fix(core): harden audited edge cases

Author: aryamthecodebreaker

docs/releases/v0.10.0-implementation-ledger.md

@@ -24,6 +24,7 @@ that npm, GitHub `main`, or the public Action already contains the fix.
 | #640 prior FixMap/setup artifacts | implemented | Contract-recognized report/context/verify artifacts and signature-recognized setup commands are removed from the analysis file and changed-file snapshots before reporting. Same-path team-owned content remains eligible. Artifact and scan-to-analysis tests cover both sides. |
 | #641 routed-test attribution | implemented | Impact routing first attributes a test to the ranked seed it actually imports, then uses path proximity only as a fallback. A regression with an earlier unrelated `data.json` seed proves the test remains attributed to its imported source. |
 | #642 Windows npm doctor shims | implemented | Doctor collapses same-directory extensionless/`.cmd`/`.ps1` npm launchers into one installation while retaining identical launchers from different directories as a real conflict. Focused doctor tests pass. |
+| Post-8446838 correctness sweep | implemented | Six claims from an external 100-item audit survived live-branch reproduction and now have focused regressions: diagnostic truncation backs off rather than splitting UTF-16 surrogate pairs; tsconfig aliases preserve an empty wildcard capture; `sk-` secrets ending in `-` redact correctly; cached and parsed history accepts exact 40-character SHA-1 or 64-character SHA-256 identities; explicit single-ref diffs no longer absorb unrelated untracked files (working-tree inclusion remains separately opt-in); and remote Git refs cannot start with `/`. Stale, speculative, and disproven claims from that document were not treated as bugs. |
 | Scheduled external baseline snapshot | implemented | The 2026-08-24 `external-eval` log confirms both FixMap gates passed and only `evaluate-baseline --suite external --check-recorded` failed on `main`. The branch's deterministic-evidence work refreshes that artifact. After the remaining language and scan corrections, a full 16-repository record changed only six lower-ranked webpack evidence scalars; every Top-5 path and aggregate hit rate stayed unchanged, and two subsequent filtered webpack runs were byte-identical. A clean Linux check remains a candidate gate. This repairs snapshot drift, not a general benchmark claim. |
 | Nested-checkout history scope | implemented | A generated-example freshness gate exposed that a scan rooted below a parent Git checkout read the parent-wide commit log and could confuse matching parent-relative filenames with repository-relative identities. History counts and names are now path-limited and `--relative` to the scanned root; a nested-repository regression proves unrelated parent commits are absent. |
 | PR CI and v0.10 stress campaign | verified | Draft PR #645 runs the real GitHub matrix; current checkpoints through run 33295260500 pass the comprehensive `npm run ci` job plus Node 20.11/22 Ubuntu and Node 24 macOS/Windows jobs. Core and CLI Vitest configs bound file-level workers and retain 15-second default integration/hook timeouts. A sustained 94%-CPU Windows run reproduced seven Git/cache tests at their 30-second ceiling; those named heavy cases now allow 60 seconds only on Windows and remain 30 seconds elsewhere, after which the isolated group and the complete 736-test Core suite passed without cache races. The MCP wire stress retains 10 seconds off Windows and allows 30 seconds for Windows process startup. `npm run stress:v0.10` proves four concurrent cold analyses are deterministic, exact warm reuse is faster, corrupt indexes heal without stale source, saved reports stay isolated, outside links are not scanned, and MCP returns `-32002`/`-32700` on the wire. The scanner benchmark now requires both its completion marker and fixture directory before reuse, preventing a stale marker from producing a false zero-file failure. A final uninterrupted local `npm run ci` passes 42 Action, 313 CLI, 736 Core, and 4 web tests plus audit, lint, production build, generated artifacts, smoke, stress, study integrity, retrieval, adversarial, and the 1,000-file scanner bound. Clean-package tarball proof and the broader release-candidate matrix remain separate gates. |

