mdkg 0.4.1 → 0.5.0

package/dist/commands/skill_mirror.js

@@ -12,6 +12,7 @@ exports.scaffoldMirrorRoots = scaffoldMirrorRoots;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const skills_indexer_1 = require("../graph/skills_indexer");
 const errors_1 = require("../util/errors");
 const MANIFEST_FILE = ".mdkg-managed.json";
@@ -29,7 +30,9 @@ function resolveMirrorTargets(root, config) {
     return configuredSkillMirrorTargets(config).map((configuredPath) => {
         const skillsRoot = path_1.default.join(root, configuredPath);
         return {
+            boundaryRoot: root,
             configuredPath,
+            relativeSkillsRoot: configuredPath.split(/[\\/]/).join("/"),
             rootDir: path_1.default.dirname(skillsRoot),
             skillsRoot,
             manifestPath: path_1.default.join(skillsRoot, MANIFEST_FILE),
@@ -37,17 +40,20 @@ function resolveMirrorTargets(root, config) {
     });
 }
 function readManifest(target) {
-    if (!fs_1.default.existsSync(target.manifestPath)) {
+    const relativeManifest = `${target.relativeSkillsRoot}/${MANIFEST_FILE}`;
+    if (!(0, filesystem_authority_1.containedPathExists)({ root: target.boundaryRoot, relativePath: relativeManifest })) {
         return new Set();
     }
     try {
-        const parsed = JSON.parse(fs_1.default.readFileSync(target.manifestPath, "utf8"));
+        const parsed = JSON.parse((0, filesystem_authority_1.readContainedFile)({ root: target.boundaryRoot, relativePath: relativeManifest }));
         if (!Array.isArray(parsed.managed_slugs)) {
             return new Set();
         }
-        return new Set(parsed.managed_slugs
-            .map((value) => String(value).trim().toLowerCase())
-            .filter(Boolean));
+        const slugs = parsed.managed_slugs.map((value) => String(value).trim().toLowerCase());
+        if (slugs.some((slug) => !skills_indexer_1.SKILL_SLUG_RE.test(slug))) {
+            return new Set();
+        }
+        return new Set(slugs);
     }
     catch {
         return new Set();
@@ -57,8 +63,8 @@ function writeManifest(target, managed) {
     const payload = {
         managed_slugs: Array.from(new Set(Array.from(managed).map((value) => value.toLowerCase()))).sort(),
     };
-    fs_1.default.mkdirSync(target.skillsRoot, { recursive: true });
-    fs_1.default.writeFileSync(target.manifestPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+    (0, filesystem_authority_1.ensureContainedDirectory)({ root: target.boundaryRoot, relativePath: target.relativeSkillsRoot });
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: target.boundaryRoot, relativePath: `${target.relativeSkillsRoot}/${MANIFEST_FILE}` }, `${JSON.stringify(payload, null, 2)}\n`);
 }
 function shouldCreateMirrorRoots(root, config) {
     if (MANAGED_ROOT_MARKERS.some((relPath) => fs_1.default.existsSync(path_1.default.join(root, relPath)))) {
@@ -250,30 +256,32 @@ function syncSkillMirrors(options) {
             continue;
         }
         touchedTargets += 1;
-        fs_1.default.mkdirSync(target.skillsRoot, { recursive: true });
-        const managed = readManifest(target);
-        for (const source of sources) {
-            const destDir = path_1.default.join(target.skillsRoot, source.slug);
-            const exists = fs_1.default.existsSync(destDir);
-            if (exists && !managed.has(source.slug) && !force) {
-                throw new errors_1.UsageError(`${path_1.default.relative(options.root, destDir)} already exists and is not mdkg-managed; rerun \`mdkg skill sync --force\` to replace it`);
+        (0, filesystem_authority_1.ensureContainedDirectory)({ root: options.root, relativePath: target.relativeSkillsRoot });
+        (0, filesystem_authority_1.withContainedTreeSink)({ root: options.root, relativePath: target.relativeSkillsRoot, operation: "replace" }, () => {
+            const managed = readManifest(target);
+            for (const source of sources) {
+                const destDir = path_1.default.join(target.skillsRoot, source.slug);
+                const exists = fs_1.default.existsSync(destDir);
+                if (exists && !managed.has(source.slug) && !force) {
+                    throw new errors_1.UsageError(`${path_1.default.relative(options.root, destDir)} already exists and is not mdkg-managed; rerun \`mdkg skill sync --force\` to replace it`);
