mdkg 0.4.2 → 0.5.1

package/dist/commands/event_support.js

@@ -12,9 +12,10 @@ exports.normalizeEventRefList = normalizeEventRefList;
 exports.normalizeEventStringList = normalizeEventStringList;
 exports.appendEvent = appendEvent;
 exports.appendAutomaticEvent = appendAutomaticEvent;
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
+const workspace_path_1 = require("../core/workspace_path");
 const errors_1 = require("../util/errors");
 function normalizeWorkspaceForEvents(config, raw) {
     const normalized = (raw ?? "root").toLowerCase();
@@ -33,6 +34,13 @@ function resolveEventsPath(root, config, ws = "root") {
     }
     return path_1.default.resolve(root, entry.path, entry.mdkg_dir, "work", "events", "events.jsonl");
 }
+function resolveEventsRelativePath(config, ws) {
+    const entry = config.workspaces[ws];
+    if (!entry) {
+        throw new errors_1.NotFoundError(`workspace not found: ${ws}`);
+    }
+    return (0, workspace_path_1.workspaceDocumentRelativePath)(entry.path, entry.mdkg_dir, "work", "events", "events.jsonl");
+}
 function formatRunIdTimestamp(now) {
     const iso = now.toISOString().replace(/[-:]/g, "").replace(/\./g, "").replace("Z", "Z");
     return iso;
@@ -43,16 +51,16 @@ function createLocalRunId(kind, now = new Date()) {
 }
 function isEventLoggingEnabled(root, config, ws) {
     const normalizedWs = normalizeWorkspaceForEvents(config, ws);
-    return fs_1.default.existsSync(resolveEventsPath(root, config, normalizedWs));
+    return (0, filesystem_authority_1.containedPathExists)({ root, relativePath: resolveEventsRelativePath(config, normalizedWs) });
 }
 function ensureEventsEnabled(options) {
     const config = (0, config_1.loadConfig)(options.root);
     const ws = normalizeWorkspaceForEvents(config, options.ws);
     const eventsPath = resolveEventsPath(options.root, config, ws);
+    const relativePath = resolveEventsRelativePath(config, ws);
     let created = false;
-    if (!fs_1.default.existsSync(eventsPath)) {
-        fs_1.default.mkdirSync(path_1.default.dirname(eventsPath), { recursive: true });
-        fs_1.default.writeFileSync(eventsPath, "", "utf8");
+    if (!(0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath })) {
+        (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath }, "");
         created = true;
     }
     return { ws, eventsPath, created };
@@ -102,10 +110,11 @@ function appendEvent(options) {
         throw new errors_1.UsageError("--refs requires at least one id or qid");
     }
     const eventsPath = resolveEventsPath(options.root, config, record.workspace);
-    if (!fs_1.default.existsSync(eventsPath)) {
+    const relativePath = resolveEventsRelativePath(config, record.workspace);
+    if (!(0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath })) {
         throw new errors_1.NotFoundError(`events.jsonl is missing for workspace ${record.workspace}; run \`mdkg event enable --ws ${record.workspace}\``);
     }
-    fs_1.default.appendFileSync(eventsPath, `${JSON.stringify(record)}\n`, "utf8");
+    (0, filesystem_authority_1.appendContainedFile)({ root: options.root, relativePath }, `${JSON.stringify(record)}\n`);
     return record;
 }
 function appendAutomaticEvent(options) {

package/dist/commands/fix.js

@@ -13,6 +13,7 @@ const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const capabilities_indexer_1 = require("../graph/capabilities_indexer");
 const capabilities_index_cache_1 = require("../graph/capabilities_index_cache");
 const staleness_1 = require("../graph/staleness");
@@ -26,7 +27,6 @@ const template_schema_1 = require("../graph/template_schema");
 const workspace_files_1 = require("../graph/workspace_files");
 const errors_1 = require("../util/errors");
 const refs_1 = require("../util/refs");
-const atomic_1 = require("../util/atomic");
 const lock_1 = require("../util/lock");