packages/action/dist/index.mjs

@@ -814,7 +814,7 @@ function isDistinctiveFragment(fragment) {
   return punctuationCount >= 1 && /[\p{L}\p{N}]/u.test(fragment);
 }
 function redactSensitiveTaskText(text) {
-  return text.replace(/(https?:\/\/)[^/\s@]+@/gi, "$1").replace(/\b(?:ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9_]{8,}\b/g, "[redacted]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[redacted]").replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, "[redacted]");
+  return text.replace(/(https?:\/\/)[^/\s@]+@/gi, "$1").replace(/\b(?:ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9_]{8,}\b/g, "[redacted]").replace(/\bAKIA[0-9A-Z]{16}\b/g, "[redacted]").replace(/\bsk-[A-Za-z0-9_-]{16,}(?=$|[^A-Za-z0-9_])/g, "[redacted]");
 }
 function stripHttpUrls(text) {
   return text.includes("://") ? text.replace(/https?:\/\/[^\s<>()\[\]{}]+/gi, " [url] ") : text;
@@ -2836,7 +2836,8 @@ function resolveSpecifier(fromPath, specifier, repoPaths, aliases, workspacePack
     for (const alias of aliases) {
       if (!specifier.startsWith(alias.prefix) || !specifier.endsWith(alias.suffix))
         continue;
-      const middle = specifier.slice(alias.prefix.length, specifier.length - alias.suffix.length || void 0);
+      const end = alias.suffix.length === 0 ? specifier.length : specifier.length - alias.suffix.length;
+      const middle = specifier.slice(alias.prefix.length, end);
       roots.push(...alias.targets.map((target) => target.replace("*", middle)));
     }
   }
@@ -4081,7 +4082,14 @@ function stripByteOrderMark(value) {
   return value.replace(/^\uFEFF/, "");
 }
 function truncateForDiagnostic(value, limit) {
-  return value.length <= limit ? value : `${value.slice(0, limit)}\u2026`;
+  if (value.length <= limit)
+    return value;
+  let end = Math.max(0, limit);
+  const last = value.charCodeAt(end - 1);
+  const next = value.charCodeAt(end);
+  if (last >= 55296 && last <= 56319 && next >= 56320 && next <= 57343)
+    end -= 1;
+  return `${value.slice(0, end)}\u2026`;
 }
 
 // packages/core/dist/semantic.js
@@ -5828,7 +5836,7 @@ function isCachedHistory(candidate) {
     return false;
   }
   return candidate.commits.every((commit) => {
-    if (!isRecord5(commit) || typeof commit.hash !== "string" || !/^[a-f0-9]{40}$/i.test(commit.hash) || typeof commit.committedAt !== "number" || !Number.isSafeInteger(commit.committedAt) || commit.committedAt < 0 || commit.author !== void 0 && (typeof commit.author !== "string" || !commit.author.trim() || commit.author.length > 200 || /[\0-\x1f\x7f]/.test(commit.author)) || !Array.isArray(commit.files))
+    if (!isRecord5(commit) || typeof commit.hash !== "string" || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(commit.hash) || typeof commit.committedAt !== "number" || !Number.isSafeInteger(commit.committedAt) || commit.committedAt < 0 || commit.author !== void 0 && (typeof commit.author !== "string" || !commit.author.trim() || commit.author.length > 200 || /[\0-\x1f\x7f]/.test(commit.author)) || !Array.isArray(commit.files))
       return false;
     return commit.files.every(isCachedRelativePath);
   });
@@ -6397,8 +6405,7 @@ async function readDiff(repoRoot, diffSpec, diagnostics, internalPaths) {
       exec("git", ["diff", "--relative", diffSpec, ...gitPathspec(internalPaths)], { cwd: repoRoot, maxBuffer: GIT_MAX_BUFFER })
     ]);
     const tracked = names.split(/\r?\n/).map((path) => path.trim()).filter(Boolean).map(normalizePath3);
-    const untracked = diffSpec.includes("..") ? [] : await listUntrackedPaths(repoRoot, internalPaths);
-    const changedFiles = [.../* @__PURE__ */ new Set([...tracked, ...untracked])].sort((a, b) => a.localeCompare(b));
+    const changedFiles = [...new Set(tracked)].sort((a, b) => a.localeCompare(b));
     diagnostics.push({
       code: "diff-resolved",
       severity: "info",
@@ -6568,7 +6575,7 @@ function parseHistoryLog(logText, repositoryPaths) {
     const committedAt = Number.parseInt(header.slice(separator + 1, secondSeparator === -1 ? void 0 : secondSeparator).trim(), 10);
     const rawAuthor = secondSeparator === -1 ? "" : header.slice(secondSeparator + 1).trim();
     const author = rawAuthor && !/[\0-\x1f\x7f]/.test(rawAuthor) ? rawAuthor.slice(0, 200) : void 0;
-    if (!/^[a-f0-9]{40}$/i.test(hash) || !Number.isSafeInteger(committedAt) || committedAt < 0)
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(hash) || !Number.isSafeInteger(committedAt) || committedAt < 0)
       continue;
     inspectedCommits += 1;
     const allFiles = [...new Set(fields.map((path) => path.replace(/^\r?\n/, "")).filter(Boolean).map(normalizePath3))];