+                }
+                materializeSkillMirror(source, destDir);
+                managed.add(source.slug);
+                synced += 1;
             }
-            materializeSkillMirror(source, destDir);
-            managed.add(source.slug);
-            synced += 1;
-        }
-        for (const slug of Array.from(managed)) {
-            if (sources.some((source) => source.slug === slug)) {
-                continue;
-            }
-            const destDir = path_1.default.join(target.skillsRoot, slug);
-            if (fs_1.default.existsSync(destDir)) {
-                fs_1.default.rmSync(destDir, { recursive: true, force: true });
-                pruned += 1;
+            for (const slug of Array.from(managed)) {
+                if (sources.some((source) => source.slug === slug)) {
+                    continue;
+                }
+                const destDir = path_1.default.join(target.skillsRoot, slug);
+                if (fs_1.default.existsSync(destDir)) {
+                    fs_1.default.rmSync(destDir, { recursive: true, force: true });
+                    pruned += 1;
+                }
+                managed.delete(slug);
             }
-            managed.delete(slug);
-        }
-        writeManifest(target, managed);
+            writeManifest(target, managed);
+        });
     }
     return { synced, pruned, targets: touchedTargets };
 }
@@ -342,8 +350,8 @@ function auditSkillMirrors(root, config) {
 }
 function scaffoldMirrorRoots(root, config) {
     for (const target of resolveMirrorTargets(root, config)) {
-        fs_1.default.mkdirSync(target.skillsRoot, { recursive: true });
-        if (!fs_1.default.existsSync(target.manifestPath)) {
+        (0, filesystem_authority_1.ensureContainedDirectory)({ root, relativePath: target.relativeSkillsRoot });
+        if (!(0, filesystem_authority_1.containedPathExists)({ root, relativePath: `${target.relativeSkillsRoot}/${MANIFEST_FILE}` })) {
             writeManifest(target, []);
         }
     }

package/dist/commands/subgraph.js

@@ -19,6 +19,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const migrate_1 = require("../core/migrate");
 const workspace_path_1 = require("../core/workspace_path");
 const subgraphs_1 = require("../graph/subgraphs");
@@ -35,6 +36,9 @@ function normalizeAlias(alias) {
     if (alias === "all") {
         throw new errors_1.UsageError("subgraph alias cannot be 'all'");
     }
+    if (alias === "__proto__" || alias === "constructor" || alias === "prototype") {
+        throw new errors_1.UsageError(`subgraph alias is reserved: ${alias}`);
+    }
     if (alias !== alias.toLowerCase() || !ALIAS_RE.test(alias)) {
         throw new errors_1.UsageError("subgraph alias must be lowercase and use [a-z0-9_]");
     }
@@ -674,10 +678,12 @@ function inspectSourcePath(root, alias, subgraph, allowDirty) {
         throw new errors_1.UsageError(`subgraph ${alias} is missing source_path`);
     }
     const sourcePath = normalizeContained(subgraph.source_path, `subgraphs.${alias}.source_path`);
-    const sourceRoot = path_1.default.resolve(root, sourcePath);
-    if (!fs_1.default.existsSync(sourceRoot) || !fs_1.default.statSync(sourceRoot).isDirectory()) {
-        throw new errors_1.NotFoundError(`subgraph ${alias} source_path does not exist: ${sourcePath}`);
-    }
+    const sourceRoot = (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath: sourcePath, operation: "read" }, ({ absolutePath }) => {
+        if (!fs_1.default.existsSync(absolutePath) || !fs_1.default.lstatSync(absolutePath).isDirectory()) {
+            throw new errors_1.NotFoundError(`subgraph ${alias} source_path does not exist: ${sourcePath}`);
+        }
+        return absolutePath;
+    });
     const gitTop = gitRun(sourceRoot, ["rev-parse", "--show-toplevel"]);
     const gitTopPath = gitTop.stdout.trim();
     if (!gitTop.ok || !gitTopPath) {
@@ -774,13 +780,34 @@ function syncOneAlias(options) {
     const planned = [];
     for (const source of activeSources) {
         const outputPath = path_1.default.resolve(options.root, source.path);
+        let oldBundleHash;
+        let oldZipSha256;
+        try {
+            (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: source.path, operation: "replace", createParents: true }, ({ absolutePath }) => {
