dotmd-cli 0.69.0 → 0.70.1

package/src/lint.mjs

@@ -6,6 +6,7 @@ import { buildIndex, collectDocFiles } from './index.mjs';
 import { updateFrontmatter } from './lifecycle.mjs';
 import { runMLX, checkUvAvailable } from './ai.mjs';
 import { bold, green, yellow, dim } from './color.mjs';
+import { authorizeManagedSweep, findLexicalDocsRoot } from './managed-path.mjs';
 
 const KEY_RENAMES = {
   nextStep: 'next_step',
@@ -16,6 +17,55 @@ const KEY_RENAMES = {
   supportsPlans: 'supports_plans',
 };
 
+function frontmatterFieldBlock(frontmatter, field) {
+  const lines = frontmatter.split(/\r?\n/);
+  const fieldRe = new RegExp(`^${escapeRegex(field)}:`);
+  const start = lines.findIndex(line => fieldRe.test(line));
+  if (start < 0) return null;
+  let end = start + 1;
+  while (end < lines.length) {
+    if (/^[ \t]/.test(lines[end]) || lines[end].trim() === '') {
+      end++;
+      continue;
+    }
+    if (lines[end].trimStart().startsWith('#')) {
+      let next = end + 1;
+      while (next < lines.length && (lines[next].trim() === '' || lines[next].trimStart().startsWith('#'))) next++;
+      if (next < lines.length && /^[ \t]/.test(lines[next])) {
+        end++;
+        continue;
+      }
+    }
+    break;
+  }
+  return { lines, start, end };
+}
+
+function replaceFrontmatterFieldBlock(frontmatter, field, replacement = '') {
+  const block = frontmatterFieldBlock(frontmatter, field);
+  if (!block) return frontmatter;
+  const { lines, start, end } = block;
+  lines.splice(start, end - start, ...(replacement ? replacement.split('\n') : []));
+  return lines.join('\n');
+}
+
+function frontmatterFieldComments(frontmatter, field) {
+  const block = frontmatterFieldBlock(frontmatter, field);
+  if (!block) return [];
+  return block.lines
+    .slice(block.start + 1, block.end)
+    .map(line => line.trim())
+    .filter(line => line.startsWith('#'));
+}
+
+function isAutoFixableString(value) {
+  return typeof value === 'string' && !/(^|\s)#/.test(value);
+}
+
+function formatYamlScalar(value) {
+  return /^[A-Za-z0-9_./-]+$/.test(value) ? value : JSON.stringify(value);
+}
+
 export function runLint(argv, config, opts = {}) {
   const { dryRun } = opts;
   const fix = argv.includes('--fix');
@@ -29,11 +79,11 @@ export function runLint(argv, config, opts = {}) {
     const parsed = parseSimpleFrontmatter(frontmatter);
     const repoPath = toRepoPath(filePath, config.repoRoot);
     const fixes = [];
+    const skipWarnings = config.lifecycle.skipWarningsFor.has(asString(parsed.status));
 
     // Missing type (fixable — infer from root: plans → 'plan', else 'doc')
     if (!asString(parsed.type)) {
-      const roots = config.docsRoots || [config.docsRoot];
-      const docRoot = roots.find(r => filePath.startsWith(r)) ?? config.docsRoot;
+      const docRoot = findLexicalDocsRoot(filePath, config) ?? config.docsRoot;
       const rootLabel = path.relative(config.repoRoot, docRoot).split(path.sep).join('/');
       // If the root label contains 'plan' (e.g. 'docs/plans'), default to plan type
       const inferredType = rootLabel.includes('plan') ? 'plan' : 'doc';
@@ -46,7 +96,7 @@ export function runLint(argv, config, opts = {}) {
     }
 
