truthmark 2.3.0 → 2.3.1

package/dist/main.js

@@ -60,6 +60,7 @@ var isPathInsideRoot = (rootDir, targetPath) => {
 var isNodeErrorWithCode = (error, code) => {
   return error instanceof Error && "code" in error && error.code === code;
 };
+var isExcludedPath = (targetPath, excludedRoots) => excludedRoots.some((root) => isPathInsideRoot(root, targetPath));
 var pathSegments = (absolutePath) => {
   return absolutePath.split(path.sep);
 };
@@ -107,10 +108,15 @@ var resolveRepoPath = (rootDir, relativePath) => {
   }
   return resolvedPath;
 };
-var isSafeExactFile = async (rootDir, relativePath, allowMissing) => {
+var isSafeExactFile = async (rootDir, relativePath, allowMissing, excludedRoots = []) => {
   try {
     const absolutePath = resolveRepoPath(rootDir, relativePath);
     await assertRepoContainment(rootDir, absolutePath);
+    if (isExcludedPath(
+      await resolveThroughExistingAncestor(absolutePath),
+      excludedRoots
+    ))
+      return false;
     const relative = path.relative(rootDir, absolutePath);
     const segments = pathSegments(relative);
     if (segments.length === 0 || segments.every((segment) => segment.length === 0)) {
@@ -144,6 +150,43 @@ var isSafeExactFile = async (rootDir, relativePath, allowMissing) => {
     return false;
   }
 };
+var resolveSafeExactFileTarget = async (rootDir, relativePath, allowMissing, allowFinalSymlink, excludedRoots = []) => {
+  if (await isSafeExactFile(rootDir, relativePath, allowMissing, excludedRoots)) {
+    const absolutePath = resolveRepoPath(rootDir, relativePath);
+    try {
+      const [resolvedRootDir, resolvedPath] = await Promise.all([
+        fs.realpath(rootDir),
+        fs.realpath(absolutePath)
+      ]);
+      return {
+        path: toRepoRelativePath(resolvedRootDir, resolvedPath),
+        aliased: false
+      };
+    } catch (error) {
+      if (!allowMissing || !isNodeErrorWithCode(error, "ENOENT")) return null;
+      return {
+        path: toRepoRelativePath(rootDir, absolutePath),
+        aliased: false
+      };
+    }
+  }
+  if (!allowFinalSymlink) return null;
+  try {
+    const absolutePath = resolveRepoPath(rootDir, relativePath);
+    if (!(await fs.lstat(absolutePath)).isSymbolicLink()) return null;
+    const resolvedPath = await fs.realpath(absolutePath);
+    await assertRepoContainment(rootDir, resolvedPath);
+    if (isExcludedPath(resolvedPath, excludedRoots)) return null;
+    const stat = await fs.lstat(resolvedPath);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) return null;
+    return {
+      path: toRepoRelativePath(await fs.realpath(rootDir), resolvedPath),
+      aliased: true
+    };
+  } catch {
+    return null;
+  }
+};
 var assertRepoContainment = async (rootDir, targetPath) => {
   const [resolvedRootDir, resolvedTargetPath] = await Promise.all([
     resolveThroughExistingAncestor(rootDir),
@@ -1062,9 +1105,15 @@ var getGitRepository = async (cwd) => {
   const worktreePath = await realpathOrResolved(
     (await runGit(cwd, ["rev-parse", "--show-toplevel"])).stdout.trim()
   );
-  const commonDirOutput = (await runGit(cwd, ["rev-parse", "--git-common-dir"])).stdout.trim();
-  const commonDir = await realpathOrResolved(path3.resolve(worktreePath, commonDirOutput));
-  const repositoryRoot = path3.basename(commonDir) === ".git" ? path3.dirname(commonDir) : worktreePath;
+  const [gitDirOutput, gitCommonDirOutput] = await Promise.all([
+    runGit(cwd, ["rev-parse", "--git-dir"]),
+    runGit(cwd, ["rev-parse", "--git-common-dir"])
+  ]);
+  const [gitDir, gitCommonDir] = await Promise.all([
+    realpathOrResolved(path3.resolve(cwd, gitDirOutput.stdout.trim())),
+    realpathOrResolved(path3.resolve(cwd, gitCommonDirOutput.stdout.trim()))
+  ]);
