rvlib-shipkit 0.35.2 → 0.35.3

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.35.3
+
+- **`shipkit mv` no longer resolves a link that climbs out of the repo.** The cross-directory pass rewrites references by resolving them against the file that carries them, and a target like `../../outside.md` resolves to somewhere on the wider disk, which `existsSync` will happily confirm. A reference that leaves the repo is not this repo's to retarget, so it is left exactly as written.
+
 ## 0.35.2
 
 - **A contract folder typed without its dot is repaired, not reported.** `rv-reflections/` instead of `.rv-reflections/` is invisible in every direction at once: the harvest scanner reads the dotted name, the SK004 ignore block covers the dotted name, and the repo filing notes into it gets silence rather than an error. Three notes sat unread for a day that way with nothing red anywhere. It is one character, a machine can be certain, and nobody gets a say in the answer, so the fix pass renames it and lands it through the machine commit path, and no agent is told: a WARN a machine can repair is a design bug. An EMPTY misnamed folder is removed instead, since there is nothing to carry. A rename takes the files OUT of the index, which is the contract rather than a side effect: those folders are gitignored under their real name, so tracking them was the missing dot's doing. The names come from the SK004 policy block itself, so a new always-ignored `.rv-*` folder is covered by declaring it there and nowhere else; the TRACKED contract dirs stay out, because their own contract check already reports them missing. BOTH names present is the one case that reaches a human, and it refuses out loud rather than merging: two folders can hold the same filename, and picking a winner is a decision.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rvlib-shipkit",
-    "version": "0.35.2",
+    "version": "0.35.3",
     "description": "All-in-one repo companion: ci gate (task DAG), auto-discovered health checks, release-contract fulfillness, asks queue, md-wiki tools, asset atelier, live tui",
     "license": "MIT",
     "type": "module",

package/src/mv/mv-md.ts

@@ -42,6 +42,9 @@ export function retargetRelativeRefs(root: string, text: string, fromDir: string
         const anchor = hash === -1 ? '' : target.slice(hash)
         if (path === '') return null
         const from = posix(join(fromDir, path))
+        // a target that climbs out of the repo is not this repo's to rewrite,
+        // and existsSync would happily confirm something on the wider disk
+        if (from.startsWith('../')) return null
         const to = moves.get(from)
         // nothing moved for this reference: neither its target nor its carrier
         if (to == null && fromDir === toDir) return null