     // Missing updated
-    if (!asString(parsed.updated) && asString(parsed.status) && !config.lifecycle.skipWarningsFor.has(asString(parsed.status))) {
+    if (!asString(parsed.updated) && asString(parsed.status) && !skipWarnings) {
       const today = new Date().toISOString().slice(0, 10);
       fixes.push({ field: 'updated', oldValue: null, newValue: today, type: 'add' });
     }
@@ -72,26 +122,31 @@ export function runLint(argv, config, opts = {}) {
     // split on `,`, single values become a one-item list. Merging with any
     // existing plural array happens at apply-time so the message reflects
     // just what's being introduced from the singular form.
-    for (const { singular, plural } of [{ singular: 'module', plural: 'modules' }, { singular: 'surface', plural: 'surfaces' }]) {
-      const rawVal = parsed[singular];
-      const val = asString(rawVal);
-      if (val) {
-        // Inline value (`surface: foo`) → migrate into the plural array.
-        const values = val.includes(',')
-          ? val.split(',').map(s => s.trim()).filter(Boolean)
-          : [val];
-        fixes.push({ field: singular, oldValue: val, newValue: values, pluralKey: plural, type: 'singular-to-plural' });
-      } else if (singular in parsed && (!Array.isArray(rawVal) || rawVal.length === 0)) {
-        // Empty deprecated key (`surface:` with nothing after it, which the
-        // parser yields as `[]`) — usually sitting right above a populated
-        // `surfaces:`. There's no value to migrate; the deprecation warning
-        // just wants the dead line gone. `validate` treats the empty `[]` as
-        // present (so it warns), while the old `asString` gate here saw it as
-        // absent and skipped — the exact no-op reported in issue #17. Emit a
-        // drop fix so `lint --fix` does what the warning advertises. A
-        // populated block-form singular (rawVal.length > 0) is left untouched:
-        // too rare to risk mis-editing.
-        fixes.push({ field: singular, pluralKey: plural, type: 'drop-singular' });
+    if (!skipWarnings) {
+      for (const { singular, plural } of [{ singular: 'module', plural: 'modules' }, { singular: 'surface', plural: 'surfaces' }]) {
+        const rawVal = parsed[singular];
+        const rawPluralVal = parsed[plural];
+        const val = asString(rawVal);
+        const scalarValue = val && isAutoFixableString(val) ? val : null;
+        const blockValues = Array.isArray(rawVal) && rawVal.every(isAutoFixableString)
+          ? rawVal.map(item => item.trim()).filter(Boolean)
+          : [];
+        const pluralAutoFixable = rawPluralVal === undefined
+          || isAutoFixableString(rawPluralVal)
+          || (Array.isArray(rawPluralVal) && rawPluralVal.every(isAutoFixableString));
+        if (pluralAutoFixable && (scalarValue || blockValues.length > 0)) {
+          const values = blockValues.length > 0
+            ? blockValues
+            : scalarValue.includes(',')
+              ? scalarValue.split(',').map(s => s.trim()).filter(Boolean)
+              : [scalarValue];
+          fixes.push({ field: singular, oldValue: scalarValue || blockValues.join(', '), newValue: values, pluralKey: plural, type: 'singular-to-plural' });
+        } else if (pluralAutoFixable && singular in parsed && (
+          (typeof rawVal === 'string' && !rawVal.trim())
+          || (Array.isArray(rawVal) && rawVal.every(item => typeof item === 'string' && !item.trim()))
+        )) {
+          fixes.push({ field: singular, pluralKey: plural, type: 'drop-singular' });
+        }
       }
     }
 
@@ -113,27 +168,31 @@ export function runLint(argv, config, opts = {}) {
     }
   }
 
-  // Also get non-fixable issues from index, excluding issues we can already fix
-  const index = buildIndex(config);
-  const fixablePaths = new Set(fixable.map(f => f.repoPath));
-  // Singular-key deprecation warnings whose fix `lint --fix` will actually make.
-  // Without this, those warnings landed in BOTH the "fixable" preview and the
-  // "non-fixable" list, so the header claimed "N non-fixable" while every line
-  // told you to run `lint --fix` (issue #17, item 8).
-  const fixableSingularKeys = new Set();
-  for (const { repoPath, fixes } of fixable) {
-    for (const f of fixes) {
-      if (f.type === 'singular-to-plural' || f.type === 'drop-singular') {
-        fixableSingularKeys.add(`${repoPath}::${f.field}`);
+  let nonFixable = [];
+  if (!fix) {
+    // Report-only mode also gets non-fixable issues from the index. Fix mode
+    // does not render these and must not pay for a full validation/Git scan.
+    const index = buildIndex(config);
+    const fixablePaths = new Set(fixable.map(f => f.repoPath));
+    // Singular-key deprecation warnings whose fix `lint --fix` will actually make.
+    // Without this, those warnings landed in BOTH the "fixable" preview and the
+    // "non-fixable" list, so the header claimed "N non-fixable" while every line
+    // told you to run `lint --fix` (issue #17, item 8).
+    const fixableSingularKeys = new Set();
+    for (const { repoPath, fixes } of fixable) {
+      for (const f of fixes) {
+        if (f.type === 'singular-to-plural' || f.type === 'drop-singular') {
+          fixableSingularKeys.add(`${repoPath}::${f.field}`);
+        }
       }
     }
+    nonFixable = [...index.errors, ...index.warnings].filter(issue => {
+      if (issue.message.includes('Missing frontmatter `status`') && fixablePaths.has(issue.path)) return false;
+      const dep = issue.message.match(/^`(module|surface):` \(singular\) is deprecated/);
+      if (dep && fixableSingularKeys.has(`${issue.path}::${dep[1]}`)) return false;
+      return true;
+    });
   }
-  const nonFixable = [...index.errors, ...index.warnings].filter(issue => {
-    if (issue.message.includes('Missing frontmatter `status`') && fixablePaths.has(issue.path)) return false;
-    const dep = issue.message.match(/^`(module|surface):` \(singular\) is deprecated/);
-    if (dep && fixableSingularKeys.has(`${issue.path}::${dep[1]}`)) return false;
-    return true;
-  });
 
