != nil {
-		return err
-	}
 	materializedTree := filepath.Join(materialized, "tree")
 	if err := os.MkdirAll(materializedTree, 0o700); err != nil {
 		return fmt.Errorf("create restore tree: %w", err)
 	}
-	gitPrefix := filepath.ToSlash(materializedTree) + "/"
-	if _, err := reconcileGitOutput(
-		gitRoot,
-		restoreEnv,
-		"-c", "core.autocrlf=false",
-		"checkout-index", "--all", "--force", "--prefix="+gitPrefix,
-	); err != nil {
-		return err
-	}
 
+	type restoreEntry struct {
+		path, target, parent, source string
+		mode                         os.FileMode
+		symlink, exists              bool
+	}
+	entries := make([]restoreEntry, 0, len(changed))
 	for _, changedPath := range changed {
 		if changedPath == "." || changedPath == ".devrites" ||
 			strings.HasPrefix(changedPath, reconcileDevritesPathPrefix) ||
@@ -992,39 +984,111 @@ func restoreTreePaths(gitRoot string, env []string, targetTree string, changed [
 		if !safepath.WithinResolved(targetParent, gitRoot) {
 			return fmt.Errorf("restore parent escapes repository through a symlink: %s", changedPath)
 		}
-		source := filepath.Join(materializedTree, filepath.FromSlash(changedPath))
-		sourceInfo, sourceErr := os.Lstat(source)
-		if sourceErr != nil && !os.IsNotExist(sourceErr) {
-			return fmt.Errorf("inspect clean source %s: %w", changedPath, sourceErr)
+		if targetInfo, targetErr := os.Lstat(target); targetErr == nil {
+			if targetInfo.IsDir() {
+				return fmt.Errorf("refusing to remove live directory at restore path %s", changedPath)
+			}
+		} else if !os.IsNotExist(targetErr) {
+			return fmt.Errorf("inspect restore target %s: %w", changedPath, targetErr)
 		}
-		if err := os.RemoveAll(target); err != nil {
-			return fmt.Errorf("remove source path %s: %w", changedPath, err)
+
+		treeEntry, err := reconcileGitOutput(
+			gitRoot, env, "ls-tree", "-z", targetTree, "--", ":(top,literal)"+changedPath,
+		)
+		if err != nil {
+			return err
 		}
-		if os.IsNotExist(sourceErr) {
+		if len(treeEntry) == 0 {
+			entries = append(entries, restoreEntry{path: changedPath, target: target, parent: targetParent})
 			continue
 		}
-		if err := os.MkdirAll(targetParent, 0o755); err != nil {
-			return fmt.Errorf("create restore parent for %s: %w", changedPath, err)
+		record := strings.TrimSuffix(string(treeEntry), "\x00")
+		if strings.Contains(record, "\x00") {
+			return fmt.Errorf("ambiguous tree entry for %s", changedPath)
+		}
+		header, entryPath, ok := strings.Cut(record, "\t")
+		fields := strings.Fields(header)
+		if !ok || len(fields) != 3 || entryPath != changedPath {
+			return fmt.Errorf("invalid tree entry for %s", changedPath)
+		}
+		if fields[0] == "160000" || fields[1] == "commit" {
+			return fmt.Errorf("cannot safely restore changed submodule worktree %s", changedPath)
+		}
+		entry := restoreEntry{
+			path:    changedPath,
+			target:  target,
+			parent:  targetParent,
+			source:  filepath.Join(materializedTree, filepath.FromSlash(changedPath)),
+			exists:  true,
+			symlink: fields[0] == "120000",
+		}
+		switch fields[0] {
+		case "100644":
+			entry.mode = 0o644
+		case "100755":
+			entry.mode = 0o755
+		case "120000":
+		default:
+			return fmt.Errorf("unsupported tree mode %s for %s", fields[0], changedPath)
 		}
-		switch {
-		case sourceInfo.Mode()&os.ModeSymlink != 0:
-			link, err := os.Readlink(source)
-			if err != nil {
-				return fmt.Errorf("read clean symlink %s: %w", changedPath, err)
-			}
-			if err := os.Symlink(link, target); err != nil {
-				return fmt.Errorf("restore symlink %s: %w", changedPath, err)
-			}
-		case sourceInfo.Mode().IsRegular():
-			data, err := os.ReadFile(source)
+		if err := os.MkdirAll(filepath.Dir(entry.source), 0o700); err != nil {
+			return fmt.Errorf("create materialized parent for %s: %w", changedPath, err)
+		}
+		source, err := os.OpenFile(entry.source, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+		if err != nil {
+			return fmt.Errorf("create materialized source %s: %w", changedPath, err)
+		}
+		writeErr := runGitCommandToWriter(gitRoot, env, source, "cat-file", "blob", fields[2])
+		closeErr := source.Close()
+		if writeErr != nil {
+			return fmt.Errorf("materialize source %s: %w", changedPath, writeErr)
+		}
+		if closeErr != nil {
+			return fmt.Errorf("close materialized source %s: %w", changedPath, closeErr)
+		}
+		entries = append(entries, entry)
+	}
+
+	for _, entry := range entries {
+		if err := os.RemoveAll(entry.target); err != nil {
+			return fmt.Errorf("remove source path %s: %w", entry.path, err)
+		}
+		if !entry.exists {
+			continue
+		}
+		if err := os.MkdirAll(entry.parent, 0o755); err != nil {
+			return fmt.Errorf("create restore parent for %s: %w", entry.path, err)
+		}
+		if entry.symlink {
+			link, err := os.ReadFile(entry.source)
 			if err != nil {
-				return fmt.Errorf("read clean file %s: %w", changedPath, err)
+				return fmt.Errorf("read clean symlink %s: %w", entry.path, err)
 			}
-			if err := os.WriteFile(target, data, sourceInfo.Mode().Perm()); err != nil {
-				return fmt.Errorf("restore file %s: %w", changedPath, err)
+			if err := os.Symlink(string(link), entry.target); err != nil {
+				return fmt.Errorf("restore symlink %s: %w", entry.path, err)
 			}
-		default:
-			return fmt.Errorf("unsupported clean tree entry for %s: %s", changedPath, sourceInfo.Mode())
+			continue
+		}
+		source, err := os.Open(entry.source)
+		if err != nil {
+			return fmt.Errorf("open clean file %s: %w", entry.path, err)
+		}
+		target, err := os.OpenFile(entry.target, os.O_WRONLY|os.O_CREATE|os.O_EXCL, entry.mode)
+		if err != nil {
+			_ = source.Close()
+			return fmt.Errorf("create restored file %s: %w", entry.path, err)
+		}
+		_, copyErr := io.Copy(target, source)
+		sourceCloseErr := source.Close()
+		targetCloseErr := target.Close()
+		if copyErr != nil {
+			return fmt.Errorf("restore file %s: %w", entry.path, copyErr)
+		}
+		if sourceCloseErr != nil {
+			return fmt.Errorf("close clean file %s: %w", entry.path, sourceCloseErr)
+		}
+		if targetCloseErr != nil {
+			return fmt.Errorf("close restored file %s: %w", entry.path, targetCloseErr)
 		}
 	}
 	return nil
@@ -1193,6 +1257,9 @@ func worktreeTree(gitRoot, objectDir string, excludedRoots ...string) (string, e
 			return "", fmt.Errorf("exclude %s from worktree snapshot: %w", rel, err)
 		}
 	}
+	if err := rewriteIndexWithRawWorktreeBytes(gitRoot, env); err != nil {
+		return "", err
+	}
 