+  const repositoryRoot = path3.basename(gitCommonDir) === ".git" ? path3.dirname(gitCommonDir) : worktreePath;
   const branchResult = await runGit(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"], false);
   const headResult = await runGit(cwd, ["rev-parse", "--verify", "HEAD"], false);
   const branchName = branchResult.exitCode === 0 ? branchResult.stdout.trim() : null;
@@ -1074,6 +1123,9 @@ var getGitRepository = async (cwd) => {
   return {
     repositoryRoot,
     worktreePath,
+    gitEntryPath: path3.join(worktreePath, ".git"),
+    gitDir,
+    gitCommonDir,
     branchName,
     headSha,
     isDetached,
@@ -4432,6 +4484,7 @@ var renderTruthmarkCopilotPortalPrompt = (config = defaultAgentConfig()) => {
 // src/templates/generated-surfaces.ts
 var RETIRED_GENERATED_SURFACES = {
   exactPaths: [
+    "CLAUDE.md",
     "GEMINI.md",
     ".github/prompts/truthmark-preview.prompt.md",
     ".cursor/rules/truthmark-structure.mdc",
@@ -4602,7 +4655,10 @@ var opencodeFiles = (config, block) => {
 };
 var claudeFiles = (config, block) => {
   const files = [
-    ...instructionBlockFiles(["CLAUDE.md"], block),
+    {
+      path: ".claude/rules/truthmark.md",
+      content: block
+    },
     ...renderTruthmarkSkillPackage({
       skillPath: ".claude/skills/truthmark-structure/SKILL.md",
       workflowId: "truthmark-structure",
@@ -4866,16 +4922,18 @@ var renderGeneratedSurfaceCatalog = (config) => {
         generated: { portal: { enabled: false } }
       }
     };
-    const basePaths = new Set(
-      renderGeneratedSurfaces(baseConfig).map(({ path: path13 }) => path13)
-    );
-    for (const surface of renderGeneratedSurfaces({
-      ...baseConfig,
-      truthmark: {
-        ...baseConfig.truthmark,
-        generated: { portal: { enabled: true } }
-      }
-    })) {
+    const baseSurfaces = renderGeneratedSurfaces(baseConfig);
+    const basePaths = new Set(baseSurfaces.map(({ path: path13 }) => path13));
+    for (const surface of [
+      ...baseSurfaces,
+      ...renderGeneratedSurfaces({
+        ...baseConfig,
+        truthmark: {
+          ...baseConfig.truthmark,
+          generated: { portal: { enabled: true } }
+        }
+      })
+    ]) {
       const owner = {
         kind: basePaths.has(surface.path) ? "platform" : "portal",
         platform
@@ -4884,7 +4942,10 @@ var renderGeneratedSurfaceCatalog = (config) => {
       const recognizedContent = surface.content.endsWith("\n") ? surface.content : `${surface.content}
 `;
       if (existing) {
-        existing.owners.push(owner);
+        if (!existing.owners.some(
+          (existingOwner) => existingOwner.kind === owner.kind && "platform" in existingOwner && existingOwner.platform === owner.platform
+        ))
+          existing.owners.push(owner);
         if (!existing.recognizedContents.includes(recognizedContent)) {
           existing.recognizedContents.push(recognizedContent);
         }
@@ -4902,6 +4963,7 @@ var renderGeneratedSurfaceCatalog = (config) => {
       catalog.set(retiredPath, {
         path: retiredPath,
         content: "",
+        ...retiredPath === "CLAUDE.md" ? { managedBlock: true } : {},
         owners: [
           {
             kind: "retired",
@@ -4919,6 +4981,8 @@ var renderGeneratedSurfaceCatalog = (config) => {
 // src/init/lifecycle.ts
 import fs5 from "fs/promises";
 var plannedContents = /* @__PURE__ */ new WeakMap();
+var plannedTargets = /* @__PURE__ */ new WeakMap();
+var plannedExcludedRoots = /* @__PURE__ */ new WeakMap();
 var readFile = async (rootDir, filePath) => {
   try {
     return await fs5.readFile(resolveRepoPath(rootDir, filePath), "utf8");
@@ -4993,23 +5057,38 @@ var findRetiredSurfaces = async (rootDir) => {
   }
   return [...paths];
 };
-var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGeneratedSurfaces(config)) => {
