halfcycle 0.3.31 → 0.3.32

package/dist/identity.d.ts

@@ -65,6 +65,8 @@ export interface ProjectIdentity {
      */
     note: string;
 }
+/** This process's environment without the repository-locating git variables. */
+export declare function gitEnvForNamedRepo(): NodeJS.ProcessEnv;
 /** Read the repository's root commit hash (the first commit, reachable from HEAD). */
 export declare function readRootCommit(targetRepoRoot: string): string | null;
 /** Read the `origin` remote URL. */
@@ -79,6 +81,43 @@ export declare function readRemote(targetRepoRoot: string): string | null;
  * the banner drops the whole clause rather than printing a zero it did not measure.
  */
 export declare function readCommitCount(targetRepoRoot: string): number | null;
+/** One path git ignores, with the rule that ignores it. */
+export interface IgnoredPath {
+    /** The path as it was asked about, relative to the directory the install ran in. */
+    path: string;
+    /** The pattern that matched, as written in its source. */
+    pattern: string;
+    /**
+     * Where the pattern lives, as git names it: relative to the repository root for a
+     * file inside it, else absolute. Made absolute when the install ran below the root.
+     */
+    source: string;
+    /** The pattern's line number in `source`. */
+    line: number;
+}
+/**
+ * Which of `paths` git would leave out of a commit, and the rule that says so, or `null`
+ * when git cannot answer (no repository, no `git`) or nothing is ignored. An empty
+ * `paths` asks git nothing.
+ *
+ * ONE `git check-ignore -v -z --stdin`: the paths go NUL-separated on stdin and every
+ * answer comes back as four NUL-separated fields — source, line, pattern, path. `-z`
+ * because an absolute excludes-file path may contain `:`, which the default output
+ * uses as its separator; `--stdin` because `-z` requires it. The command is index
+ * aware, so a tracked file is never reported however its rules read.
+ *
+ * A `!` pattern is a negation: `-v` prints the one that matched with exit 0 although
+ * the path is NOT ignored, so it is dropped here rather than reported. Git refuses the
+ * whole batch (exit 128) over one path below a symbolic link or inside a submodule;
+ * the caller drops those paths before asking, and a refusal here reads as "cannot
+ * answer", with no retry.
+ *
+ * Git reports a source inside the repository relative to the repository ROOT, not to
+ * the directory it ran in, so when the install ran below the root such a source is
+ * joined to `--show-toplevel` (which resolves symbolic links) and returned absolute.
+ * Those two calls are made only when there is something to report.
+ */
+export declare function readIgnoredPaths(targetRepoRoot: string, paths: readonly string[]): IgnoredPath[] | null;
 /**
  * Return the existing committed identity if `.halfcycle/project.json` is present,
  * otherwise mint a fresh one. Minting never overwrites the MINTED fields

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,qBAAqB,QAGF,CAAC;AAEjC,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gEAAgE;IAChE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAgBD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMpE;AAED,oCAAoC;AACpC,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKrE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAmBzG"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,qBAAqB,QAGF,CAAC;AAEjC,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gEAAgE;IAChE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AA6BD,gFAAgF;AAChF,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,UAAU,CAItD;AAqBD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMpE;AAED,oCAAoC;AACpC,wBAAgB,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAyBvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAmBzG"}

package/dist/index.js

@@ -1,13 +1,10 @@
 // dist/install.js
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname2, join as join5, posix, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// ../events/dist/result.js
-import { z as z2 } from "zod";
-
 // ../core/dist/guard-record.js
 import { z } from "zod";
 var severitySchema = z.enum(["info", "warn", "block"]);
@@ -113,7 +110,76 @@ ${block}`);
   return result;
 }
 