+                oldBundleHash = existingBundleHash(absolutePath);
+                oldZipSha256 = fs_1.default.existsSync(absolutePath) ? (0, bundle_1.sha256Buffer)(fs_1.default.readFileSync(absolutePath)) : undefined;
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            sources.push({
+                label: source.label,
+                path: source.path,
+                enabled: source.enabled,
+                expected_profile: source.expected_profile,
+                warnings: [],
+                errors: [message],
+            });
+            errors.push(`source ${source.path}: ${message}`);
+            continue;
+        }
         const sourceReceipt = {
             label: source.label,
             path: source.path,
             enabled: source.enabled,
             expected_profile: source.expected_profile,
-            old_bundle_hash: existingBundleHash(outputPath),
-            old_zip_sha256: fs_1.default.existsSync(outputPath) ? (0, bundle_1.sha256Buffer)(fs_1.default.readFileSync(outputPath)) : undefined,
+            old_bundle_hash: oldBundleHash,
+            old_zip_sha256: oldZipSha256,
             warnings: [],
             errors: [],
         };
@@ -821,7 +848,7 @@ function syncOneAlias(options) {
     for (const item of planned) {
         const sourceReceipt = sources.find((source) => source.path === item.source.path);
         try {
-            (0, atomic_1.atomicWriteFile)(item.outputPath, item.zip);
+            (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: relativeToRoot(options.root, item.outputPath) }, item.zip);
             const verify = (0, bundle_1.verifyBundle)(gitState.sourceRoot, item.outputPath);
             sourceReceipt.verified = verify.ok;
             if (!verify.ok) {
@@ -902,11 +929,11 @@ function safeZipEntryPath(entryName) {
     }
     return normalized;
 }
-function writeMaterializeGitignore(targetRoot) {
-    const gitignorePath = path_1.default.join(targetRoot, ".gitignore");
+function writeMaterializeGitignore(root, targetRoot) {
+    const gitignoreRelative = relativeToRoot(root, path_1.default.join(targetRoot, ".gitignore"));
     const required = ["*", "!.gitignore"];
-    const existing = fs_1.default.existsSync(gitignorePath)
-        ? fs_1.default.readFileSync(gitignorePath, "utf8").split(/\r?\n/)
+    const existing = (0, filesystem_authority_1.containedPathExists)({ root, relativePath: gitignoreRelative })
+        ? (0, filesystem_authority_1.readContainedFile)({ root, relativePath: gitignoreRelative }, "utf8").split(/\r?\n/)
         : [];
     const lines = existing.filter((line) => line.length > 0);
     for (const line of required) {
@@ -914,13 +941,21 @@ function writeMaterializeGitignore(targetRoot) {
             lines.push(line);
         }
     }
-    (0, atomic_1.atomicWriteFile)(gitignorePath, `${lines.join("\n")}\n`);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: gitignoreRelative }, `${lines.join("\n")}\n`);
 }
 function materializeOneAlias(options) {
     const enabled = enabledSources(options.subgraph);
     const errors = [];
     const warnings = [];
     const outputDir = path_1.default.join(options.targetRoot, options.alias);
+    const outputRelative = relativeToRoot(options.root, outputDir);
+    try {
+        (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: outputRelative, operation: "replace", createParents: true }, () => undefined);
+    }
+    catch (error) {
+        errors.push(error instanceof Error ? error.message : String(error));
+        return { alias: options.alias, ok: false, output_path: outputRelative, warnings, errors };
+    }
     if (enabled.length !== 1) {
         errors.push(`materialize requires exactly one enabled source for ${options.alias}; found ${enabled.length}`);
         return { alias: options.alias, ok: false, output_path: relativeToRoot(options.root, outputDir), warnings, errors };
@@ -943,15 +978,14 @@ function materializeOneAlias(options) {
         }
     }
     const tempDir = path_1.default.join(options.targetRoot, `.${options.alias}.${process.pid}.${Date.now()}.tmp`);
-    fs_1.default.rmSync(tempDir, { recursive: true, force: true });
+    const tempRelative = relativeToRoot(options.root, tempDir);