   if (!fix) {
     // Report mode
@@ -176,6 +235,7 @@ export function runLint(argv, config, opts = {}) {
   }
 
   // Fix mode
+  authorizeManagedSweep(fixable.map(item => item.filePath), config, { kind: 'Lint fix source' });
   const prefix = dryRun ? dim('[dry-run] ') : '';
   let totalFixes = 0;
 
@@ -224,22 +284,25 @@ export function runLint(argv, config, opts = {}) {
       }
 
       // Apply singular-to-plural fixes (module/surface → modules/surfaces array).
-      // Removes the singular key line; merges its value(s) into the plural array,
+      // Removes the singular key block; merges its value(s) into the plural array,
       // or creates the plural block if absent. Duplicates are skipped.
       for (const sa of singularToPlural) {
         let raw = readFileSync(filePath, 'utf8');
         const { frontmatter: fm } = extractFrontmatter(raw);
-        let newFm = fm.replace(new RegExp(`^${escapeRegex(sa.field)}:.*$`, 'm'), '').replace(/\n{2,}/g, '\n');
-        const pluralLineRe = new RegExp(`^${escapeRegex(sa.pluralKey)}:[ \\t]*$`, 'm');
-        if (pluralLineRe.test(newFm)) {
-          for (const val of sa.newValue) {
-            const hasVal = new RegExp(`^[ \\t]*-[ \\t]+${escapeRegex(val)}[ \\t]*$`, 'm').test(newFm);
-            if (!hasVal) {
-              newFm = newFm.replace(pluralLineRe, `${sa.pluralKey}:\n  - ${val}`);
-            }
-          }
+        const parsedFm = parseSimpleFrontmatter(fm);
+        const pluralValue = parsedFm[sa.pluralKey];
+        const existing = Array.isArray(pluralValue)
+          ? pluralValue.filter(value => typeof value === 'string' && value.trim())
+          : asString(pluralValue) ? [asString(pluralValue)] : [];
+        const merged = [...new Set([...sa.newValue, ...existing])];
+        const comments = [...frontmatterFieldComments(fm, sa.field), ...frontmatterFieldComments(fm, sa.pluralKey)];
+        let newFm = replaceFrontmatterFieldBlock(fm, sa.field);
+        const pluralLines = [sa.pluralKey + ':', ...comments.map(comment => `  ${comment}`), ...merged.map(v => `  - ${formatYamlScalar(v)}`)];
+        const pluralBlock = pluralLines.join('\n');
+        if (Object.prototype.hasOwnProperty.call(parsedFm, sa.pluralKey)) {
+          newFm = replaceFrontmatterFieldBlock(newFm, sa.pluralKey, pluralBlock);
         } else {
-          newFm += `\n${sa.pluralKey}:\n${sa.newValue.map(v => `  - ${v}`).join('\n')}`;
+          newFm = `${newFm.trim()}\n${pluralBlock}`;
         }
         raw = replaceFrontmatter(raw, newFm.trim());
         writeFileSync(filePath, raw, 'utf8');
@@ -251,9 +314,8 @@ export function runLint(argv, config, opts = {}) {
       for (const ds of dropSingular) {
         let raw = readFileSync(filePath, 'utf8');
         const { frontmatter: fm } = extractFrontmatter(raw);
-        const newFm = fm
-          .replace(new RegExp(`^${escapeRegex(ds.field)}:[ \\t]*$`, 'm'), '')
-          .replace(/\n{2,}/g, '\n');
+        const comments = frontmatterFieldComments(fm, ds.field);
+        const newFm = replaceFrontmatterFieldBlock(fm, ds.field, comments.join('\n'));
         raw = replaceFrontmatter(raw, newFm.trim());
         writeFileSync(filePath, raw, 'utf8');
       }
@@ -322,4 +384,3 @@ export function runLint(argv, config, opts = {}) {
 