+// ../core/dist/hook-wiring.js
+var SETTINGS_REL = ".claude/settings.json";
+var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
+var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
+var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
+var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
+var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
+var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
+var HALFCYCLE_HOOK_WIRING = [
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_START_MARKER_REL}`,
+    script: SESSION_START_MARKER_REL
+  },
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 10,
+    command: `bash ./${GUARD_RUNNER_REL} refresh-credential`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${USER_PROMPT_REMINDER_REL}`,
+    script: USER_PROMPT_REMINDER_REL
+  },
+  {
+    event: "PostToolUse",
+    matcher: WRITE_CAPABLE_TOOLS.join("|"),
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook post-tool-use`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "Stop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SubagentStop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook subagent-stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SessionEnd",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_END_MARKER_REL}`,
+    script: SESSION_END_MARKER_REL
+  }
+];
+var RETIRED_HOOK_COMMANDS = [];
+var HALFCYCLE_HOOK_COMMANDS = /* @__PURE__ */ new Set([
+  ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.command),
+  ...RETIRED_HOOK_COMMANDS
+]);
+var HALFCYCLE_HOOK_WIRING_PATHS = [
+  .../* @__PURE__ */ new Set([SETTINGS_REL, ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])
+];
+
 // ../events/dist/result.js
+import { z as z2 } from "zod";
 var firedGuardSchema = z2.object({
   guardId: z2.string(),
   patternRef: z2.string(),
@@ -925,14 +991,36 @@ halfcycle_env_file() {
 // dist/identity.js
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { isAbsolute, join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
 var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
-function git(targetRepoRoot, args) {
+var REPOSITORY_LOCATING_GIT_VARS = [
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_COMMON_DIR",
+  "GIT_DIR",
+  "GIT_GRAFT_FILE",
+  "GIT_IMPLICIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_NO_REPLACE_OBJECTS",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_PREFIX",
+  "GIT_REPLACE_REF_BASE",
+  "GIT_SHALLOW_FILE",
+  "GIT_WORK_TREE"
+];
+function gitEnvForNamedRepo() {
+  const env = { ...process.env };
+  for (const name of REPOSITORY_LOCATING_GIT_VARS)
+    delete env[name];
+  return env;
+}
+function git(targetRepoRoot, args, stdin) {
   try {
     const out = execFileSync("git", ["-C", targetRepoRoot, ...args], {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      env: gitEnvForNamedRepo(),
+      ...stdin === void 0 ? {} : { input: stdin },
+      stdio: [stdin === void 0 ? "ignore" : "pipe", "pipe", "ignore"]
     });
     const trimmed = out.trim();
     return trimmed.length > 0 ? trimmed : null;
@@ -950,6 +1038,38 @@ function readRootCommit(targetRepoRoot) {
 function readRemote(targetRepoRoot) {
   return git(targetRepoRoot, ["remote", "get-url", "origin"]);
 }
+function readIgnoredPaths(targetRepoRoot, paths) {
+  if (paths.length === 0)
+    return null;
+  const out = git(targetRepoRoot, ["check-ignore", "-v", "-z", "--stdin"], paths.map((p) => `${p}\0`).join(""));
+  if (out === null)
+    return null;
+  const fields = out.split("\0");
+  if (fields[fields.length - 1] === "")
+    fields.pop();
+  if (fields.length % 4 !== 0)
+    return null;
+  const ignored = [];
+  for (let i = 0; i < fields.length; i += 4) {
+    const [source, line, pattern, path] = fields.slice(i, i + 4);
+    if (pattern.startsWith("!"))
+      continue;
+    const lineNumber = Number.parseInt(line, 10);
+    if (!Number.isFinite(lineNumber))
+      return null;
+    ignored.push({ path, pattern, source, line: lineNumber });
+  }
+  if (ignored.length === 0)
+    return null;
+  if (ignored.every((entry) => isAbsolute(entry.source)))
+    return ignored;
+  if (git(targetRepoRoot, ["rev-parse", "--show-prefix"]) === null)
+    return ignored;
+  const toplevel = git(targetRepoRoot, ["rev-parse", "--show-toplevel"]);
+  if (toplevel === null)
+    return null;
+  return ignored.map((entry) => isAbsolute(entry.source) ? entry : { ...entry, source: join3(toplevel, entry.source) });
+}
 function mintOrReadIdentity(targetRepoRoot) {
   const path = join3(targetRepoRoot, ".halfcycle", "project.json");
   if (existsSync(path)) {
@@ -1399,18 +1519,12 @@ var BUNDLE_PIN_REL = ".halfcycle/bundle.json";
 var PROJECT_IDENTITY_REL = ".halfcycle/project.json";
 var CREW_ROSTER_REL = ".halfcycle/crew.json";
 var CAPTURED_INDEX_REL = "test/fixtures/captured/manifest.json";
-var SETTINGS_REL = ".claude/settings.json";
 var GITIGNORE_REL = ".gitignore";
 function commandStubRel(name) {
   return `.claude/commands/${name}.md`;
 }
 var RETIRED_WRITE_SET_FILES = [];
-var RETIRED_HOOK_COMMANDS = [];
 var RETIRED_DENY_PATTERNS = [];
-function installerHookCommands() {
-  const settings = JSON.parse(generateSettingsJson());
-  return Object.values(settings.hooks ?? {}).flatMap((entries) => entries.flatMap((entry) => entry.hooks.map((h) => h.command)));
-}
 function closedWriteSet() {
   const files = /* @__PURE__ */ new Set([
     ...(readPluginManifest().commands ?? []).map((cmd) => commandStubRel(cmd.name)),
@@ -1436,7 +1550,7 @@ function closedWriteSet() {
     merged,
     dirs,
     ownedDirs,
-    hookCommands: /* @__PURE__ */ new Set([...installerHookCommands(), ...RETIRED_HOOK_COMMANDS]),
+    hookCommands: new Set(HALFCYCLE_HOOK_COMMANDS),
     denyRuleSha256: new Set([...DENY_PATTERNS, ...RETIRED_DENY_PATTERNS].map((rule) => sha256Hex(rule))),