 	out, err := runGitCommand(gitRoot, env, "write-tree")
 	if err != nil {
@@ -1205,6 +1272,83 @@ func worktreeTree(gitRoot, objectDir string, excludedRoots ...string) (string, e
 	return tree, nil
 }
 
+func rewriteIndexWithRawWorktreeBytes(gitRoot string, env []string) error {
+	out, err := runGitCommand(gitRoot, env, "ls-files", "--stage", "-z")
+	if err != nil {
+		return fmt.Errorf("list worktree snapshot entries: %w", err)
+	}
+	type rawEntry struct {
+		mode, path string
+	}
+	var batch, individual []rawEntry
+	for _, record := range strings.Split(string(out), "\x00") {
+		if record == "" {
+			continue
+		}
+		header, filename, ok := strings.Cut(record, "\t")
+		fields := strings.Fields(header)
+		if !ok || len(fields) != 3 || fields[2] != "0" {
+			return fmt.Errorf("invalid worktree snapshot index entry")
+		}
+		if fields[0] != "100644" && fields[0] != "100755" {
+			continue
+		}
+		entry := rawEntry{mode: fields[0], path: filename}
+		if strings.ContainsRune(filename, '\n') {
+			individual = append(individual, entry)
+		} else {
+			batch = append(batch, entry)
+		}
+	}
+
+	var indexInfo strings.Builder
+	if len(batch) > 0 {
+		var paths strings.Builder
+		for _, entry := range batch {
+			paths.WriteString(entry.path)
+			paths.WriteByte('\n')
+		}
+		hashes, err := runGitCommandInput(
+			gitRoot, env, []byte(paths.String()),
+			"hash-object", "-w", "--no-filters", "--stdin-paths",
+		)
+		if err != nil {
+			return fmt.Errorf("hash raw worktree files: %w", err)
+		}
+		objectIDs := strings.Fields(string(hashes))
+		if len(objectIDs) != len(batch) {
+			return fmt.Errorf("hash raw worktree files: got %d object ids for %d paths", len(objectIDs), len(batch))
+		}
+		for i, entry := range batch {
+			if !reconcileObjectID.MatchString(objectIDs[i]) {
+				return fmt.Errorf("hash raw worktree file %s: invalid object id", entry.path)
+			}
+			fmt.Fprintf(&indexInfo, "%s %s\t%s\x00", entry.mode, objectIDs[i], entry.path)
+		}
+	}
+	for _, entry := range individual {
+		hash, err := runGitCommand(gitRoot, env, "hash-object", "-w", "--no-filters", "--", entry.path)
+		if err != nil {
+			return fmt.Errorf("hash raw worktree file %s: %w", entry.path, err)
+		}
+		objectID := strings.TrimSpace(string(hash))
+		if !reconcileObjectID.MatchString(objectID) {
+			return fmt.Errorf("hash raw worktree file %s: invalid object id", entry.path)
+		}
+		fmt.Fprintf(&indexInfo, "%s %s\t%s\x00", entry.mode, objectID, entry.path)
+	}
+	if indexInfo.Len() == 0 {
+		return nil
+	}
+	if _, err := runGitCommandInput(
+		gitRoot, env, []byte(indexInfo.String()),
+		"update-index", "-z", "--index-info",
+	); err != nil {
+		return fmt.Errorf("record raw worktree files: %w", err)
+	}
+	return nil
+}
+
 func reconcileGitEnv(gitRoot, objectDir string) ([]string, error) {
 	out, err := runGitCommand(gitRoot, nil, "rev-parse", "--git-common-dir")
 	if err != nil {