+var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGeneratedSurfaces(config), excludedRoots = []) => {
   const desiredPaths = new Set(desired.map(({ path: path13 }) => path13));
+  const desiredTargetPaths = /* @__PURE__ */ new Set();
   const entries = [];
   const diagnostics = [];
+  const desiredTargets = /* @__PURE__ */ new Map();
+  const targets = /* @__PURE__ */ new Map();
   let applicable = true;
-  for (const surface of desired.filter(({ managedBlock }) => managedBlock)) {
-    if (!await isSafeExactFile(rootDir, surface.path, true)) {
+  for (const surface of desired) {
+    const target = await resolveSafeExactFileTarget(
+      rootDir,
+      surface.path,
+      true,
+      surface.managedBlock === true,
+      excludedRoots
+    );
+    if (!target) {
       applicable = false;
       entries.push({
         path: surface.path,
         action: "manual-review",
-        reason: "Managed instruction destination is aliased or not a regular single-link file."
+        reason: surface.managedBlock ? "Managed instruction destination does not resolve to a regular single-link file inside the worktree." : "Generated file destination is aliased or not a regular single-link file."
       });
+    } else {
+      desiredTargets.set(surface.path, target);
+      desiredTargetPaths.add(target.path);
     }
   }
   for (const surface of desired.filter(({ managedBlock }) => managedBlock)) {
-    const content = await readFile(rootDir, surface.path);
+    const target = desiredTargets.get(surface.path);
+    if (!target) continue;
+    const content = await readFile(rootDir, target.path);
     if (content !== null && parseManagedBlock(content).status === "malformed") {
       applicable = false;
       entries.push({
@@ -5019,6 +5098,7 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
       });
     }
   }
+  const plannedManagedRemovalTargets = /* @__PURE__ */ new Set();
   const catalog = renderGeneratedSurfaceCatalog(config);
   for (const retiredPath of await findRetiredSurfaces(rootDir)) {
     if (!catalog.some(({ path: catalogPath }) => catalogPath === retiredPath))
@@ -5036,9 +5116,21 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
   }
   for (const surface of catalog) {
     if (desiredPaths.has(surface.path)) continue;
-    const content = await readFile(rootDir, surface.path);
-    if (content === null) continue;
-    if (!await isSafeExactFile(rootDir, surface.path, false)) {
+    try {
+      await fs5.lstat(resolveRepoPath(rootDir, surface.path));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        continue;
+      throw error;
+    }
+    const target = await resolveSafeExactFileTarget(
+      rootDir,
+      surface.path,
+      false,
+      surface.managedBlock === true,
+      excludedRoots
+    );
+    if (!target) {
       applicable = false;
       entries.push({
         path: surface.path,
@@ -5047,6 +5139,9 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
       });
       continue;
     }
+    if (desiredTargetPaths.has(target.path)) continue;
+    const content = await readFile(rootDir, target.path);
+    if (content === null) continue;
     if (surface.path === "GEMINI.md" || surface.path.startsWith(".gemini/")) {
       entries.push({
         path: surface.path,
@@ -5063,11 +5158,14 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
           reason: "Truthmark managed-block markers are malformed."
         });
       } else if (block.status === "valid") {
+        if (plannedManagedRemovalTargets.has(target.path)) continue;
+        plannedManagedRemovalTargets.add(target.path);
         entries.push({
           path: surface.path,
           action: "remove-managed-block",
           reason: "No configured platform owns this managed block."