 const index_1 = require("./index");
 const FAMILY_VALUES = new Set(["index", "refs", "ids", "all"]);
@@ -1211,12 +1211,12 @@ function applyDuplicateIdChange(root, change) {
     if (!fromId || !toId) {
         throw new errors_1.UsageError(`fix apply change ${change.id} is missing duplicate id rewrite details`);
     }
-    const current = fs_1.default.readFileSync(absPath, "utf8");
+    const current = (0, filesystem_authority_1.readContainedFile)({ root, relativePath });
     const rewritten = rewriteIdInNodeContent(current, fromId, toId);
     if (rewritten === current) {
         throw new errors_1.UsageError(`fix apply change ${change.id} produced no file changes`);
     }
-    (0, atomic_1.atomicWriteFile)(absPath, rewritten);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath }, rewritten);
     const afterDetails = change.after;
     const safeReferenceRewrites = Array.isArray(afterDetails.safe_reference_rewrites)
         ? afterDetails.safe_reference_rewrites
@@ -1227,13 +1227,13 @@ function applyDuplicateIdChange(root, change) {
             continue;
         }
         const rewriteAbs = path_1.default.resolve(root, rewrite.path);
-        if (!isInsideRoot(root, rewriteAbs) || !fs_1.default.existsSync(rewriteAbs)) {
+        if (!isInsideRoot(root, rewriteAbs) || !(0, filesystem_authority_1.containedPathExists)({ root, relativePath: rewrite.path })) {
             continue;
         }
-        const rewriteCurrent = fs_1.default.readFileSync(rewriteAbs, "utf8");
+        const rewriteCurrent = (0, filesystem_authority_1.readContainedFile)({ root, relativePath: rewrite.path });
         const rewriteNext = rewriteCurrent.split(rewrite.from).join(rewrite.to);
         if (rewriteNext !== rewriteCurrent) {
-            (0, atomic_1.atomicWriteFile)(rewriteAbs, rewriteNext);
+            (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: rewrite.path }, rewriteNext);
             touchedPaths.add(rewrite.path);
         }
     }
@@ -1273,8 +1273,11 @@ function applyGitStageDuplicateIdChange(root, change) {
         throw new errors_1.UsageError(`fix apply refused path outside repo while resolving ${conflictPath}`);
     }
     const rewrittenDuplicate = rewriteIdInNodeContent(duplicateContent, fromId, candidateId);
-    (0, atomic_1.atomicWriteFile)(canonicalAbs, canonicalContent);
-    (0, atomic_1.atomicWriteFile)(candidateAbs, rewrittenDuplicate);
+    for (const relativePath of [conflictPath, candidatePath]) {
+        (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath, operation: "replace", createParents: true }, () => undefined);
+    }
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: conflictPath }, canonicalContent);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: candidatePath }, rewrittenDuplicate);
     runGitStrict(root, ["add", "--", conflictPath, candidatePath]);
     return {
         id: change.id,

package/dist/commands/git.js

@@ -14,10 +14,10 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const project_db_1 = require("../core/project_db");
 const project_db_snapshot_1 = require("../core/project_db_snapshot");
 const validate_1 = require("./validate");
-const atomic_1 = require("../util/atomic");
 const lock_1 = require("../util/lock");
 const errors_1 = require("../util/errors");
 function toPosix(value) {
@@ -75,6 +75,22 @@ function assertNoEmbeddedCredentials(label, value) {
         throw new errors_1.UsageError(`${label} must not contain embedded credentials; use SSH, credential helpers, gh auth, CI env, or shell-managed Git auth`);
     }
 }
+function assertGitOperand(label, value) {
+    if (value.length === 0 || value !== value.trim() || value.startsWith("-") || /[\0\r\n\t ]/.test(value)) {
+        throw new errors_1.UsageError(`${label} must be a non-option Git operand without whitespace or control characters`);