packages/cli/src/repository-source.ts

@@ -102,7 +102,7 @@ export type ParsedGitHubIssueSource = {
 export function isSafeGitRefName(value: string): boolean {
   return value.length > 0 && value.length <= 255 &&
     value !== "@" &&
-    !/^[.-]|[./]$|[\s\u0000-\u001f\u007f~^:?*\[\\]|\.\.|\/\/|@\{|(?:^|\/)\.|(?:^|\/)[^/]*\.lock(?:\/|$)/i.test(value);
+    !/^[.\/-]|[./]$|[\s\u0000-\u001f\u007f~^:?*\[\\]|\.\.|\/\/|@\{|(?:^|\/)\.|(?:^|\/)[^/]*\.lock(?:\/|$)/i.test(value);
 }
 
 export type PublicGitHubIssue = {

packages/cli/test/mcp.test.ts

@@ -1128,6 +1128,10 @@ describe("MCP surface parity", () => {
       success: true,
       value: { issue: "x", repo: "https://github.com/o/r", ref: "release-2.x" }
     });
+    expect(parsePlanArguments({ issue: "x", repo: "https://github.com/o/r", ref: "/main" })).toEqual({
+      success: false,
+      message: '"ref" must be a safe branch or tag name.'
+    });
   });
 
   it("rejects unknown compare arguments at the request handler", async () => {

packages/core/src/import-graph.ts

@@ -693,7 +693,8 @@ function resolveSpecifier(
     roots.push(...(workspacePackages.get(specifier) ?? []));
     for (const alias of aliases) {
       if (!specifier.startsWith(alias.prefix) || !specifier.endsWith(alias.suffix)) continue;
-      const middle = specifier.slice(alias.prefix.length, specifier.length - alias.suffix.length || undefined);
+      const end = alias.suffix.length === 0 ? specifier.length : specifier.length - alias.suffix.length;
+      const middle = specifier.slice(alias.prefix.length, end);
       roots.push(...alias.targets.map((target) => target.replace("*", middle)));
     }
   }

packages/core/src/repo-scan.ts

@@ -376,7 +376,7 @@ function isCachedHistory(candidate: unknown): candidate is RepositoryHistory {
     return false;
   }
   return candidate.commits.every((commit) => {
-    if (!isRecord(commit) || typeof commit.hash !== "string" || !/^[a-f0-9]{40}$/i.test(commit.hash) ||
+    if (!isRecord(commit) || typeof commit.hash !== "string" || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(commit.hash) ||
       typeof commit.committedAt !== "number" || !Number.isSafeInteger(commit.committedAt) || commit.committedAt < 0 ||
       (commit.author !== undefined && (typeof commit.author !== "string" || !commit.author.trim() || commit.author.length > 200 || /[\0-\x1f\x7f]/.test(commit.author))) ||
       !Array.isArray(commit.files)) return false;
@@ -1225,8 +1225,7 @@ async function readDiff(
       .map((path) => path.trim())
       .filter(Boolean)
       .map(normalizePath);
-    const untracked = diffSpec.includes("..") ? [] : await listUntrackedPaths(repoRoot, internalPaths);
-    const changedFiles = [...new Set([...tracked, ...untracked])].sort((a, b) => a.localeCompare(b));
+    const changedFiles = [...new Set(tracked)].sort((a, b) => a.localeCompare(b));
     diagnostics.push({
       code: "diff-resolved",
       severity: "info",
@@ -1458,7 +1457,7 @@ async function readRepositoryHistory(
   }
 }
 
-function parseHistoryLog(
+export function parseHistoryLog(
   logText: string,
   repositoryPaths: ReadonlySet<string>
 ): { commits: HistoryCommit[]; inspectedCommits: number; skippedLargeCommits: number } {
@@ -1477,7 +1476,7 @@ function parseHistoryLog(
     const committedAt = Number.parseInt(header.slice(separator + 1, secondSeparator === -1 ? undefined : secondSeparator).trim(), 10);
     const rawAuthor = secondSeparator === -1 ? "" : header.slice(secondSeparator + 1).trim();
     const author = rawAuthor && !/[\0-\x1f\x7f]/.test(rawAuthor) ? rawAuthor.slice(0, 200) : undefined;
-    if (!/^[a-f0-9]{40}$/i.test(hash) || !Number.isSafeInteger(committedAt) || committedAt < 0) continue;
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i.test(hash) || !Number.isSafeInteger(committedAt) || committedAt < 0) continue;
 
     inspectedCommits += 1;
     const allFiles = [...new Set(fields

packages/core/src/signals.ts

@@ -298,7 +298,7 @@ export function redactSensitiveTaskText(text: string): string {
     .replace(/(https?:\/\/)[^/\s@]+@/gi, "$1")
     .replace(/\b(?:ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9_]{8,}\b/g, "[redacted]")
     .replace(/\bAKIA[0-9A-Z]{16}\b/g, "[redacted]")
-    .replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, "[redacted]");
+    .replace(/\bsk-[A-Za-z0-9_-]{16,}(?=$|[^A-Za-z0-9_])/g, "[redacted]");
 }
 