         });
+        targets.set(surface.path, target);
       }
     } else if (surface.recognizedContents.includes(content)) {
       entries.push({
@@ -5075,6 +5173,7 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
         action: "remove-file",
         reason: "Generated file has no active platform owner."
       });
+      targets.set(surface.path, target);
     } else {
       entries.push({
         path: surface.path,
@@ -5109,22 +5208,34 @@ var buildLifecyclePlan = async (rootDir, config, mode, desired = renderGenerated
   const contents = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     if (entry.action === "remove-file" || entry.action === "remove-managed-block") {
-      const content = await readFile(rootDir, entry.path);
+      const target = targets.get(entry.path);
+      const content = target ? await readFile(rootDir, target.path) : null;
       if (content !== null) contents.set(entry.path, content);
     }
   }
   plannedContents.set(plan, contents);
+  plannedTargets.set(plan, targets);
+  plannedExcludedRoots.set(plan, excludedRoots);
   return plan;
 };
 var applyLifecyclePlan = async (rootDir, plan) => {
   if (!plan.applicable || plan.mode !== "apply") return plan;
   const expected = plannedContents.get(plan);
+  const expectedTargets = plannedTargets.get(plan);
   const failure = async (entry) => {
     if (entry.action !== "remove-file" && entry.action !== "remove-managed-block")
       return null;
-    if (!await isSafeExactFile(rootDir, entry.path, false))
+    const target = await resolveSafeExactFileTarget(
+      rootDir,
+      entry.path,
+      false,
+      entry.action === "remove-managed-block",
+      plannedExcludedRoots.get(plan)
+    );
+    const expectedTarget = expectedTargets?.get(entry.path);
+    if (!target || !expectedTarget || target.path !== expectedTarget.path || target.aliased !== expectedTarget.aliased)
       return `Unsafe lifecycle target: ${entry.path}`;
-    const content = await readFile(rootDir, entry.path);
+    const content = await readFile(rootDir, target.path);
     if (content === null || expected?.get(entry.path) !== content)
       return `Lifecycle target changed after planning: ${entry.path}`;
     if (entry.action === "remove-managed-block" && parseManagedBlock(content).status !== "valid")
@@ -5150,7 +5261,9 @@ var applyLifecyclePlan = async (rootDir, plan) => {
       };
   }
   for (const entry of plan.entries) {
-    const absolutePath = resolveRepoPath(rootDir, entry.path);
+    const target = expectedTargets?.get(entry.path);
+    if (!target) continue;
+    const absolutePath = resolveRepoPath(rootDir, target.path);
     if (entry.action === "remove-file") {
       const stat = await fs5.lstat(absolutePath);
       if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
@@ -5167,7 +5280,8 @@ var applyLifecyclePlan = async (rootDir, plan) => {
       if (block.status !== "valid")
         throw new Error(`Managed block changed during removal: ${entry.path}`);
       const remaining = `${content.slice(0, block.start)}${content.slice(block.end)}`;
-      if (remaining.trim().length === 0) await fs5.rm(absolutePath);
+      if (remaining.trim().length === 0 && !target.aliased)
+        await fs5.rm(absolutePath);
       else await fs5.writeFile(absolutePath, remaining, "utf8");
     }
   }
@@ -5175,20 +5289,33 @@ var applyLifecyclePlan = async (rootDir, plan) => {
 };
 
 // src/init/init.ts
-var writeManagedAgentsFile = async (rootDir, path13 = "AGENTS.md", block) => {
+var writeManagedAgentsFile = async (rootDir, path13, block, excludedRoots) => {
+  const target = await resolveSafeExactFileTarget(
+    rootDir,
+    path13,
+    true,
+    true,
+    excludedRoots
+  );
+  if (!target)
+    throw new Error(`Refusing unsafe managed instruction write: ${path13}`);
