fix: resolve plan-scope paths from caller

Author: Jon Langevin

.github/workflows/hooks-check.yml

@@ -5,12 +5,16 @@ on:
       - 'hooks/**'
       - 'tests/hook-contracts.sh'
       - 'tests/hook-stdout-discipline.sh'
+      - 'tests/plan-scope-check-contracts.sh'
+      - 'tests/plan-scope-check.sh'
       - '.github/workflows/hooks-check.yml'
   pull_request:
     paths:
       - 'hooks/**'
       - 'tests/hook-contracts.sh'
       - 'tests/hook-stdout-discipline.sh'
+      - 'tests/plan-scope-check-contracts.sh'
+      - 'tests/plan-scope-check.sh'
       - '.github/workflows/hooks-check.yml'
 
 permissions:
@@ -27,5 +31,7 @@ jobs:
         run: bash tests/hook-stdout-discipline.sh
       - name: Hook contract tests
         run: bash tests/hook-contracts.sh
+      - name: Plan scope checker contract tests
+        run: bash tests/plan-scope-check-contracts.sh
       - name: Subagent scope guard regression tests (#86)
         run: bash hooks/subagent-scope-guard.test.sh

tests/plan-scope-check-contracts.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# tests/plan-scope-check-contracts.sh — direct contracts for plan-scope-check.sh.
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CHECKER="$REPO_ROOT/tests/plan-scope-check.sh"
+APPLY="$REPO_ROOT/hooks/scope-lock-apply"
+failures=0
+
+pass() { printf 'PASS: %s\n' "$*"; }
+fail() { printf 'FAIL: %s\n' "$*" >&2; failures=$((failures + 1)); }
+
+test_relative_plan_paths_resolve_from_caller_cwd() {
+  local tmp ws out status
+  tmp="$(mktemp -d)"
+  ws="$tmp/workspace"
+  mkdir -p "$ws/docs/plans"
+  (
+    cd "$ws" &&
+      git init -q &&
+      git checkout -q -b feat/p &&
+      git -c user.email=a@b -c user.name=x commit -q --allow-empty -m init
+  )
+  cat >"$ws/docs/plans/p.md" <<'PLAN'
+# P
+
+## Scope Manifest
+
+**PR Count:** 1
+**Tasks:** 1
+**Out of scope:**
+- (none)
+
+**PR Grouping:**
+
+| PR # | Title | Tasks | Branch |
+|------|-------|-------|--------|
+| 1 | P | Task 1 | feat/p |
+
+**Status:** Locked 2026-06-23T00:00:00Z
+
+### Task 1: P
+PLAN
+  bash "$APPLY" "$ws/docs/plans/p.md" >/dev/null
+
+  set +e
+  out="$(
+    cd "$ws" &&
+      bash "$CHECKER" \
+        --plan docs/plans/p.md \
+        --verify-lock docs/plans/p.md \
+        --against-branch docs/plans/p.md
+  )"
+  status=$?
+  set -e
+
+  if [ "$status" = "0" ] && printf '%s' "$out" | grep -q 'PASS: scope-manifest checks succeeded'; then
+    pass "plan-scope-check: relative plan paths resolve from caller cwd"
+  else
+    fail "plan-scope-check: expected caller-relative paths to pass, status=${status}, output=${out}"
+  fi
+  rm -rf "$tmp"
+}
+
+test_relative_plan_paths_resolve_from_caller_cwd
+
+echo ""
+echo "Results: $failures failure(s)"
+[ "$failures" -eq 0 ]

tests/plan-scope-check.sh

@@ -30,6 +30,7 @@
 
 set -euo pipefail
 
+CALLER_CWD="$PWD"
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$REPO_ROOT"
 
@@ -64,6 +65,13 @@ sha256_stdin() {
   fi
 }
 
+resolve_input_path() {
+  case "$1" in
+    /*) printf '%s\n' "$1" ;;
+    *) printf '%s/%s\n' "$CALLER_CWD" "$1" ;;
+  esac
+}
+
 # Check the manifest is well-formed. Args: plan path. Echoes problems to stdout.
 # Legacy plans (no manifest section) are skipped — only plans that opt into the
 # format are enforced. New plans created by writing-plans always include the
@@ -221,6 +229,9 @@ check_lock_hash() {
 # in the plan header (defaults to `main` if absent).
 check_against_branch() {
   local plan="$1"
+  local plan_dir
+  plan_dir="$(cd "$(dirname "$plan")" 2>/dev/null && pwd || true)"
+  [ -n "$plan_dir" ] || plan_dir="$CALLER_CWD"
   local base
   base="$(grep -E '^\*\*Base branch:\*\*' "$plan" | head -1 \
             | sed -E 's/.*\*\*Base branch:\*\*[[:space:]]*([A-Za-z0-9._/-]+).*/\1/' || true)"
@@ -252,8 +263,8 @@ check_against_branch() {
 
   while read -r br; do
     [ -z "$br" ] && continue
-    if ! git rev-parse --verify "refs/heads/${br}" >/dev/null 2>&1 \
-      && ! git rev-parse --verify "refs/remotes/origin/${br}" >/dev/null 2>&1; then
+    if ! git -C "$plan_dir" rev-parse --verify "refs/heads/${br}" >/dev/null 2>&1 \
+      && ! git -C "$plan_dir" rev-parse --verify "refs/remotes/origin/${br}" >/dev/null 2>&1; then
       printf '%s: planned branch %s does not exist locally or on origin\n' "$plan" "$br"
       rc=1
     fi
@@ -273,13 +284,13 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --plan)
       [ -n "${2:-}" ] || { usage; exit 3; }
-      MODE_PLAN+=("$2"); shift 2 ;;
+      MODE_PLAN+=("$(resolve_input_path "$2")"); shift 2 ;;
     --verify-lock)
       [ -n "${2:-}" ] || { usage; exit 3; }
-      MODE_VERIFY_LOCK+=("$2"); shift 2 ;;
+      MODE_VERIFY_LOCK+=("$(resolve_input_path "$2")"); shift 2 ;;
     --against-branch)
       [ -n "${2:-}" ] || { usage; exit 3; }
-      MODE_AGAINST_BRANCH+=("$2"); shift 2 ;;
+      MODE_AGAINST_BRANCH+=("$(resolve_input_path "$2")"); shift 2 ;;
     --strict)
       STRICT=1; shift ;;
     --help|-h)