     gitignoreLines: /* @__PURE__ */ new Set([GITIGNORE_HEADER, ...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL])
   };
@@ -1521,6 +1635,54 @@ function assertManifestInWriteSet(manifest, writeSet) {
     throw new Error(`[bundle install] the install record names paths outside the write set: ${strays.join(", ")}`);
   }
 }
+function findNotShared(targetRepo, manifest, collidedPaths) {
+  const merged = [
+    SETTINGS_REL,
+    ...manifest.mcp !== void 0 ? [MCP_REGISTRATION_REL] : [],
+    ...manifest.gitignore.created || manifest.gitignore.appended.length > 0 ? [GITIGNORE_REL] : []
+  ];
+  const collided = new Set(collidedPaths);
+  const dirVerdicts = /* @__PURE__ */ new Map();
+  const travelsThroughPlainDirs = (rel) => {
+    for (let dir = posix.dirname(rel); dir !== "."; dir = posix.dirname(dir)) {
+      let plain = dirVerdicts.get(dir);
+      if (plain === void 0) {
+        const abs = join5(targetRepo, dir);
+        plain = !lstatOrNull(abs)?.isSymbolicLink() && lstatOrNull(join5(abs, ".git")) === null;
+        dirVerdicts.set(dir, plain);
+      }
+      if (!plain)
+        return false;
+    }
+    return true;
+  };
+  const paths = [
+    .../* @__PURE__ */ new Set([
+      ...manifest.files.filter((f) => !("perMachine" in f)).map((f) => f.path),
+      ...merged,
+      INSTALL_MANIFEST_REL
+    ])
+  ].filter((rel) => !collided.has(rel)).filter((rel) => lstatOrNull(join5(targetRepo, rel)) !== null).filter(travelsThroughPlainDirs).sort();
+  const ignored = readIgnoredPaths(targetRepo, paths);
+  if (ignored === null)
+    return null;
+  const sorted = [...ignored].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const named = sorted.find((entry) => entry.path === SETTINGS_REL) ?? sorted[0];
+  return {
+    path: named.path,
+    pattern: named.pattern,
+    source: named.source,
+    line: named.line,
+    others: sorted.length - 1
+  };
+}
+function lstatOrNull(path) {
+  try {
+    return lstatSync(path);
+  } catch {
+    return null;
+  }
+}
 function isPlainObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1635,9 +1797,15 @@ var DENY_PATTERNS = [
   "Bash(git push --no-verify:*)",
   "Bash(git commit --no-verify:*)"
 ];
-var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
 var USER_PROMPT_REMINDER_SENTENCE = "Where this project stands, and what order to work in, is recorded in the Halfcycle service and nowhere in this repository \u2014 call halfcycle_resolve before you answer or plan, because the files here will look complete and current and still be wrong about position.";
 function generateSettingsJson() {
+  const hooks = {};
+  for (const { event, matcher, timeout, command } of HALFCYCLE_HOOK_WIRING) {
+    (hooks[event] ??= []).push({
+      ...matcher === null ? {} : { matcher },
+      hooks: [{ type: "command", command, timeout }]
+    });
+  }
   const settings = {
     $schema: "https://json.schemastore.org/claude-code-settings.json",
     permissions: {
@@ -1645,88 +1813,10 @@ function generateSettingsJson() {
       // and is the machine owner's grant to make, not ours.
       deny: [...DENY_PATTERNS]
     },
-    hooks: {
-      SessionStart: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/session-start-marker.sh",
-              timeout: 5
-            }
-          ]
-        },
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh refresh-credential",
-              timeout: 10
-            }
-          ]
-        }
-      ],
-      UserPromptSubmit: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/user-prompt-reminder.sh",
-              timeout: 5
-            }
-          ]
-        }
-      ],
-      PostToolUse: [
-        {
-          matcher: WRITE_CAPABLE_TOOLS.join("|"),
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook post-tool-use",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      Stop: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook stop",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      SubagentStop: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook subagent-stop",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      SessionEnd: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/session-end-marker.sh",
-              timeout: 5
-            }
-          ]
-        }
-      ]
-    }
+    hooks
   };
   return JSON.stringify(settings, null, 2) + "\n";
 }
-var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
 var GENERATED_GUARD_RUNNER_HEADER = "# Governance hook wrapper \u2014 generated by";
 function generateGuardRunnerWrapper() {
   return `#!/usr/bin/env bash
@@ -1948,14 +2038,16 @@ var CI_STANZA_KNOWN_HEADER_HASHES = [
 function isTrackedAndClean(targetRepo, relPath) {
   try {
     execFileSync2("git", ["-C", targetRepo, "ls-files", "--error-unmatch", "--", relPath], {
-      stdio: "ignore"
+      stdio: "ignore",
+      env: gitEnvForNamedRepo()
     });
   } catch {
     return false;
   }
   try {
     execFileSync2("git", ["-C", targetRepo, "diff", "--quiet", "HEAD", "--", relPath], {
-      stdio: "ignore"
+      stdio: "ignore",
+      env: gitEnvForNamedRepo()
     });
   } catch {
     return false;
@@ -2533,6 +2625,7 @@ async function install(options) {
   const installManifest = finishManifest(draft);
   assertManifestInWriteSet(installManifest, writeSet);
   recordOwned(report, join5(targetRepo, INSTALL_MANIFEST_REL), targetRepo, serializeManifest(installManifest), INSTALL_MANIFEST_REL);
+  const notShared = findNotShared(targetRepo, installManifest, report.collidedPaths);
   return {
     version: manifest.version,
     writtenPaths: report.writtenPaths,
@@ -2541,7 +2634,8 @@ async function install(options) {
     collidedPaths: report.collidedPaths,
     replacedPaths: report.replacedPaths,
     bootstrapScanRan: scanResult.ran,
-    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null
+    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null,
+    notShared
   };
 }
 