+    }
+}
+function assertGitBranch(root, branch) {
+    assertGitOperand("--branch", branch);
+    const result = (0, child_process_1.spawnSync)("git", ["check-ref-format", "--branch", branch], {
+        cwd: root,
+        encoding: "utf8",
+        stdio: "pipe",
+    });
+    if (result.status !== 0) {
+        throw new errors_1.UsageError(`--branch is not a valid Git branch name: ${branch}`);
+    }
+}
 function sanitizeOutput(value) {
     return value
         .split(/\r?\n/)
@@ -234,15 +250,22 @@ function runGitInspectCommand(options) {
 }
 function runGitCloneCommand(options) {
     assertNoEmbeddedCredentials("repository", options.repository);
-    const target = containedPath(options.root, options.target, "--target");
-    if (fs_1.default.existsSync(target) && fs_1.default.readdirSync(target).length > 0) {
-        throw new errors_1.UsageError("--target must be empty or absent");
+    assertGitOperand("repository", options.repository);
+    if (options.branch) {
+        assertGitBranch(options.root, options.branch);
     }
+    const target = containedPath(options.root, options.target, "--target");
+    const targetRelative = rel(options.root, target);
+    (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: targetRelative, operation: "create" }, ({ absolutePath }) => {
+        if (fs_1.default.existsSync(absolutePath) && fs_1.default.readdirSync(absolutePath).length > 0) {
+            throw new errors_1.UsageError("--target must be empty or absent");
+        }
+    });
     const args = ["clone"];
     if (options.branch) {
         args.push("--branch", options.branch);
     }
-    args.push(options.repository, target);
+    args.push("--", options.repository, target);
     git(options.root, args);
     const inspect = collectInspectReceipt(target);
     const receipt = {
@@ -273,12 +296,16 @@ function runGitCloneCommand(options) {
 function runGitFetchCommand(options) {
     requireGitWorkTree(options.root);
     const remote = options.remote ?? "origin";
+    assertGitOperand("--remote", remote);
+    if (options.branch) {
+        assertGitBranch(options.root, options.branch);
+    }
     assertNoEmbeddedCredentials("--remote", remote);
     const configuredRemoteUrl = rawRemoteUrl(options.root, remote);
     if (configuredRemoteUrl && hasEmbeddedUrlCredentials(configuredRemoteUrl)) {
         throw new errors_1.UsageError(`remote ${remote} must not contain embedded credentials; use external Git auth`);
     }
-    const args = ["fetch", remote];
+    const args = ["fetch", "--", remote];
     if (options.branch) {
         args.push(options.branch);
     }
@@ -382,7 +409,7 @@ function collectCloseoutReceipt(options) {
     else {
         warnings.push("project DB did not participate in this closeout; no DB snapshot was sealed");
     }
-    fs_1.default.mkdirSync(outputDir, { recursive: true });
+    (0, filesystem_authority_1.ensureContainedDirectory)({ root: options.root, relativePath: outputRel });
     const baseReceipt = {
         action: "git.closeout",
         ok: true,
@@ -406,8 +433,8 @@ function collectCloseoutReceipt(options) {
             markdown: rel(options.root, markdownPath),
         },
     };
-    (0, atomic_1.atomicWriteFile)(jsonPath, stableJson(receipt));
-    (0, atomic_1.atomicWriteFile)(markdownPath, closeoutMarkdown(baseReceipt));
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: rel(options.root, jsonPath) }, stableJson(receipt));
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: rel(options.root, markdownPath) }, closeoutMarkdown(baseReceipt));
     return receipt;
 }
 function runGitCloseoutCommand(options) {
@@ -443,6 +470,8 @@ function collectPushReadyReceipt(options) {
     if (!branch) {
         throw new errors_1.UsageError("mdkg git push-ready requires --branch <name>");
     }
+    assertGitOperand("--remote", remote);