package/engine/internal/lib/reconcile_test.go

@@ -392,6 +392,80 @@ func TestReconcileAbortRestoresOriginalSourceAndClosesWindow(t *testing.T) {
 	}
 }
 
+func TestReconcileAbortRestoresOriginalCRLFBytes(t *testing.T) {
+	gitRoot := newGitRepo(t)
+	root := workspace(t, "feat")
+	writeWrightAllowlist(t, root, "feat", "seed.go")
+	if out, err := exec.Command("git", "-C", gitRoot, "config", "core.autocrlf", "true").CombinedOutput(); err != nil {
+		t.Fatalf("configure core.autocrlf: %v\n%s", err, out)
+	}
+	baseline := []byte("package main\r\n\r\nfunc userWork() {}\r\n")
+	if err := os.WriteFile(filepath.Join(gitRoot, "seed.go"), baseline, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+	writeFile(t, filepath.Join(gitRoot, "seed.go"), "package main\n\nfunc rejectedWriterChange() {}\n")
+
+	if code, out := runReconcile(t, root, "abort", "feat"); code != 0 {
+		t.Fatalf("abort = %d, want 0\n%s", code, out)
+	}
+	restored, err := os.ReadFile(filepath.Join(gitRoot, "seed.go"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(restored, baseline) {
+		t.Fatalf("restored bytes = %q, want original bytes %q", restored, baseline)
+	}
+}
+
+func TestReconcileAbortPreservesChangedSubmoduleWorktree(t *testing.T) {
+	submoduleOrigin := newGitRepo(t)
+	gitRoot := newGitRepo(t)
+	git := func(dir string, args ...string) string {
+		t.Helper()
+		cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatalf("git %v: %v\n%s", args, err, out)
+		}
+		return strings.TrimSpace(string(out))
+	}
+	git(gitRoot, "-c", "protocol.file.allow=always", "submodule", "add", "-q", submoduleOrigin, "sub")
+	commitAll(t, gitRoot, "add submodule")
+
+	root := workspace(t, "feat")
+	writeWrightAllowlist(t, root, "feat")
+	if code, out := runReconcile(t, root, "snapshot", "feat"); code != 0 {
+		t.Fatalf("snapshot = %d, want 0\n%s", code, out)
+	}
+
+	writeFile(t, filepath.Join(submoduleOrigin, "seed.go"), "package changed\n")
+	commitAll(t, submoduleOrigin, "advance submodule")
+	advanced := git(submoduleOrigin, "rev-parse", "HEAD")
+	git(filepath.Join(gitRoot, "sub"), "-c", "protocol.file.allow=always", "fetch", "-q", "origin")
+	git(filepath.Join(gitRoot, "sub"), "checkout", "-q", advanced)
+	local := []byte("uncommitted submodule work\n")
+	if err := os.WriteFile(filepath.Join(gitRoot, "sub", "local.txt"), local, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	code, out := runReconcile(t, root, "abort", "feat")
+	if code != 6 {
+		t.Fatalf("abort = %d, want fail-closed 6 for a changed submodule\n%s", code, out)
+	}
+	if restored, err := os.ReadFile(filepath.Join(gitRoot, "sub", "local.txt")); err != nil {
+		t.Fatalf("abort removed the live submodule worktree: %v\n%s", err, out)
+	} else if !bytes.Equal(restored, local) {
+		t.Fatalf("abort changed uncommitted submodule bytes: %q", restored)
+	}
+	if !isFile(filepath.Join(featureDir(root, "feat"), reconcileBaseName)) {
+		t.Fatal("failed abort removed its retained baseline marker")
+	}
+}
+
 func TestReconcileAbortFailsClosedWhenObjectDatabaseIsMissing(t *testing.T) {
 	gitRoot := newGitRepo(t)
 	root := workspace(t, "feat")

package/engine/internal/lib/util.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -57,11 +58,27 @@ func (e *gitCommandError) Error() string {
 func (e *gitCommandError) Unwrap() error { return e.err }
 