@@ -2722,7 +2816,7 @@ async function mintBoardEnterCode(baseUrl, sessionToken) {
 }
 
 // dist/setup/manifest.js
-import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync5, statSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname3, join as join6, posix as posix2 } from "node:path";
 var DECLARED_ROOT_FILES = ["CLAUDE.md", "AGENTS.md", "ENGAGEMENT.md"];
 var DECLARED_DIR_PREFIX = "docs";
@@ -2810,7 +2904,7 @@ function firstSymlinkOnPath(targetRepo, path) {
   for (let i = 0; i < segments.length; i++) {
     walked = join6(walked, segments[i]);
     try {
-      if (lstatSync(walked).isSymbolicLink())
+      if (lstatSync2(walked).isSymbolicLink())
         return segments.slice(0, i + 1).join("/");
     } catch {
       return null;
@@ -3280,7 +3374,7 @@ function parseCloseRecord(path, parsed) {
 
 // dist/build-record/write.js
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename, join as join9, resolve, relative as relative2, isAbsolute } from "node:path";
+import { basename, join as join9, resolve, relative as relative2, isAbsolute as isAbsolute2 } from "node:path";
 
 // dist/build-record/template.js
 function severityLabel(seed) {
@@ -3334,7 +3428,7 @@ function renderBuildRecordMarkdown(record2) {
     `- **Tools:** ${record2.delivered.tools.join(", ")}`,
     `- **Dogfood:** ${record2.delivered.dogfood}`,
     "",
-    guardsList ? `Guards evaluated (results only): ${guardsList}. *(What a guard reported about this phase is recorded; the guard's own definition and its history are not.)*` : "No guards fired during this phase.",
+    guardsList ? `Guards evaluated (results only): ${guardsList}. *(What a guard reported about this phase is recorded; the guard's own definition and its history are not.)*` : "No guard firing was recorded on this machine during this phase.",
     "",
     `## Acceptance (independent walk \u2014 walker ${record2.acceptance.walker})`,
     "",
@@ -3359,7 +3453,7 @@ function serialiseRecordJson(record2) {
 }
 function assertInsideOutDir(outDir, candidate, identity) {
   const rel = relative2(outDir, resolve(candidate));
-  const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute(rel) && rel === basename(rel);
+  const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute2(rel) && rel === basename(rel);
   if (!isPlainFilename) {
     throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
   }