+    (0, filesystem_authority_1.removeContainedPath)({ root: options.root, relativePath: tempRelative, recursive: true, force: true });
     try {
-        const parsed = (0, bundle_1.parseBundle)(bundlePath);
-        fs_1.default.mkdirSync(tempDir, { recursive: true });
+        const parsed = (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: source.path, operation: "read" }, ({ absolutePath }) => (0, bundle_1.parseBundle)(absolutePath));
+        (0, filesystem_authority_1.ensureContainedDirectory)({ root: options.root, relativePath: tempRelative });
         for (const [entryName, data] of parsed.entries.entries()) {
             const safeName = safeZipEntryPath(entryName);
-            const target = path_1.default.join(tempDir, safeName);
-            fs_1.default.mkdirSync(path_1.default.dirname(target), { recursive: true });
-            fs_1.default.writeFileSync(target, data);
+            (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath: `${tempRelative}/${safeName}` }, data);
         }
         const marker = {
             tool: "mdkg",
@@ -959,19 +993,18 @@ function materializeOneAlias(options) {
             alias: options.alias,
             bundle_path: source.path,
             bundle_hash: parsed.manifest.bundle_hash,
-            zip_sha256: (0, bundle_1.sha256Buffer)(fs_1.default.readFileSync(bundlePath)),
+            zip_sha256: (0, bundle_1.sha256Buffer)((0, filesystem_authority_1.readContainedFile)({ root: options.root, relativePath: source.path }, null)),
             profile: parsed.manifest.profile,
             source_repo: options.subgraph.source_repo ?? parsed.manifest.source.repo,
             source_git_head: parsed.manifest.source.git_head,
             generated_at: new Date().toISOString(),
             mdkg_version: readPackageVersion(),
         };
-        fs_1.default.writeFileSync(path_1.default.join(tempDir, ".mdkg-materialized.json"), `${JSON.stringify(marker, null, 2)}\n`, "utf8");
+        (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath: `${tempRelative}/.mdkg-materialized.json` }, `${JSON.stringify(marker, null, 2)}\n`);
         if (fs_1.default.existsSync(outputDir)) {
-            fs_1.default.rmSync(outputDir, { recursive: true, force: true });
+            (0, filesystem_authority_1.removeContainedPath)({ root: options.root, relativePath: outputRelative, recursive: true, force: true });
         }
-        fs_1.default.mkdirSync(path_1.default.dirname(outputDir), { recursive: true });
-        fs_1.default.renameSync(tempDir, outputDir);
+        (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: outputRelative, operation: "replace", createParents: true }, ({ absolutePath: safeOutput }) => (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: tempRelative, operation: "read" }, ({ absolutePath: safeTemp }) => fs_1.default.renameSync(safeTemp, safeOutput)));
         return {
             alias: options.alias,
             ok: true,
@@ -984,7 +1017,7 @@ function materializeOneAlias(options) {
         };
     }
     catch (err) {
-        fs_1.default.rmSync(tempDir, { recursive: true, force: true });
+        (0, filesystem_authority_1.removeContainedPath)({ root: options.root, relativePath: tempRelative, recursive: true, force: true });
         errors.push(err instanceof Error ? err.message : String(err));
         return { alias: options.alias, ok: false, output_path: relativeToRoot(options.root, outputDir), warnings, errors };
     }
@@ -1002,8 +1035,8 @@ function runSubgraphMaterializeCommand(options) {
             clean: Boolean(options.clean),
         }));
         if (options.gitignore) {
-            fs_1.default.mkdirSync(targetRoot, { recursive: true });
-            writeMaterializeGitignore(targetRoot);
+            (0, filesystem_authority_1.ensureContainedDirectory)({ root: options.root, relativePath: relativeToRoot(options.root, targetRoot) });
+            writeMaterializeGitignore(options.root, targetRoot);
         }
         const ok = results.every((item) => item.ok === true);
         const receipt = {

package/dist/commands/task.js

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runTaskStartCommand = runTaskStartCommand;
 exports.runTaskUpdateCommand = runTaskUpdateCommand;
 exports.runTaskDoneCommand = runTaskDoneCommand;