 func runGitCommand(dir string, env []string, args ...string) ([]byte, error) {
+	return runGitCommandIO(dir, env, nil, nil, args...)
+}
+
+func runGitCommandInput(dir string, env []string, input []byte, args ...string) ([]byte, error) {
+	return runGitCommandIO(dir, env, input, nil, args...)
+}
+
+func runGitCommandToWriter(dir string, env []string, stdout io.Writer, args ...string) error {
+	_, err := runGitCommandIO(dir, env, nil, stdout, args...)
+	return err
+}
+
+func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, args ...string) ([]byte, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), gitCommandTimeout)
 	defer cancel()
 	commandArgs := append([]string{"-C", dir}, args...)
 	cmd := exec.CommandContext(ctx, "git", commandArgs...)
 	cmd.WaitDelay = 2 * time.Second
+	if input != nil {
+		cmd.Stdin = bytes.NewReader(input)
+	}
 	if env == nil {
 		env = os.Environ()
 	} else {
@@ -76,7 +93,11 @@ func runGitCommand(dir string, env []string, args ...string) ([]byte, error) {
 		"LC_ALL=C",
 	)
 	var output cappedGitOutput
-	cmd.Stdout = &output
+	if stdout == nil {
+		cmd.Stdout = &output
+	} else {
+		cmd.Stdout = stdout
+	}
 	cmd.Stderr = &output
 	err := cmd.Run()
 	if err == nil {

package/engine/tests/hook_test.go

@@ -293,6 +293,33 @@ func TestHookReviewerReadonlyAllowsSafeBash(t *testing.T) {
 	}
 }
 
+func TestHookReviewerReadonlyRejectsWriteCapableInspectionFlags(t *testing.T) {
+	root := newWorkspace(t)
+	env := []string{
+		"DEVRITES_AGENT_RUN=1",
+		"DEVRITES_ACTIVE_AGENT=devrites-code-reviewer",
+	}
+	for _, command := range []string{
+		"sed --in-place=.bak s/a/b/ src/app.go",
+		"sort -o src/app.go input.txt",
+		"find . -fls src/index.txt",
+		"git diff --output=src/diff.txt",
+	} {
+		in := hookPayload(t, map[string]any{
+			"tool_name":  "Bash",
+			"tool_input": map[string]any{"command": command},
+		})
+		out, errOut, code := runDevritesIO(t, root, in, env,
+			"hook", "reviewer-readonly", "--harness=codex")
+		if code != 0 {
+			t.Fatalf("%q exit=%d stderr=%q", command, code, errOut)
+		}
+		if decision, _ := parsePermissionDecision(t, out); decision != "deny" {
+			t.Errorf("write-capable inspection command was not denied: %q", command)
+		}
+	}
+}
+
 func TestHookReviewerReadonlyNonBashIsSilent(t *testing.T) {
 	root := newWorkspace(t)
 	in := `{"tool_name":"Read","tool_input":{"file_path":"secret.txt"}}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.23",
+  "version": "3.2.25",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
@@ -32,10 +32,14 @@
     "engine/",
     "pack/",
     "scripts/",
+    "!scripts/__pycache__/",
+    "!scripts/*.pyc",
+    "!scripts/.cache/",
     "install.sh",
     "uninstall.sh",
     "update.sh",
     "docs/",
+    "!docs/internal/",
     "README.md",
     "LICENSE",
     "SECURITY.md",
@@ -47,7 +51,7 @@
   },
   "scripts": {
     "prepare": "husky || true",
-    "prepack": "bash scripts/build-host-artifacts.sh && rm -rf scripts/__pycache__ scripts/.cache docs/internal",
+    "prepack": "bash scripts/build-host-artifacts.sh",
     "commitlint": "commitlint --edit",
     "validate": "bash scripts/validate.sh",
     "test": "node scripts/run-tests.mjs",

package/scripts/build-host-artifacts.sh

@@ -4,7 +4,7 @@
 #
 # Default output is pack/generated/ so npm pack can ship prebuilt surfaces.
 # Tests may set DEVRITES_HOST_ARTIFACT_DIR to a temporary directory.
-set -u
+set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 PACK_SRC="$ROOT/pack/.claude"
@@ -13,7 +13,7 @@ OUT_ROOT="${DEVRITES_HOST_ARTIFACT_DIR:-$ROOT/pack/generated}"
 [ -d "$PACK_SRC/skills" ] || { echo "build-host-artifacts: missing $PACK_SRC/skills" >&2; exit 1; }
 [ -d "$PACK_SRC/agents" ] || { echo "build-host-artifacts: missing $PACK_SRC/agents" >&2; exit 1; }
 
-TMP_GEN_DIR="$(mktemp -d 2>/dev/null || echo "${TMPDIR:-/tmp}/devrites-host-artifacts.$$")"
+TMP_GEN_DIR="$(mktemp -d)"
 cleanup() { rm -rf "$TMP_GEN_DIR"; }
 trap cleanup EXIT
 

package/scripts/build-release-tarball.sh

@@ -57,14 +57,14 @@ PAYLOAD=(
 
 for item in "${PAYLOAD[@]}"; do
   if [[ -e "$item" ]]; then
-    if [[ "$item" == "engine" ]] && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
       while IFS= read -r -d '' path; do
-        [[ -e "$path" ]] || continue
+        [[ -e "$path" || -L "$path" ]] || continue
         if [[ "$path" == engine/testdata/golden/* ]]; then
           continue
         fi
         mkdir -p "$STAGE/$(dirname "$path")"
-        cp "$path" "$STAGE/$path"
+        cp -P "$path" "$STAGE/$path"
       done < <(git ls-files -z -- "$item")
     else
       cp -R "$item" "$STAGE/"
@@ -73,7 +73,7 @@ for item in "${PAYLOAD[@]}"; do
 done
 