+    assertGitBranch(options.root, branch);
     assertNoEmbeddedCredentials("--remote", remote);
     requireGitWorkTree(options.root);
     const config = (0, config_1.loadConfig)(options.root);
@@ -529,6 +558,8 @@ function collectPushReceipt(options) {
     if (!branch) {
         throw new errors_1.UsageError("mdkg git push requires --branch <name>");
     }
+    assertGitOperand("--remote", remote);
+    assertGitBranch(options.root, branch);
     assertNoEmbeddedCredentials("--remote", remote);
     requireGitWorkTree(options.root);
     let closeout = null;
@@ -556,7 +587,7 @@ function collectPushReceipt(options) {
     if (!pushReady.ok) {
         throw new errors_1.ValidationError(`git push-ready failed with ${pushReady.failure_count} issue(s)`);
     }
-    const push = git(options.root, ["push", remote, `HEAD:refs/heads/${branch}`]);
+    const push = git(options.root, ["push", "--", remote, `HEAD:refs/heads/${branch}`]);
     const inspect = collectInspectReceipt(options.root);
     return {
         action: "git.push",

package/dist/commands/goal.js

@@ -15,15 +15,14 @@ exports.runGoalPauseCommand = runGoalPauseCommand;
 exports.runGoalResumeCommand = runGoalResumeCommand;
 exports.runGoalDoneCommand = runGoalDoneCommand;
 exports.runGoalArchiveCommand = runGoalArchiveCommand;
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const goal_scope_1 = require("../graph/goal_scope");
 const index_cache_1 = require("../graph/index_cache");
 const frontmatter_1 = require("../graph/frontmatter");
 const indexer_1 = require("../graph/indexer");
 const reindex_1 = require("../graph/reindex");
-const atomic_1 = require("../util/atomic");
 const date_1 = require("../util/date");
 const errors_1 = require("../util/errors");
 const lock_1 = require("../util/lock");
@@ -66,11 +65,11 @@ function selectedGoalPath(root) {
 }
 function readSelectedGoalState(root, warnings) {
     const filePath = selectedGoalPath(root);
-    if (!fs_1.default.existsSync(filePath)) {
+    if (!(0, filesystem_authority_1.containedPathExists)({ root, relativePath: ".mdkg/state/selected-goal.json" })) {
         return undefined;
     }
     try {
-        const parsed = JSON.parse(fs_1.default.readFileSync(filePath, "utf8"));
+        const parsed = JSON.parse((0, filesystem_authority_1.readContainedFile)({ root, relativePath: ".mdkg/state/selected-goal.json" }));
         if (typeof parsed.qid === "string" &&
             typeof parsed.id === "string" &&
             typeof parsed.ws === "string" &&
@@ -97,30 +96,31 @@ function writeSelectedGoalState(root, node, now) {
         ws: node.ws,
         selected_at: now.toISOString(),
     };
-    (0, atomic_1.atomicWriteFile)(selectedGoalPath(root), `${JSON.stringify(state, null, 2)}\n`);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: ".mdkg/state/selected-goal.json" }, `${JSON.stringify(state, null, 2)}\n`);
 }
 function readNodeFrontmatter(root, node) {
     const filePath = path_1.default.resolve(root, node.path);
-    const parsed = (0, frontmatter_1.parseFrontmatter)(fs_1.default.readFileSync(filePath, "utf8"), filePath);
+    const relativePath = path_1.default.relative(root, filePath).split(path_1.default.sep).join("/");
+    const parsed = (0, frontmatter_1.parseFrontmatter)((0, filesystem_authority_1.readContainedFile)({ root, relativePath }), filePath);
     return {
         filePath,
         frontmatter: { ...parsed.frontmatter },
         body: parsed.body,
     };
 }
-function writeNodeFrontmatterFile(filePath, frontmatter, body, now) {
+function writeNodeFrontmatterFile(root, filePath, frontmatter, body, now) {
     frontmatter.updated = (0, date_1.formatDate)(now);
     const lines = (0, frontmatter_1.formatFrontmatter)(frontmatter, frontmatter_1.DEFAULT_FRONTMATTER_KEY_ORDER);
     const frontmatterBlock = ["---", ...lines, "---"].join("\n");