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const indexer_1 = require("../graph/indexer");
 const index_cache_1 = require("../graph/index_cache");
 const reindex_1 = require("../graph/reindex");
@@ -18,7 +18,6 @@ const date_1 = require("../util/date");
 const errors_1 = require("../util/errors");
 const qid_1 = require("../util/qid");
 const id_1 = require("../util/id");
-const atomic_1 = require("../util/atomic");
 const lock_1 = require("../util/lock");
 const event_support_1 = require("./event_support");
 const checkpoint_1 = require("./checkpoint");
@@ -66,6 +65,75 @@ function normalizeIdList(raw, flag) {
 function normalizeIdRefList(raw, flag) {
     return parseCsvList(raw).map((value) => normalizeIdRef(value, flag));
 }
+function taskCompletionCheckpointBody(loaded, artifacts, note) {
+    const title = typeof loaded.frontmatter.title === "string" ? loaded.frontmatter.title : loaded.id;
+    const artifactLines = artifacts.length > 0
+        ? artifacts.map((artifact) => `- ${artifact}`)
+        : ["- No artifacts were attached by the completion command."];
+    return [
+        "# Summary",
+        "",
+        note?.trim() || `${loaded.id} was marked done through the mdkg task lifecycle.`,
+        "",
+        "# Scope Covered",
+        "",
+        `- Completed node: ${loaded.id} (${title})`,
+        `- Node type: ${loaded.type}`,
+        "- Checkpoint source: `mdkg task done --checkpoint`",
+        "",
+        "## Changed Surfaces",
+        "",
+        `- Completed work node: ${loaded.id}`,
+        "- Attached artifacts are listed in checkpoint frontmatter and below.",
+        "",
+        "## Boundaries",
+        "",
+        "- in scope: structured task completion and checkpoint evidence",
+        "- out of scope: unrelated graph, runtime, provider, or release mutations",
+        "- raw secrets, raw prompts, raw payloads, and bulky execution traces excluded",
+        "",
+        "# Decisions Captured",
+        "",
+        "- See decision and approval refs on the completed node and checkpoint frontmatter.",
+        "",
+        "# Implementation Summary",
+        "",
+        `- Completion of ${loaded.id} was recorded through the structured task lifecycle.`,
+        "- Detailed implementation or test evidence remains on the completed node and linked refs.",
+        "",
+        "# Verification / Testing",
+        "",
+        "## Command Evidence",
+        "",
+        "- command: `mdkg task done --checkpoint`",
+        "- result: completed node and evidence checkpoint written",
+        "",
+        "## Pass / Fail Status",
+        "",
+        "- status: done",
+        "",
+        "## Known Warnings",
+        "",
+        "- warning: none recorded by the completion command",
+        "",
+        "# Known Issues / Follow-ups",
+        "",
+        "- Inspect the completed node and linked refs for any explicitly recorded residual work.",
+        "",
+        "## Follow-up Refs",
+        "",
+        "- task/test/goal refs: inspect the completed node and checkpoint frontmatter",
+        "",
+        "# Links / Artifacts",
+        "",
+        ...artifactLines,
+        "",
+        "# Raw Content Safety",
+        "",
+        "- This checkpoint stores the completion summary and artifact refs, not raw prompts, secrets, payloads, or bulky traces.",
+        "",
+    ].join("\n");
+}
 function normalizeSkillList(raw) {
     return parseCsvList(raw).map((value) => {
         const normalized = value.toLowerCase();
@@ -116,7 +184,7 @@ function loadMutableTaskNode(root, idOrQid, wsHint) {
         throw new errors_1.UsageError(`mdkg task only supports feat, task, bug, test, and spike nodes; use markdown editing for ${node.type}:${node.id}`);
     }
     const filePath = path_1.default.resolve(root, node.path);
-    const content = fs_1.default.readFileSync(filePath, "utf8");
+    const content = (0, filesystem_authority_1.readContainedFile)({ root, relativePath: node.path });
     const parsed = (0, frontmatter_1.parseFrontmatter)(content, filePath);
     return {
         config,
@@ -134,7 +202,7 @@ function writeNodeFile(root, filePath, frontmatter, body) {
     const lines = (0, frontmatter_1.formatFrontmatter)(frontmatter, frontmatter_1.DEFAULT_FRONTMATTER_KEY_ORDER);