   let existingContent = null;
   try {
-    existingContent = await fs6.readFile(resolveRepoPath(rootDir, path13), "utf8");
+    existingContent = await fs6.readFile(
+      resolveRepoPath(rootDir, target.path),
+      "utf8"
+    );
   } catch (error) {
     if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
       throw error;
     }
   }
-  return writeRepoFile(
+  const result = await writeRepoFile(
     rootDir,
-    path13,
+    target.path,
     upsertManagedBlock(existingContent, block)
   );
+  return { ...result, path: path13 };
 };
 var diagnosticCategoryForPath = (filePath, config) => {
   if (filePath === "AGENTS.md") {
@@ -5197,7 +5324,7 @@ var diagnosticCategoryForPath = (filePath, config) => {
   if (filePath === ".github/prompts/truthmark-realize.prompt.md" || filePath.startsWith(".github/skills/truthmark-realize/") || filePath.startsWith(".claude/skills/truthmark-realize/") || filePath.startsWith(".opencode/skills/truthmark-realize/") || filePath.startsWith(".agents/skills/truthmark-realize/") || filePath.startsWith(".antigravity/rules/truthmark-realize") || filePath.startsWith(".cursor/rules/truthmark-realize") || filePath.startsWith(".cursor/skills/truthmark-realize/")) {
     return "realization";
   }
-  if (filePath === "CLAUDE.md" || filePath === ".github/copilot-instructions.md" || filePath.startsWith(".github/prompts/truthmark-") || filePath.startsWith(".github/agents/truth-") || filePath.startsWith(".github/skills/truthmark-") || filePath.startsWith(".claude/agents/truth-") || filePath.startsWith(".claude/skills/truthmark-") || filePath.startsWith(".opencode/skills/truthmark-") || filePath.startsWith(".opencode/agents/") || filePath.startsWith(".codex/agents/") || filePath.startsWith(".antigravity/rules/truthmark-") || filePath.startsWith(".cursor/rules/truthmark-") || filePath.startsWith(".cursor/skills/truthmark-")) {
+  if (filePath === "CLAUDE.md" || filePath === ".claude/rules/truthmark.md" || filePath === ".github/copilot-instructions.md" || filePath.startsWith(".github/prompts/truthmark-") || filePath.startsWith(".github/agents/truth-") || filePath.startsWith(".github/skills/truthmark-") || filePath.startsWith(".claude/agents/truth-") || filePath.startsWith(".claude/skills/truthmark-") || filePath.startsWith(".opencode/skills/truthmark-") || filePath.startsWith(".opencode/agents/") || filePath.startsWith(".codex/agents/") || filePath.startsWith(".antigravity/rules/truthmark-") || filePath.startsWith(".cursor/rules/truthmark-") || filePath.startsWith(".cursor/skills/truthmark-")) {
     return "truth-sync";
   }
   if (filePath.startsWith(".agents/skills/truthmark-")) {
@@ -5208,9 +5335,14 @@ var diagnosticCategoryForPath = (filePath, config) => {
   }
   return "config";
 };
-var writePlatformFile = async (rootDir, file) => {
+var writePlatformFile = async (rootDir, file, excludedRoots) => {
   if (file.managedBlock) {
-    return writeManagedAgentsFile(rootDir, file.path, file.content);
+    return writeManagedAgentsFile(
+      rootDir,
+      file.path,
+      file.content,
+      excludedRoots
+    );
   }
   return writeRepoFile(rootDir, file.path, file.content);
 };
@@ -5245,6 +5377,11 @@ var normalizeRequestedPlatforms = (values) => {
 var runInit = async (cwd, options = {}) => {
   const repository = await getGitRepository(cwd);
   const rootDir = repository.worktreePath;
+  const excludedGeneratedRoots = [
+    repository.gitEntryPath,
+    repository.gitDir,
+    repository.gitCommonDir
+  ];
   const loadedConfig = await loadConfig(rootDir);
   const repositoryData = {
     repositoryRoot: repository.repositoryRoot,
@@ -5317,7 +5454,8 @@ var runInit = async (cwd, options = {}) => {
     rootDir,
     config,
     "apply",
-    platformFiles
+    platformFiles,