   process.stdout.write(`\n${prefix}${totalFixes} fix${totalFixes !== 1 ? 'es' : ''} applied across ${fixable.length} file(s).\n`);
 }
-

package/src/managed-path.mjs

@@ -0,0 +1,192 @@
+import { existsSync, lstatSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+
+// These checks are authorization preflights, not filesystem transactions. A
+// concurrent actor can still replace a checked ancestor before the later write
+// (TOCTOU); eliminating that residual boundary requires descriptor-relative IO.
+
+function contains(parent, child) {
+  const rel = path.relative(parent, child);
+  return rel === '' || (!rel.startsWith(`..${path.sep}`) && rel !== '..' && !path.isAbsolute(rel));
+}
+
+function sameNode(a, b) {
+  try {
+    const left = statSync(a, { bigint: true });
+    const right = statSync(b, { bigint: true });
+    return left.dev === right.dev && left.ino === right.ino;
+  } catch { return false; }
+}
+
+// realpath on case-insensitive macOS volumes may preserve the caller's casing.
+// Prove an alias by inode before treating it as contained; lowercase string
+// comparison alone would be unsafe on case-sensitive volumes.
+function aliasContainment(parent, child) {
+  if (contains(parent, child)) return { contained: true, relative: path.relative(parent, child) };
+  const parentParts = path.resolve(parent).split(path.sep).filter(Boolean);
+  const childParts = path.resolve(child).split(path.sep).filter(Boolean);
+  if (childParts.length < parentParts.length) return { contained: false, relative: null };
+  const childPrefix = `${path.parse(path.resolve(child)).root}${childParts.slice(0, parentParts.length).join(path.sep)}`;
+  if (!sameNode(parent, childPrefix)) return { contained: false, relative: null };
+  return { contained: true, relative: childParts.slice(parentParts.length).join(path.sep) };
+}
+
+function lexicalRootsFor(config) {
+  return (config.docsRoots ?? [config.docsRoot]).map(configuredPath => ({
+    configuredPath,
+    lexicalPath: path.resolve(configuredPath),
+  }));
+}
+
+function rootsFor(config) {
+  return lexicalRootsFor(config).map(root => {
+    const { configuredPath, lexicalPath } = root;
+    let canonicalPath;
+    try {
+      canonicalPath = realpathSync(lexicalPath);
+    } catch (err) {
+      throw new Error(`Configured docs root cannot be resolved: ${lexicalPath} (${err.message})`);
+    }
+    return { configuredPath, lexicalPath, canonicalPath };
+  });
+}
+
+function rootsMessage(roots) {
+  return roots.map(root => root.lexicalPath).join(', ');
+}
+
+function markdown(pathname, kind, roots) {
+  if (!pathname.endsWith('.md')) {
+    throw new Error(`${kind} must be a Markdown file ending in .md: ${pathname}\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+}
+
+function nearestExistingAncestor(input, roots, kind) {
+  let current = input;
+  while (!existsSync(current)) {
+    try {
+      // existsSync is false for dangling symlinks, but lstat still sees them.
+      if (lstatSync(current).isSymbolicLink()) {
+        throw new Error(`dangling symlink: ${current}`);
+      }
+    } catch (err) {
+      if (err?.code !== 'ENOENT' && err?.code !== 'ENOTDIR') {
+        throw new Error(`${kind} has an unsafe existing ancestor: ${current} (${err.message})\nConfigured docs roots: ${rootsMessage(roots)}`);
+      }
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  try {
+    return realpathSync(current);
+  } catch (err) {
+    throw new Error(`${kind} ancestor cannot be resolved: ${current} (${err.message})\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+}
+
+function lexicalOwner(input, roots) {
+  return roots
+    .filter(root => contains(root.lexicalPath, input))
+    .sort((a, b) => b.lexicalPath.length - a.lexicalPath.length)[0] ?? null;
+}
+
+export function findLexicalDocsRoot(input, config) {
+  return lexicalOwner(path.resolve(input), lexicalRootsFor(config))?.lexicalPath ?? null;
+}
+
+export function authorizeManagedSource(input, config, { kind = 'Managed mutation source' } = {}) {
+  const roots = rootsFor(config);
+  const lexicalPath = path.resolve(input);
+  markdown(lexicalPath, kind, roots);
+
+  if (!existsSync(lexicalPath)) {
+    throw new Error(`${kind} does not exist: ${lexicalPath}\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+  if (lstatSync(lexicalPath).isSymbolicLink()) {
+    throw new Error(`${kind} may not be a symlink: ${lexicalPath}\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+
+  let canonicalPath;
