require 'json'
require 'digest'
require 'open3'
require 'pathname'
roots = ['.claude/tasks/bao-bounded-traversal', 'audit/2026-10-11-bao-bounded-traversal']
files = roots.flat_map { |r| Dir.glob("#{r}/**/*.md", File::FNM_DOTMATCH) }.sort
links = []
files.each do |path|
File.read(path).scan(/\^\*\]\(([^)]+)\)/).flatten.each do |raw|
next if raw.match?(/\A(?:[a-zA-Z][a-zA-Z0-9+.-]*:|#)/)
target = raw.sub(/#.*/, '').delete_prefix('<').delete_suffix('>')
next if target.empty?
absolute = File.expand_path(target, File.dirname(path))
raise "missing link #{path}: #{raw}" unless File.exist?(absolute)
links << [path, raw]
end
end
out, err, status = Open3.capture3('git', 'diff', '--check')
raise "diff check: #{out}#{err}" unless status.success?
revision, revision_status = Open3.capture2('git', 'rev-parse', 'HEAD')
raise 'revision' unless revision_status.success?
puts JSON.pretty_generate({status: 'PASS', revision: revision.strip, scope: 'Owned task and audit Markdown local file links; no network or anchor resolution claim. Tracked whitespace only; staged check follows separately.', files: files.map { |p| {path: p, sha256: Digest::SHA256.file(p).hexdigest} }, local_links: links, tracked_diff_check: status.exitstatus})