+    excludedGeneratedRoots
   );
   if (!lifecyclePlan.applicable) {
     return {
@@ -5329,7 +5467,9 @@ var runInit = async (cwd, options = {}) => {
   }
   results.push(...await scaffoldHierarchy(rootDir, config));
   for (const file of platformFiles) {
-    results.push(await writePlatformFile(rootDir, file));
+    results.push(
+      await writePlatformFile(rootDir, file, excludedGeneratedRoots)
+    );
   }
   results.push(
     await writeRepoFile(rootDir, loadedConfig.configPath, configSource)
@@ -5453,7 +5593,8 @@ var runUninstall = async (cwd, mode) => {
     repository.worktreePath,
     loaded.config,
     mode,
-    []
+    [],
+    [repository.gitEntryPath, repository.gitDir, repository.gitCommonDir]
   );
   const plan = await applyLifecyclePlan(repository.worktreePath, planned);
   return {
@@ -6906,11 +7047,19 @@ var obsoleteGeneratedSurfaceMessage = (surfacePath) => {
   }
   return `Generated surface ${surfacePath} is obsolete; rerun truthmark init.`;
 };
-var checkGeneratedSurfaces = async (rootDir, config) => {
+var checkGeneratedSurfaces = async (rootDir, config, excludedRoots = []) => {
   const diagnostics = [];
   const renderedSurfaces = renderGeneratedSurfaces(config);
   for (const surface of renderedSurfaces) {
-    const content = await readOptionalFile(rootDir, surface.path);
+    const target = await resolveSafeExactFileTarget(
+      rootDir,
+      surface.path,
+      true,
+      surface.managedBlock === true,
+      excludedRoots
+    );
+    if (!target) continue;
+    const content = await readOptionalFile(rootDir, target.path);
     if (content === null) {
       diagnostics.push({
         category: "generated-surface",
@@ -6937,13 +7086,14 @@ var checkGeneratedSurfaces = async (rootDir, config) => {
     rootDir,
     config,
     "dry-run",
-    renderedSurfaces
+    renderedSurfaces,
+    excludedRoots
   );
   for (const entry of lifecyclePlan.entries) {
     diagnostics.push({
       category: "generated-surface",
       severity: entry.action === "manual-review" ? "error" : "review",
-      message: entry.action === "preserve" && (entry.path.includes("truthmark-preview") || entry.path.endsWith("helper-manifest.yml") || entry.path.endsWith("support/helper-policy.md") || isRetiredGeminiSurfacePath(entry.path)) ? obsoleteGeneratedSurfaceMessage(entry.path) : entry.action === "preserve" ? `Generated surface ${entry.path} is inactive but was preserved: ${entry.reason}` : `Generated surface ${entry.path} is inactive; rerun truthmark init to reconcile it.`,
+      message: entry.action === "manual-review" ? `Generated surface ${entry.path} requires manual review: ${entry.reason}` : entry.action === "preserve" && (entry.path.includes("truthmark-preview") || entry.path.endsWith("helper-manifest.yml") || entry.path.endsWith("support/helper-policy.md") || isRetiredGeminiSurfacePath(entry.path)) ? obsoleteGeneratedSurfaceMessage(entry.path) : entry.action === "preserve" ? `Generated surface ${entry.path} is inactive but was preserved: ${entry.reason}` : `Generated surface ${entry.path} is inactive; rerun truthmark init to reconcile it.`,
       file: entry.path
     });
   }
@@ -7894,7 +8044,11 @@ var runCheck = async (cwd, options = {}) => {
     markdownPaths,
     areas.truthDocumentEntries
   );
-  const generatedSurfaces = await checkGeneratedSurfaces(rootDir, loadResult.config);
+  const generatedSurfaces = await checkGeneratedSurfaces(
+    rootDir,
+    loadResult.config,
+    [repository.gitEntryPath, repository.gitDir, repository.gitCommonDir]
+  );
   const sourceTraceability = await validateEvidenceReferences(rootDir, areas.truthDocumentPaths);
   const freshness = options.base ? await checkFreshness(rootDir, loadResult.config, areas.truthDocumentPaths, options.base) : null;
   const diagnostics = [