     const content = body.length > 0 ? `${frontmatterBlock}\n${body}` : frontmatterBlock;
-    (0, atomic_1.atomicWriteFile)(filePath, content);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: path_1.default.relative(root, filePath).split(path_1.default.sep).join("/") }, content);
 }
 function removeSelectedGoalState(root) {
     const filePath = selectedGoalPath(root);
-    if (!fs_1.default.existsSync(filePath)) {
+    if (!(0, filesystem_authority_1.containedPathExists)({ root, relativePath: ".mdkg/state/selected-goal.json" })) {
         return false;
     }
-    fs_1.default.rmSync(filePath, { force: true });
+    (0, filesystem_authority_1.removeContainedPath)({ root, relativePath: ".mdkg/state/selected-goal.json", force: true });
     return true;
 }
 function optionalString(value) {
@@ -184,9 +184,9 @@ function resolveGoalSelection(root, index, idOrQid, wsHint) {
     }
     throw new errors_1.NotFoundError("no selected goal or unique active goal found; run `mdkg goal activate <goal-id>`");
 }
-function loadGoal(root, idOrQid, wsHint) {
+function loadGoal(root, idOrQid, wsHint, persistReindex = true) {
     const config = (0, config_1.loadConfig)(root);
-    const { index } = (0, index_cache_1.loadIndex)({ root, config });
+    const { index } = (0, index_cache_1.loadIndex)({ root, config, persistReindex });
     const ws = normalizeWorkspace(wsHint);
     const selection = resolveGoalSelection(root, index, idOrQid, ws);
     const node = selection.node;
@@ -197,7 +197,7 @@ function loadGoal(root, idOrQid, wsHint) {
         throw new errors_1.UsageError(`mdkg goal requires a goal node; got ${node.type}:${node.id}`);
     }
     const filePath = path_1.default.resolve(root, node.path);
-    const content = fs_1.default.readFileSync(filePath, "utf8");
+    const content = (0, filesystem_authority_1.readContainedFile)({ root, relativePath: node.path });
     const parsed = (0, frontmatter_1.parseFrontmatter)(content, filePath);
     return {
         config,
@@ -234,8 +234,8 @@ function goalReceipt(root, loaded) {
         blocked_after_attempts: optionalString(fm.blocked_after_attempts),
     };
 }
-function writeGoalFile(loaded, now) {
-    writeNodeFrontmatterFile(loaded.filePath, loaded.frontmatter, loaded.body, now);
+function writeGoalFile(root, loaded, now) {
+    writeNodeFrontmatterFile(root, loaded.filePath, loaded.frontmatter, loaded.body, now);
 }
 function maybeReindex(root, config) {
     if (!config.index.auto_reindex) {
@@ -313,7 +313,7 @@ function readOnlySubgraphBlockerWarnings(index, qids) {
     return warnings;
 }
 function runGoalShowCommand(options) {
-    const loaded = loadGoal(options.root, options.id, options.ws);
+    const loaded = loadGoal(options.root, options.id, options.ws, false);
     const receipt = { action: "showed", goal: goalReceipt(options.root, loaded) };
     if (options.json) {
         console.log(JSON.stringify(receipt, null, 2));
@@ -332,7 +332,7 @@ function runGoalShowCommand(options) {
     console.log(`required_checks: ${checks.length === 0 ? "none" : checks.join(", ")}`);
 }
 function runGoalEvaluateCommand(options) {
-    const loaded = loadGoal(options.root, options.id, options.ws);
+    const loaded = loadGoal(options.root, options.id, options.ws, false);
     const checks = toStringList(loaded.frontmatter.required_checks).map((command) => ({
         command,
         status: "report_only",
@@ -364,7 +364,7 @@ function runGoalEvaluateCommand(options) {
     }
 }
 function runGoalNextCommand(options) {
-    const loaded = loadGoal(options.root, options.id, options.ws);
+    const loaded = loadGoal(options.root, options.id, options.ws, false);
     if (isArchivedGoal(loaded.node)) {
         const warnings = [...loaded.warnings, `${loaded.node.qid} is archived and has no actionable next work`];