 # Include the same prebuilt host artifacts as the npm package.
-DEVRITES_HOST_ARTIFACT_DIR="$STAGE/pack/generated" bash "$ROOT/scripts/build-host-artifacts.sh" >/dev/null
+DEVRITES_HOST_ARTIFACT_DIR="$STAGE/pack/generated" bash "$STAGE/scripts/build-host-artifacts.sh" >/dev/null
 
 # Remove development files copied with the payload.
 rm -rf "$STAGE/docs/internal" "$STAGE/scripts/.cache" 2>/dev/null || true

package/scripts/check-generated-skill-budget.mjs

@@ -2,8 +2,9 @@
 // Guard generated host skill payloads against accidental context bloat.
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const root = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
+const root = fileURLToPath(new URL('..', import.meta.url));
 const base = process.argv[2] || join(root, 'pack', '.claude', 'skills');
 const totalLimit = Number(process.env.DEVRITES_SKILL_TOTAL_BUDGET || 900_000);
 const fileLimit = Number(process.env.DEVRITES_SKILL_FILE_BUDGET || 64_000);

package/scripts/check-instruction-size-baseline.mjs

@@ -2,8 +2,9 @@
 // Track canonical instruction files individually and skills as a group.
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const defaultRoot = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
+const defaultRoot = fileURLToPath(new URL('..', import.meta.url));
 const argv = process.argv.slice(2);
 function option(name, fallback) {
   const i = argv.indexOf(name);

package/scripts/check-reference-governance.mjs

@@ -2,8 +2,9 @@
 // Ensure supporting skill references are reachable or explicitly time-bounded.
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { basename, dirname, join, normalize, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const defaultRoot = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
+const defaultRoot = fileURLToPath(new URL('..', import.meta.url));
 const argv = process.argv.slice(2);
 function option(name, fallback) {
   const i = argv.indexOf(name);

package/scripts/pin.sh

@@ -29,7 +29,7 @@
 #   - Manifest-managed: pinned wrappers are recorded in .claude/devrites.manifest
 #     so the standard uninstall.sh cleans them up automatically.
 
-set -u
+set -euo pipefail
 
 # ---- locate install-lib + load helpers ----------------------------------
 SELF_DIR="$( cd "$(dirname "$0")" && pwd -P )"
@@ -77,6 +77,16 @@ MF="$TARGET/$DR_MANIFEST_NAME"
 [ -f "$MF" ]         || dr_die "no manifest at $MF: run install.sh first?"
 
 # ---- helpers -------------------------------------------------------------
+PIN_TMP=""
+cleanup_pin_tmp() {
+  [ -z "$PIN_TMP" ] || rm -rf "$PIN_TMP"
+}
+trap cleanup_pin_tmp EXIT
+
+path_exists() {
+  [ -e "$1" ] || [ -L "$1" ]
+}
+
 valid_alias_name() {
   # lowercase ASCII, digits, hyphens. No /, ., spaces. Not "rite" or "rite-*".
   case "$1" in
@@ -105,6 +115,20 @@ is_pinned_alias_file() {
   grep -q 'description: Alias of DevRites /' "$1"
 }
 
+preflight_alias_destination() {
+  _dir="$1"
+  _file="$2"
+  if [ -L "$_dir" ] || { path_exists "$_dir" && [ ! -d "$_dir" ]; }; then
+    dr_die "$_dir exists and is not a managed alias directory: refusing to overwrite"
+  fi
+  if path_exists "$_file"; then
+    [ ! -L "$_file" ] && is_pinned_alias_file "$_file" \
+      || dr_die "$_file exists and is NOT a pinned alias: refusing to overwrite"
+  elif [ -d "$_dir" ]; then
+    dr_die "$_dir exists without a pinned alias: refusing to overwrite"
+  fi
+}
+
 # ---- subcommands ---------------------------------------------------------
 do_add() {
   valid_alias_name "$ALIAS"    || dr_die "invalid alias name '$ALIAS' (lowercase / digits / hyphens; not 'rite' or 'rite-*')"
@@ -118,34 +142,47 @@ do_add() {
   CODEX_ALIAS_FILE="$CODEX_ALIAS_DIR/SKILL.md"
   CODEX_ALIAS_REL=".agents/skills/$ALIAS/SKILL.md"
 
-  if [ -e "$ALIAS_FILE" ]; then
-    if is_pinned_alias "$ALIAS"; then
-      dr_warn "already pinned: /$ALIAS: overwriting"
-    else
-      dr_die "$ALIAS_FILE exists and is NOT a pinned alias: refusing to overwrite"
-    fi
+  preflight_alias_destination "$ALIAS_DIR" "$ALIAS_FILE"
+  if path_exists "$ALIAS_FILE"; then
+    dr_warn "already pinned: /$ALIAS: overwriting"
   fi
-  if [ -d "$CODEX_SKILLS_DIR" ] && [ -e "$CODEX_ALIAS_FILE" ]; then
-    if is_pinned_alias_file "$CODEX_ALIAS_FILE"; then
+  if [ -d "$CODEX_SKILLS_DIR" ]; then
+    preflight_alias_destination "$CODEX_ALIAS_DIR" "$CODEX_ALIAS_FILE"
+    if path_exists "$CODEX_ALIAS_FILE"; then
       dr_warn "already pinned for Codex: /$ALIAS: overwriting"
-    else
-      dr_die "$CODEX_ALIAS_FILE exists and is NOT a pinned alias: refusing to overwrite"
     fi
   fi
 