     const frontmatterBlock = ["---", ...lines, "---"].join("\n");
     const content = body.length > 0 ? `${frontmatterBlock}\n${body}` : frontmatterBlock;
-    (0, atomic_1.atomicWriteFile)(filePath, content);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: path_1.default.relative(root, filePath).split(path_1.default.sep).join("/") }, content);
 }
 function ensureStatusAllowed(config, statusRaw, flag = "--status") {
     const normalized = statusRaw.trim().toLowerCase();
@@ -290,6 +358,7 @@ function runTaskDoneCommandLocked(options) {
         now,
     });
     let checkpoint;
+    const checkpointBody = taskCompletionCheckpointBody(loaded, nextArtifacts, options.note);
     if (options.checkpoint && options.json) {
         checkpoint = (0, checkpoint_1.createCheckpoint)({
             root: options.root,
@@ -298,6 +367,8 @@ function runTaskDoneCommandLocked(options) {
             relates: loaded.id,
             scope: loaded.id,
             kind: options.checkpointKind,
+            status: "done",
+            body: checkpointBody,
             runId: options.runId,
             note: `checkpoint created from mdkg task done for ${loaded.id}`,
             now,
@@ -311,6 +382,8 @@ function runTaskDoneCommandLocked(options) {
             relates: loaded.id,
             scope: loaded.id,
             kind: options.checkpointKind,
+            status: "done",
+            body: checkpointBody,
             runId: options.runId,
             note: `checkpoint created from mdkg task done for ${loaded.id}`,
             now,

package/dist/commands/upgrade.js

@@ -9,6 +9,7 @@ const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const migrate_1 = require("../core/migrate");
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const paths_1 = require("../core/paths");
 const version_1 = require("../core/version");
 const project_db_1 = require("../core/project_db");
@@ -16,7 +17,6 @@ const errors_1 = require("../util/errors");
 const frontmatter_1 = require("../graph/frontmatter");
 const workspace_files_1 = require("../graph/workspace_files");
 const agent_file_types_1 = require("../graph/agent_file_types");
-const atomic_1 = require("../util/atomic");
 const init_manifest_1 = require("./init_manifest");
 const skill_support_1 = require("./skill_support");
 const skill_mirror_1 = require("./skill_mirror");
@@ -58,13 +58,11 @@ function isAgentWorkspace(root, config) {
         ...(0, skill_mirror_1.configuredSkillMirrorTargets)(config).map((target) => path_1.default.join(root, target)),
     ].some((candidate) => fs_1.default.existsSync(candidate));
 }
-function copyFile(src, dest) {
-    fs_1.default.mkdirSync(path_1.default.dirname(dest), { recursive: true });
-    fs_1.default.copyFileSync(src, dest);
+function copyFile(root, src, dest) {
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: repoRelativePath(root, dest) }, fs_1.default.readFileSync(src));
 }
-function writeFile(filePath, content) {
-    fs_1.default.mkdirSync(path_1.default.dirname(filePath), { recursive: true });
-    fs_1.default.writeFileSync(filePath, content, "utf8");
+function writeFile(root, filePath, content) {
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: repoRelativePath(root, filePath) }, content);
 }
 function repoRelativePath(root, filePath) {
     return path_1.default.relative(root, filePath).split(path_1.default.sep).join("/");
@@ -142,7 +140,7 @@ function planSeedFile(options) {
             reason: "missing managed init asset",
         });
         if (!options.dryRun) {
-            copyFile(srcPath, destPath);
+            copyFile(options.root, srcPath, destPath);
         }
         options.managedCurrentFiles.push(options.file);
         return true;
@@ -165,7 +163,7 @@ function planSeedFile(options) {
             reason: "matches a managed seed hash",
         });
         if (!options.dryRun) {
-            copyFile(srcPath, destPath);
+            copyFile(options.root, srcPath, destPath);
         }
         options.managedCurrentFiles.push(options.file);
         return true;
@@ -295,7 +293,7 @@ function migrateConfigIfNeeded(root, dryRun, summary, changes) {
         reason: reasons.join(" and "),
     });
     if (!dryRun) {
-        writeFile(cfgPath, `${JSON.stringify(customizationConfig.config, null, 2)}\n`);