 /** URLs are never identifier evidence. Removing them before exact-fragment and identifier

packages/core/src/text.ts

@@ -16,5 +16,10 @@ export function stripByteOrderMark(value: string): string {
 }
 
 export function truncateForDiagnostic(value: string, limit: number): string {
-  return value.length <= limit ? value : `${value.slice(0, limit)}…`;
+  if (value.length <= limit) return value;
+  let end = Math.max(0, limit);
+  const last = value.charCodeAt(end - 1);
+  const next = value.charCodeAt(end);
+  if (last >= 0xd800 && last <= 0xdbff && next >= 0xdc00 && next <= 0xdfff) end -= 1;
+  return `${value.slice(0, end)}…`;
 }

packages/core/test/import-graph.test.ts

@@ -67,6 +67,16 @@ describe("buildImportGraph", () => {
     expect([...(graph.imports.get("apps/web/page.ts") ?? [])]).toEqual(["packages/auth/src/reset.ts"]);
   });
 
+  it("resolves an alias whose wildcard captures an empty middle", () => {
+    const graph = buildImportGraph([
+      codeFile("app.ts", 'import { value } from "foo";'),
+      codeFile("tsconfig.json", JSON.stringify({ compilerOptions: { paths: { "*foo": ["src/prefix*"] } } })),
+      codeFile("src/prefix.ts", "export const value = true;")
+    ]);
+
+    expect([...(graph.imports.get("app.ts") ?? [])]).toEqual(["src/prefix.ts"]);
+  });
+
   it("resolves Python relative, package, and imported-module relationships", () => {
     const files = [
       codeFile("services/auth/app/api/reset.py", [

packages/core/test/repo-scan.test.ts

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { describe, expect, it } from "vitest";
-import { scanRepo, summarizeSkippedScope } from "../src/repo-scan.js";
+import { parseHistoryLog, scanRepo, summarizeSkippedScope } from "../src/repo-scan.js";
 
 const exec = promisify(execFile);
 const HEAVY_GIT_TEST_TIMEOUT = process.platform === "win32" ? 60_000 : 30_000;
@@ -251,7 +251,7 @@ describe("scanRepo", () => {
     expect(repo.diagnostics[0]?.code).toBe("diff-unavailable");
   });
 
-  it("includes untracked files as changed for working-tree diff specs", { timeout: 30_000 }, async () => {
+  it("keeps untracked files out of an explicit single-ref diff", { timeout: 30_000 }, async () => {
     const root = await mkdtemp(join(tmpdir(), "fixmap-untracked-"));
     await mkdir(join(root, "src"), { recursive: true });
     await mkdir(join(root, "api"), { recursive: true });
@@ -267,7 +267,7 @@ describe("scanRepo", () => {
     const repo = await scanRepo({ repoRoot: root, diffSpec: "HEAD" });
 
     expect(repo.changedFiles).toContain("src/login.ts");
-    expect(repo.changedFiles).toContain("api/index.ts");
+    expect(repo.changedFiles).not.toContain("api/index.ts");
   });
 
   it("maps tracked edits in working-tree mode and leaves untracked files out", { timeout: 30_000 }, async () => {
@@ -1169,6 +1169,19 @@ describe("scanRepo", () => {
 });
 
 describe("repository impact history", () => {
+  it("accepts exact SHA-1 and SHA-256 commit identities", () => {
+    const sha1 = "a".repeat(40);
+    const sha256 = "b".repeat(64);
+    const parsed = parseHistoryLog(
+      `\x1e${sha1}\x1f1700000000\x1fAlice\0src/a.ts` +
+      `\x1e${sha256}\x1f1700000001\x1fBob\0src/b.ts`,
+      new Set(["src/a.ts", "src/b.ts"])
+    );
+
+    expect(parsed.commits.map((commit) => commit.hash)).toEqual([sha1, sha256]);
+    expect(parsed.inspectedCommits).toBe(2);
+  });
+
   it("scopes history and file identities to a scanned repository subdirectory", { timeout: HEAVY_GIT_TEST_TIMEOUT }, async () => {
     const root = await mkdtemp(join(tmpdir(), "fixmap-nested-history-"));
     const app = join(root, "app");