+  PIN_TMP="$(mktemp -d "$SKILLS_DIR/.devrites-pin.XXXXXX")"
+  dr_gen_alias_wrapper "$ALIAS" "$DEST" "$PIN_TMP/claude"
+  if [ -d "$CODEX_SKILLS_DIR" ]; then
+    dr_gen_alias_wrapper "$ALIAS" "$DEST" "$PIN_TMP/codex"
+  fi
+  cp -p "$MF" "$PIN_TMP/manifest"
+  if ! dr_manifest_contains "$PIN_TMP/manifest" "$ALIAS_REL"; then
+    printf '%s\n' "$ALIAS_REL" >> "$PIN_TMP/manifest"
+  fi
+  if [ -d "$CODEX_SKILLS_DIR" ] && ! dr_manifest_contains "$PIN_TMP/manifest" "$CODEX_ALIAS_REL"; then
+    printf '%s\n' "$CODEX_ALIAS_REL" >> "$PIN_TMP/manifest"
+  fi
+
   mkdir -p "$ALIAS_DIR"
-  dr_gen_alias_wrapper "$ALIAS" "$DEST" "$ALIAS_FILE"
   if [ -d "$CODEX_SKILLS_DIR" ]; then
     mkdir -p "$CODEX_ALIAS_DIR"
-    dr_gen_alias_wrapper "$ALIAS" "$DEST" "$CODEX_ALIAS_FILE"
   fi
-
-  if ! dr_manifest_contains "$MF" "$ALIAS_REL"; then
-    printf '%s\n' "$ALIAS_REL" >> "$MF"
+  [ -w "$ALIAS_DIR" ] || dr_die "$ALIAS_DIR is not writable"
+  [ -w "$(dirname "$MF")" ] || dr_die "$(dirname "$MF") is not writable"
+  if [ -d "$CODEX_SKILLS_DIR" ]; then
+    [ -w "$CODEX_ALIAS_DIR" ] || dr_die "$CODEX_ALIAS_DIR is not writable"
   fi
-  if [ -d "$CODEX_SKILLS_DIR" ] && ! dr_manifest_contains "$MF" "$CODEX_ALIAS_REL"; then
-    printf '%s\n' "$CODEX_ALIAS_REL" >> "$MF"
+
+  mv "$PIN_TMP/claude" "$ALIAS_FILE"
+  if [ -d "$CODEX_SKILLS_DIR" ]; then
+    mv "$PIN_TMP/codex" "$CODEX_ALIAS_FILE"
   fi
+  mv "$PIN_TMP/manifest" "$MF"
+  rm -rf "$PIN_TMP"
+  PIN_TMP=""
 
   if [ -d "$CODEX_SKILLS_DIR" ]; then
     dr_ok "pinned: /$ALIAS → /$DEST   ($ALIAS_FILE, $CODEX_ALIAS_FILE)"
@@ -166,17 +203,24 @@ do_remove() {
   [ -f "$ALIAS_FILE" ]      || dr_die "no pinned alias at $ALIAS_FILE"
   is_pinned_alias "$ALIAS"  || dr_die "$ALIAS_FILE exists but is not a pinned alias: refusing to remove"
 
+  if path_exists "$CODEX_ALIAS_FILE"; then
+    is_pinned_alias_file "$CODEX_ALIAS_FILE" || dr_die "$CODEX_ALIAS_FILE exists but is not a pinned alias: refusing to remove"
+  fi
+
+  PIN_TMP="$(mktemp -d "$SKILLS_DIR/.devrites-pin.XXXXXX")"
+  awk -v claude="$ALIAS_REL" -v codex="$CODEX_ALIAS_REL" \
+    '$0 != claude && $0 != codex' "$MF" > "$PIN_TMP/manifest"
+
   rm -f "$ALIAS_FILE"
   rmdir "$ALIAS_DIR" 2>/dev/null || true
-  if [ -f "$CODEX_ALIAS_FILE" ]; then
-    is_pinned_alias_file "$CODEX_ALIAS_FILE" || dr_die "$CODEX_ALIAS_FILE exists but is not a pinned alias: refusing to remove"
+  if path_exists "$CODEX_ALIAS_FILE"; then
     rm -f "$CODEX_ALIAS_FILE"
     rmdir "$CODEX_ALIAS_DIR" 2>/dev/null || true
   fi
 
