fix(okr): gate-herding B2 scoped strict + B3 alle lenkeformer + M2 realpath-confinement + M3 deriveType basename/ord-grense

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/okf-check.test.mjs

@@ -16,6 +16,7 @@ import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { generateIndexes } from '../scripts/okf-index.mjs';
+import { checkBundle } from '../scripts/okf-check.mjs';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const CHECK = join(ROOT, 'scripts', 'okf-check.mjs');
@@ -310,3 +311,80 @@ test('okf-index: innboks/ + dot-katalog -> ingen egen index.md OG ikke listet i
     rmSync(dir, { recursive: true, force: true });
   }
 });
+
+// --- B3 (A1): strict-gaten fanger ALLE standard lenkeformer, ikke bare inline ---
+
+test('okf-check --strict-ingest: referanse-def/autolink/HTML-anker fanges (B3)', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    writeFileSync(
+      join(dir, 'dokumenter', 'refdef.md'),
+      '---\ntype: Notat\ntitle: Refdef\ndescription: x\n---\n# Refdef\n\n'
+        + 'Se [rapporten][r].\n\n[r]: https://evil.example/refdef-exfil\n',
+    );
+    writeFileSync(
+      join(dir, 'dokumenter', 'autolenke.md'),
+      '---\ntype: Notat\ntitle: Autolenke\ndescription: x\n---\n# Autolenke\n\n'
+        + '<https://evil.example/auto-exfil>\n',
+    );
+    writeFileSync(
+      join(dir, 'dokumenter', 'anker.md'),
+      '---\ntype: Notat\ntitle: Anker\ndescription: x\n---\n# Anker\n\n'
+        + '<a href="file:///etc/passwd">passord</a>\n',
+    );
+    const { status, stdout } = runCheck(dir, '--strict-ingest');
+    assert.equal(status, 1, `alle tre lenkeformene skal felle strict:\n${stdout}`);
+    assert.match(stdout, /refdef-exfil/, 'referanse-definisjon fanges');
+    assert.match(stdout, /auto-exfil/, 'autolink fanges');
+    assert.match(stdout, /file:\/\/\/etc\/passwd/, 'raa HTML-anker fanges');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('okf-check --strict-ingest: referanse-def med trygt on-disk bundle-maal passerer', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    writeFileSync(
+      join(dir, 'dokumenter', 'trygg-ref.md'),
+      '---\ntype: Notat\ntitle: Trygg ref\ndescription: x\n---\n# Trygg ref\n\n'
+        + 'Se [notatet][n].\n\n[n]: /dokumenter/notat.md\n',
+    );
+    const { status, stdout } = runCheck(dir, '--strict-ingest');
+    assert.equal(status, 0, `trygg bundle-ref-def skal passere:\n${stdout}`);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// --- B2 (A1): strict scopes til KUN kjoeringens skrevne filer via { files } ---
+
+test('checkBundle { files }: strict validerer KUN oppgitte filer, aldri hele roten (B2)', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    // Haandkuratert pre-eksisterende fil: out-of-vocab type + ekstern lenke er
+    // LOVLIG paa lese-siden (okf-vocab haandheves kun paa skrivestien).
+    mkdirSync(join(dir, 'syklus'), { recursive: true });
+    writeFileSync(
+      join(dir, 'syklus', 'kuratert.md'),
+      '---\ntype: Egne notater\ntitle: Kuratert\ndescription: x\n---\n# Kuratert\n\n'
+        + 'Se [foeringene](https://regjeringen.no/dok).\n',
+    );
+    // Full-root strict feller den kuraterte fila (dokumentert B2-problem)...
+    const full = checkBundle(dir, { strictIngest: true });
+    assert.ok(full.strictErrors.length > 0, 'full-root strict feller kuratert innhold');
+    // ...men scoped strict (kjoeringens skrevne filer) er GROENN og teller kun dem.
+    const scoped = checkBundle(dir, {
+      strictIngest: true,
+      files: [join(dir, 'dokumenter', 'notat.md'), join(dir, 'strategisk-kontekst', 'tildelingsbrev.md')],
+    });
+    assert.equal(scoped.scanned, 2, 'scoped walk teller kun oppgitte filer');
+    assert.deepEqual(scoped.strictErrors, [], 'skrevne filer er rene -> ingen strict-feil');
+    assert.deepEqual(scoped.missingType, [], 'type-sjekk gjelder samme scope');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});