         if (options.json) {
@@ -501,7 +501,7 @@ function runGoalActivateCommand(options) {
             const conflictFile = readNodeFrontmatter(options.root, conflict);
             conflictFile.frontmatter.goal_state = "paused";
             conflictFile.frontmatter.status = ensureStatusAllowed(config, "blocked");
-            writeNodeFrontmatterFile(conflictFile.filePath, conflictFile.frontmatter, conflictFile.body, now);
+            writeNodeFrontmatterFile(options.root, conflictFile.filePath, conflictFile.frontmatter, conflictFile.body, now);
             pausedGoals.push({
                 workspace: conflict.ws,
                 id: conflict.id,
@@ -515,7 +515,7 @@ function runGoalActivateCommand(options) {
         }
         loaded.frontmatter.goal_state = "active";
         loaded.frontmatter.status = ensureStatusAllowed(config, "progress");
-        writeGoalFile(loaded, now);
+        writeGoalFile(options.root, loaded, now);
         writeSelectedGoalState(options.root, loaded.node, now);
         maybeReindex(options.root, loaded.config);
         (0, event_support_1.appendAutomaticEvent)({
@@ -552,7 +552,7 @@ function runGoalActivateCommand(options) {
 }
 function runGoalCurrentCommand(options) {
     const config = (0, config_1.loadConfig)(options.root);
-    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config });
+    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config, persistReindex: false });
     const ws = normalizeWorkspace(options.ws);
     const warnings = [];
     let source = "none";
@@ -665,7 +665,7 @@ function runGoalClaimCommand(options) {
         }
         const now = options.now ?? new Date();
         loaded.frontmatter.active_node = node.ws === loaded.node.ws ? node.id : node.qid;
-        writeGoalFile(loaded, now);
+        writeGoalFile(options.root, loaded, now);
         maybeReindex(options.root, loaded.config);
         (0, event_support_1.appendAutomaticEvent)({
             root: options.root,
@@ -705,7 +705,7 @@ function runGoalStateMutationLocked(action, options) {
     }
     loaded.frontmatter.goal_state = GOAL_STATE_BY_ACTION[action];
     loaded.frontmatter.status = ensureStatusAllowed(loaded.config, STATUS_BY_ACTION[action]);
-    writeGoalFile(loaded, now);
+    writeGoalFile(options.root, loaded, now);
     maybeReindex(options.root, loaded.config);
     (0, event_support_1.appendAutomaticEvent)({
         root: options.root,

package/dist/commands/graph.js

@@ -13,6 +13,7 @@ const bundle_1 = require("./bundle");
 const index_1 = require("./index");
 const validate_1 = require("./validate");
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const workspace_path_1 = require("../core/workspace_path");
 const indexer_1 = require("../graph/indexer");
 const index_cache_1 = require("../graph/index_cache");
@@ -24,6 +25,7 @@ const zip_1 = require("../util/zip");
 const lock_1 = require("../util/lock");
 const date_1 = require("../util/date");
 const refs_1 = require("../util/refs");
+const id_1 = require("../util/id");
 function writeJson(value) {
     console.log(JSON.stringify(value, null, 2));
 }
@@ -146,6 +148,45 @@ function isInside(parent, child) {
     const relative = path_1.default.relative(parent, child);
     return relative === "" || (!relative.startsWith("..") && !path_1.default.isAbsolute(relative));
 }
+function lstatIfPresent(target) {
+    try {
+        return fs_1.default.lstatSync(target);
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            return undefined;
+        }
+        throw err;
+    }
+}
+function assertTargetPathContainment(root, targetRoot) {
+    // Preflight existing components before writes. Node does not expose an
+    // openat-style atomic directory walk, so concurrent path replacement remains
+    // an operating-system race rather than a guarantee this check can eliminate.