-  # Drop the alias line from the manifest (preserve header + the rest)
-  TMP="$(mktemp)"
-  grep -Fvx "$ALIAS_REL" "$MF" | grep -Fvx "$CODEX_ALIAS_REL" > "$TMP" && mv "$TMP" "$MF"
+  mv "$PIN_TMP/manifest" "$MF"
+  rm -rf "$PIN_TMP"
+  PIN_TMP=""
 
   dr_ok "unpinned: /$ALIAS"
 }
@@ -192,7 +236,9 @@ do_list() {
       found=1
     fi
   done
-  [ "$found" -eq 0 ] && dr_say "(no pinned aliases at $TARGET)"
+  if [ "$found" -eq 0 ]; then
+    dr_say "(no pinned aliases at $TARGET)"
+  fi
 }
 
 case "$SUBCMD" in

package/scripts/run-tests.mjs

@@ -3,8 +3,9 @@ import { spawn } from 'node:child_process';
 import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const root = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
+const root = fileURLToPath(new URL('..', import.meta.url));
 const testsDir = join(root, 'tests');
 const args = process.argv.slice(2);
 let jobs = Math.max(1, Math.min(5, Math.floor(Number(process.env.DEVRITES_TEST_JOBS || 4)) || 4));

package/scripts/scan-pack-security.py

@@ -151,7 +151,7 @@ def _file_suppressions(text):
 
 # --- driver ---------------------------------------------------------------
 
-TEXT_EXTS = {".md", ".sh", ".json", ".txt", ".py", ".js", ".yaml", ".yml", ""}
+TEXT_EXTS = {".md", ".sh", ".json", ".toml", ".txt", ".py", ".js", ".yaml", ".yml", ""}
 
 
 def iter_files(paths):

package/scripts/skill-pruning-audit.mjs

@@ -2,8 +2,9 @@
 // Advisory pruning audit plus blocking ordered-step completion contracts.
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const root = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
+const root = fileURLToPath(new URL('..', import.meta.url));
 const skillsArg = process.argv.indexOf('--skills-dir');
 const skillsDir = skillsArg >= 0 ? process.argv[skillsArg + 1] : join(root, 'pack', '.claude', 'skills');
 const quiet = process.argv.includes('--quiet');

package/scripts/skills-inventory.mjs

@@ -2,8 +2,9 @@
 // Verify the authored DevRites skill inventory and documentation counts.
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
-const root = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
+const root = fileURLToPath(new URL('..', import.meta.url));
 const skillsDir = join(root, 'pack', '.claude', 'skills');
 const docsSkills = join(root, 'docs', 'skills.md');
 const docsCommandMap = join(root, 'docs', 'command-map.md');

package/scripts/validate-workflow-security.py

@@ -20,25 +20,82 @@ import re
 import sys
 
 SHA_RE = re.compile(r"^[0-9a-f]{40}$")
-USES_RE = re.compile(r"^\s*-?\s*uses:\s*([^\s#]+)")
+USES_RE = re.compile(r"^\s*-?\s*uses\s*:\s*([^\s#]+)")
 DEPENDABOT_ONLY_RE = re.compile(
-    r"^\s*if:\s*(?:\$\{\{\s*)?"
+    r"^\s*if\s*:\s*(?:\$\{\{\s*)?"
     r"(?:github\.actor|github\.event\.pull_request\.user\.login)\s*==\s*"
     r"['\"]dependabot\[bot\]['\"]",
     re.MULTILINE,
 )
 UNQUOTED_NAME_COLON_RE = re.compile(r"^\s*(?:-\s*)?name:\s+[^'\"].*:\s+\S")
-RUN_RE = re.compile(r"^(\s*)(?:-\s*)?run:\s*(.*)$")
+RUN_RE = re.compile(r"^(\s*)(?:-\s*)?run\s*:\s*(.*)$")
 DISPATCH_EXPRESSION_RE = re.compile(r"\$\{\{[^}]*\binputs\b", re.IGNORECASE)
+KEY_RE = re.compile(r"^(\s*)([A-Za-z_][A-Za-z0-9_-]*)\s*:\s*(.*)$")
+
+
+def jobs_without_permissions(lines):
+    """Return job IDs missing direct permissions, or None with a global scope."""
+    for line in lines:
+        match = KEY_RE.match(line)
+        if match and not match.group(1) and match.group(2) == "permissions":
+            return None
+
+    jobs_line = None
+    for i, line in enumerate(lines):
+        match = KEY_RE.match(line)
+        if match and not match.group(1) and match.group(2) == "jobs":
+            jobs_line = i
+            break
+    if jobs_line is None:
+        return ["<workflow>"]
+
+    job_indent = None
+    job_starts = []
+    for i in range(jobs_line + 1, len(lines)):
+        line = lines[i]
+        if not line.strip() or line.lstrip().startswith("#"):
+            continue
+        match = KEY_RE.match(line)
+        if not match:
+            continue
+        indent = len(match.group(1))
+        if indent == 0:
+            break
+        if job_indent is None:
+            job_indent = indent
+        if indent == job_indent:
+            job_starts.append((i, match.group(2)))
+    if not job_starts:
+        return ["<workflow>"]
+
+    missing = []
+    for position, (start, job_id) in enumerate(job_starts):
+        end = job_starts[position + 1][0] if position + 1 < len(job_starts) else len(lines)
+        property_indents = []
+        properties = []
+        for line in lines[start + 1:end]:
+            match = KEY_RE.match(line)
+            if not match:
+                continue
+            indent = len(match.group(1))
+            if indent > job_indent:
+                property_indents.append(indent)
+                properties.append((indent, match.group(2)))
+        direct_indent = min(property_indents) if property_indents else None
+        if direct_indent is None or not any(
+                indent == direct_indent and key == "permissions"
+                for indent, key in properties):
+            missing.append(job_id)
+    return missing
 