+        writeFile(root, cfgPath, `${JSON.stringify(customizationConfig.config, null, 2)}\n`);
     }
 }
 function sameStringArray(left, right) {
@@ -369,7 +367,7 @@ function migrateClosedGoalActiveNodes(root, dryRun, summary, changes) {
                     frontmatter.last_active_node = activeNode;
                 }
                 delete frontmatter.active_node;
-                writeFile(filePath, renderFrontmatterDocument(frontmatter, parsed.body.length > 0 ? parsed.body : ""));
+                writeFile(root, filePath, renderFrontmatterDocument(frontmatter, parsed.body.length > 0 ? parsed.body : ""));
             }
         }
     }
@@ -420,8 +418,8 @@ function migrateLegacySpecManifests(root, dryRun, summary, changes) {
             });
             if (!dryRun) {
                 const frontmatter = { ...parsed.frontmatter, type: "manifest" };
-                (0, atomic_1.atomicWriteFile)(filePath, renderFrontmatterDocument(frontmatter, parsed.body));
-                fs_1.default.renameSync(filePath, targetPath);
+                (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: repoRelativePath(root, filePath) }, renderFrontmatterDocument(frontmatter, parsed.body));
+                (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath: repoRelativePath(root, targetPath), operation: "create", createParents: true }, ({ absolutePath: safeTarget }) => (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath: repoRelativePath(root, filePath), operation: "delete" }, ({ absolutePath: safeSource }) => fs_1.default.renameSync(safeSource, safeTarget)));
             }
         }
     }
@@ -487,7 +485,7 @@ function ensureAgentRuntimeFiles(root, dryRun, summary, changes) {
             reason: "agent workspace is missing event log",
         });
         if (!dryRun) {
-            writeFile(eventsPath, seededInitEvent(new Date().toISOString()));
+            writeFile(root, eventsPath, seededInitEvent(new Date().toISOString()));
         }
     }
     else {
@@ -512,7 +510,7 @@ function ensureArchiveIgnorePolicy(root, dryRun, summary, changes) {
     });
     if (!dryRun) {
         const suffix = raw.length === 0 || raw.endsWith("\n") ? "" : "\n";
-        writeFile(ignorePath, `${raw}${suffix}${additions.join("\n")}\n`);
+        writeFile(root, ignorePath, `${raw}${suffix}${additions.join("\n")}\n`);
     }
 }
 function isWritableChange(change) {

package/dist/commands/validate.js

@@ -208,20 +208,33 @@ function collectContractProfileErrors(qid, node, profile) {
     return errors;
 }
 function collectChangedPaths(root) {
-    const result = (0, child_process_1.spawnSync)("git", ["-C", root, "status", "--porcelain", "--", ".mdkg"], {
+    const result = (0, child_process_1.spawnSync)("git", ["-C", root, "status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ".mdkg"], {
         encoding: "utf8",
     });
     if (result.status !== 0) {
-        return new Set();
+        const detail = result.stderr.trim();
+        throw new errors_1.ValidationError(`changed-only validation could not enumerate Git paths${detail ? `: ${detail}` : ""}`);
     }
     const changed = new Set();
-    for (const line of result.stdout.split(/\r?\n/)) {
-        if (!line.trim()) {
+    const records = result.stdout.split("\0");
+    for (let index = 0; index < records.length; index += 1) {
+        const record = records[index];
+        if (!record) {
             continue;
         }
-        const rawPath = line.slice(3).trim();
-        const filePath = rawPath.includes(" -> ") ? rawPath.split(" -> ").pop() ?? rawPath : rawPath;
-        changed.add(filePath.replace(/\\/g, "/"));
+        if (record.length < 4 || record[2] !== " ") {
+            throw new errors_1.ValidationError("changed-only validation received malformed Git status output");
+        }
+        const status = record.slice(0, 2);
+        changed.add(record.slice(3).replace(/\\/g, "/"));
+        if (status.includes("R") || status.includes("C")) {
+            const sourcePath = records[index + 1];
+            if (!sourcePath) {
+                throw new errors_1.ValidationError("changed-only validation received an incomplete Git rename record");
+            }
+            changed.add(sourcePath.replace(/\\/g, "/"));
+            index += 1;
+        }
     }
     return changed;
 }