+  try {
+    canonicalPath = realpathSync(lexicalPath);
+  } catch (err) {
+    throw new Error(`${kind} cannot be resolved: ${lexicalPath} (${err.message})\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+  if (!statSync(canonicalPath).isFile()) {
+    throw new Error(`${kind} is not a file: ${lexicalPath}\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+
+  const lexical = lexicalOwner(lexicalPath, roots);
+  if (lexical && !aliasContainment(lexical.canonicalPath, canonicalPath).contained) {
+    throw new Error(`${kind} is lexically owned by ${lexical.lexicalPath} but resolves outside that root: ${lexicalPath} -> ${canonicalPath}\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+  const root = lexical
+    ?? roots.filter(candidate => aliasContainment(candidate.canonicalPath, canonicalPath).contained)
+      .sort((a, b) => b.canonicalPath.length - a.canonicalPath.length)[0];
+  if (!root) {
+    throw new Error(`${kind} resolves outside configured docs roots: ${lexicalPath} -> ${canonicalPath}\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+
+  // Keep operations on the configured root spelling (important when the root
+  // itself is a symlink), while normalizing OS-level aliases such as /var ->
+  // /private/var back through the owning root.
+  const managedPath = lexical
+    ? lexicalPath
+    : path.join(root.lexicalPath, aliasContainment(root.canonicalPath, canonicalPath).relative);
+  return { path: managedPath, canonicalPath, root };
+}
+
+export function authorizeManagedDestination(input, config, { root: requiredRoot = null, kind = 'Managed mutation destination' } = {}) {
+  const roots = rootsFor(config);
+  const lexicalPath = path.resolve(input);
+  markdown(lexicalPath, kind, roots);
+
+  const root = requiredRoot
+    ? roots.find(candidate => candidate.lexicalPath === requiredRoot.lexicalPath && candidate.canonicalPath === requiredRoot.canonicalPath)
+    : lexicalOwner(lexicalPath, roots);
+  if (!root || !contains(root.lexicalPath, lexicalPath)) {
+    const ownership = requiredRoot ? `Owning docs root: ${requiredRoot.lexicalPath}\n` : '';
+    throw new Error(`${kind} is lexically outside its configured docs root: ${lexicalPath}\n${ownership}Configured docs roots: ${rootsMessage(roots)}`);
+  }
+
+  const ancestor = nearestExistingAncestor(lexicalPath, roots, kind);
+  if (!aliasContainment(root.canonicalPath, ancestor).contained) {
+    throw new Error(`${kind} escapes through an existing symlinked parent: ${lexicalPath} -> ${ancestor}\nOwning docs root: ${root.lexicalPath}\nConfigured docs roots: ${rootsMessage(roots)}`);
+  }
+  return { path: lexicalPath, canonicalPath: existsSync(lexicalPath) ? realpathSync(lexicalPath) : null, root };
+}
+
+export function authorizeManagedMove(source, destination, config, options = {}) {
+  const authorizedSource = authorizeManagedSource(source, config, options);
+  const authorizedDestination = authorizeManagedDestination(destination, config, {
+    ...options,
+    kind: options.destinationKind ?? 'Managed mutation destination',
+    root: authorizedSource.root,
+  });
+  return { source: authorizedSource, destination: authorizedDestination };
+}
+
+export function authorizeManagedSweep(files, config, { kind = 'Managed mutation sweep' } = {}) {
+  return files.map(file => authorizeManagedSource(file, config, { kind }));
+}
+
+export function authorizeRepoGeneratedPath(input, config, { kind = 'Repository-generated destination' } = {}) {
+  const lexicalPath = path.resolve(input);
+  const repoRoot = path.resolve(config.repoRoot);
+  let canonicalRepo;
+  try { canonicalRepo = realpathSync(repoRoot); }
+  catch (err) { throw new Error(`Repository root cannot be resolved: ${repoRoot} (${err.message})`); }
+
+  if (!contains(repoRoot, lexicalPath)) {
+    throw new Error(`${kind} is outside the repository: ${lexicalPath}\nRepository root: ${repoRoot}`);
+  }
+  const ancestor = nearestExistingAncestor(lexicalPath, [{ lexicalPath: repoRoot }], kind);
+  if (!contains(canonicalRepo, ancestor)) {
+    throw new Error(`${kind} escapes through an existing symlinked parent: ${lexicalPath} -> ${ancestor}\nRepository root: ${repoRoot}`);
+  }
+  if (existsSync(lexicalPath) && lstatSync(lexicalPath).isSymbolicLink()) {
+    throw new Error(`${kind} may not be a symlink: ${lexicalPath}\nRepository root: ${repoRoot}`);
+  }
+  return { path: lexicalPath, canonicalPath: existsSync(lexicalPath) ? realpathSync(lexicalPath) : null };
+}