 
 def safe_dependabot_target(text):
-    if re.search(r"^\s*-?\s*uses:\s*actions/checkout@", text, re.MULTILINE):
+    if re.search(r"^\s*-?\s*uses\s*:\s*actions/checkout@", text, re.MULTILINE):
         return False
-    jobs = text.split("\njobs:", 1)
+    jobs = re.split(r"(?m)^jobs\s*:\s*(?:#.*)?$", text, maxsplit=1)
     if len(jobs) != 2:
         return False
-    blocks = re.split(r"(?m)^  [A-Za-z0-9_-]+:\s*(?:#.*)?$", jobs[1])[1:]
+    blocks = re.split(r"(?m)^  [A-Za-z0-9_-]+\s*:\s*(?:#.*)?$", jobs[1])[1:]
     return bool(blocks) and all(DEPENDABOT_ONLY_RE.search(block) for block in blocks)
 
 
@@ -46,9 +103,11 @@ def scan_text(path, text):
     findings = []
     lines = text.splitlines()
     dependabot_target_is_safe = safe_dependabot_target(text)
-    if not re.search(r"^\s*permissions:", text, re.MULTILINE):
-        findings.append("%s: no permissions block. The default GITHUB_TOKEN is broad; "
-                        "add an explicit least-privilege block" % path)
+    unscoped_jobs = jobs_without_permissions(lines)
+    if unscoped_jobs:
+        findings.append("%s: jobs without explicit permissions: %s. Add a global "
+                        "least-privilege block or scope every job"
+                        % (path, ", ".join(unscoped_jobs)))
     for i, line in enumerate(lines, 1):
         if UNQUOTED_NAME_COLON_RE.match(line):
             findings.append("%s:%d: name has an unquoted colon. Quote the complete "

package/scripts/validate.sh

@@ -15,9 +15,11 @@ good() { printf 'ok: %s\n' "$*"; }
 
 # ---- 1. bash -n on every shell script ------------------------------------
 section "bash syntax (bash -n)"
-SH_LIST="$ROOT/install.sh $ROOT/uninstall.sh $ROOT/update.sh"
-for f in "$ROOT"/scripts/*.sh "$ROOT"/tests/*.sh "$ROOT"/pack/.claude/hooks/*.sh "$ROOT"/pack/.claude/skills/*/scripts/*.sh; do [ -f "$f" ] && SH_LIST="$SH_LIST $f"; done
-for f in $SH_LIST; do
+SH_LIST=("$ROOT/install.sh" "$ROOT/uninstall.sh" "$ROOT/update.sh")
+for f in "$ROOT"/scripts/*.sh "$ROOT"/tests/*.sh "$ROOT"/pack/.claude/hooks/*.sh "$ROOT"/pack/.claude/skills/*/scripts/*.sh; do
+  [ -f "$f" ] && SH_LIST+=("$f")
+done
+for f in "${SH_LIST[@]}"; do
   if bash -n "$f" 2>/tmp/dr_synerr; then good "syntax ${f#$ROOT/}"; else bad "syntax ${f#$ROOT/}: $(cat /tmp/dr_synerr)"; fi
 done
 
@@ -67,10 +69,10 @@ done
 # ---- 5. frontmatter validation ------------------------------------------
 section "frontmatter"
 if command -v python3 >/dev/null 2>&1; then
-  FM_FILES=""
-  for d in "$SKILLS"/*/; do FM_FILES="$FM_FILES ${d}SKILL.md"; done
-  for a in "$AGENTS"/*.md; do FM_FILES="$FM_FILES $a"; done
-  if python3 "$ROOT/scripts/validate-frontmatter.py" $FM_FILES; then good "frontmatter parses"; else bad "frontmatter validation failed"; fi
+  FM_FILES=()
+  for d in "$SKILLS"/*/; do [ -f "${d}SKILL.md" ] && FM_FILES+=("${d}SKILL.md"); done
+  for a in "$AGENTS"/*.md; do [ -f "$a" ] && FM_FILES+=("$a"); done
+  if python3 "$ROOT/scripts/validate-frontmatter.py" "${FM_FILES[@]}"; then good "frontmatter parses"; else bad "frontmatter validation failed"; fi
 else
   echo "skip: python3 not found"
 fi
@@ -335,11 +337,11 @@ fi
 # Local validation skips this gate only when shellcheck is not installed.
 section "shellcheck (-S error blocking · -S warning advisory)"
 if command -v shellcheck >/dev/null 2>&1; then
-  for f in $SH_LIST; do
+  for f in "${SH_LIST[@]}"; do
     if shellcheck -S error "$f"; then good "shellcheck ${f#"$ROOT"/}"; else bad "shellcheck (error) ${f#"$ROOT"/}"; fi
   done
   # Warnings are advisory. Print them per file without failing the build.
-  for f in $SH_LIST; do
+  for f in "${SH_LIST[@]}"; do
     shellcheck -S warning "$f" >/dev/null 2>&1 || echo "  advisory (warning-level): ${f#"$ROOT"/}"
   done
 else