+    const absoluteRoot = path_1.default.resolve(root);
+    const relativeTarget = path_1.default.relative(absoluteRoot, targetRoot);
+    const canonicalRoot = fs_1.default.realpathSync(absoluteRoot);
+    let nearestExisting = absoluteRoot;
+    let current = absoluteRoot;
+    for (const segment of relativeTarget.split(path_1.default.sep).filter(Boolean)) {
+        current = path_1.default.join(current, segment);
+        const stat = lstatIfPresent(current);
+        if (!stat) {
+            break;
+        }
+        if (stat.isSymbolicLink()) {
+            throw new errors_1.UsageError(`--target must not contain symbolic links: ${rel(absoluteRoot, current)}`);
+        }
+        if (current !== targetRoot && !stat.isDirectory()) {
+            throw new errors_1.UsageError(`--target ancestor must be a directory: ${rel(absoluteRoot, current)}`);
+        }
+        nearestExisting = current;
+    }
+    const canonicalExisting = fs_1.default.realpathSync(nearestExisting);
+    if (!isInside(canonicalRoot, canonicalExisting)) {
+        throw new errors_1.UsageError("--target must resolve inside the current mdkg root");
+    }
+}
 function resolveSourcePath(root, source) {
     if (source.includes("\0")) {
         throw new errors_1.UsageError("source cannot contain NUL bytes");
@@ -216,7 +257,12 @@ function resolveTargetRoot(root, target) {
     if (!isInside(root, targetRoot)) {
         throw new errors_1.UsageError("--target must stay inside the current mdkg root");
     }
-    if (fs_1.default.existsSync(targetRoot)) {
+    assertTargetPathContainment(root, targetRoot);
+    const targetStat = lstatIfPresent(targetRoot);
+    if (targetStat) {
+        if (!targetStat.isDirectory()) {
+            throw new errors_1.UsageError(`target must be an empty directory or absent: ${rel(root, targetRoot)}`);
+        }
         const entries = fs_1.default.readdirSync(targetRoot);
         if (entries.length > 0) {
             throw new errors_1.UsageError(`target must be empty or absent: ${rel(root, targetRoot)}`);
@@ -454,6 +500,17 @@ function targetPathForImport(sourcePath, fromId, toId, usedPaths) {
 function renderNode(frontmatter, body) {
     return ["---", ...(0, frontmatter_1.formatFrontmatter)(frontmatter, frontmatter_1.DEFAULT_FRONTMATTER_KEY_ORDER), "---", body].join("\n");
 }
+function requireImportedIdentity(sourcePath, frontmatter) {
+    const id = typeof frontmatter.id === "string" ? frontmatter.id : undefined;
+    const type = typeof frontmatter.type === "string" ? frontmatter.type : undefined;
+    if (!id || !type) {
+        throw new errors_1.ValidationError(`${sourcePath}: imported node requires string id and type`);
+    }
+    if (!(0, id_1.isCanonicalId)(id) && !(0, id_1.isPortableId)(id)) {
+        throw new errors_1.ValidationError(`${sourcePath}: imported node id is invalid: ${id}`);
+    }
+    return { id, type };
+}
 function localIdsAndPaths(root) {
     const config = (0, config_1.loadConfig)(root);
     const index = (0, indexer_1.buildIndex)(root, config);
@@ -486,11 +543,7 @@ function planImportTemplate(options) {
             throw new errors_1.ValidationError(`graph source missing bundled file: ${sourcePath}`);
         }
         const parsed = (0, frontmatter_1.parseFrontmatter)(data.toString("utf8"), sourcePath);
-        const id = typeof parsed.frontmatter.id === "string" ? parsed.frontmatter.id : undefined;
-        const type = typeof parsed.frontmatter.type === "string" ? parsed.frontmatter.type : undefined;
-        if (!id || !type) {