package/src/migrate-prompts.mjs

@@ -6,6 +6,7 @@ import { getGitFirstAdded } from './git.mjs';
 import { bold, green, dim } from './color.mjs';
 import { readFileSync as rfs } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { authorizeManagedSweep } from './managed-path.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(rfs(path.join(__dirname, '..', 'package.json'), 'utf8'));
@@ -124,6 +125,7 @@ export function runMigratePrompts(argv, config, opts = {}) {
   } else {
     files = findPromptCandidates(config);
   }
+  authorizeManagedSweep(files, config, { kind: 'Prompt migration source' });
 
   const results = [];
   let touched = 0;

package/src/migrate-template.mjs

@@ -4,6 +4,7 @@ import { extractFrontmatter, parseSimpleFrontmatter } from './frontmatter.mjs';
 import { asString, toRepoPath, nowIso } from './util.mjs';
 import { collectDocFiles } from './index.mjs';
 import { bold, green, yellow, dim } from './color.mjs';
+import { authorizeManagedSweep } from './managed-path.mjs';
 
 const HEADING_RENAMES = [
   { from: /^##\s+Open questions\s*$/gm, to: '## Open Questions' },
@@ -117,6 +118,7 @@ export function runMigrateTemplate(argv, config, opts = {}) {
     files = collectDocFiles(config);
     if (!includeArchived) files = files.filter(f => !isInArchive(f, config));
   }
+  authorizeManagedSweep(files, config, { kind: 'Template migration source' });
 
   const results = [];
   let totalChanges = 0;

package/src/migrate.mjs

@@ -5,6 +5,7 @@ import { asString, toRepoPath, resolveDocPath, die } from './util.mjs';
 import { collectDocFiles } from './index.mjs';
 import { updateFrontmatter } from './lifecycle.mjs';
 import { bold, green, dim } from './color.mjs';
+import { authorizeManagedSweep } from './managed-path.mjs';
 
 export function runMigrate(argv, config, opts = {}) {
   const { dryRun } = opts;
@@ -38,7 +39,11 @@ export function runMigrate(argv, config, opts = {}) {
         matched.push(filePath);
         continue;
       }
-      const hits = allFiles.filter(f => f.includes(input) || path.basename(f).includes(input));
+      const normalizedInput = input.replaceAll('\\', '/');
+      const hits = allFiles.filter(f => {
+        const repoPath = toRepoPath(f, config.repoRoot);
+        return repoPath.includes(normalizedInput) || path.basename(f).includes(input);
+      });
       if (hits.length === 0) {
         unresolved.push(input);
       } else {
@@ -52,6 +57,7 @@ export function runMigrate(argv, config, opts = {}) {
   }
 
   const matches = [];
+  authorizeManagedSweep(fileFilter ? [...fileFilter] : allFiles, config, { kind: 'Migration source' });
 
   for (const filePath of allFiles) {
     if (fileFilter && !fileFilter.has(filePath)) continue;