-            throw new errors_1.ValidationError(`${sourcePath}: imported node requires string id and type`);
-        }
+        const { id, type } = requireImportedIdentity(sourcePath, parsed.frontmatter);
         return { sourcePath, parsed, id, type };
     });
     const idMap = new Map();
@@ -629,7 +682,7 @@ function applyImportTemplate(options, receipt) {
                 throw new errors_1.ValidationError(`graph source missing bundled file: ${sourcePath}`);
             }
             const parsed = (0, frontmatter_1.parseFrontmatter)(data.toString("utf8"), sourcePath);
-            const id = String(parsed.frontmatter.id);
+            const { id } = requireImportedIdentity(sourcePath, parsed.frontmatter);
             return { sourcePath, parsed, id };
         });
         const idMap = new Map();
@@ -671,14 +724,15 @@ function applyImportTemplate(options, receipt) {
             const targetPath = targetPathForImport(node.sourcePath, node.id, toId, usedPaths);
             contentByTarget.set(targetPath, renderNode(frontmatter, body));
         }
+        for (const targetPath of files) {
+            (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: targetPath, operation: "create", createParents: true }, () => undefined);
+        }
         for (const targetPath of files) {
             const content = contentByTarget.get(targetPath);
             if (!content) {
                 throw new errors_1.UsageError(`import plan content missing for ${targetPath}`);
             }
-            const targetAbs = path_1.default.resolve(options.root, targetPath);
-            fs_1.default.mkdirSync(path_1.default.dirname(targetAbs), { recursive: true });
-            (0, atomic_1.atomicWriteFile)(targetAbs, content);
+            (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath: targetPath }, content);
         }
         pauseLocalGoals(options.root, applyPlan.paused_goals, config);
         const indexReceipt = (0, index_1.rebuildDerivedIndexCaches)({ root: options.root });

package/dist/commands/handoff.js

@@ -7,10 +7,10 @@ exports.runHandoffCreateCommand = runHandoffCreateCommand;
 const crypto_1 = __importDefault(require("crypto"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const index_cache_1 = require("../graph/index_cache");
 const pack_1 = require("../pack/pack");
 const metrics_1 = require("../pack/metrics");
-const atomic_1 = require("../util/atomic");
 const errors_1 = require("../util/errors");
 const qid_1 = require("../util/qid");
 const version_1 = require("../core/version");
@@ -231,6 +231,8 @@ function runHandoffCreateCommand(options) {
         edges: ["parent", "epic", "relates", "blocked_by", "blocks", "context_refs", "evidence_refs"],
         verbose: false,
         maxNodes: config.pack.limits.max_nodes,
+        maxTraversalNodes: Math.min(config.index.limits.max_files, Math.max(1000, config.pack.limits.max_nodes * 10)),
+        maxBodyBytes: config.pack.limits.max_bytes,
         verboseCoreListPath: path_1.default.resolve(options.root, config.pack.verbose_core_list_path),
         wsHint: ws,
         includeLatestCheckpoint: true,
@@ -252,7 +254,7 @@ function runHandoffCreateCommand(options) {
     const contentHash = sha256(content);
     const outPath = outputPath(options.root, options.out);
     if (outPath) {
-        (0, atomic_1.atomicWriteFile)(outPath, content);
+        (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: path_1.default.relative(options.root, outPath).split(path_1.default.sep).join("/") }, content);
     }
     const receipt = {
         action: "handoff-created",