feat: migrate todo note to nc01 github storage

scripts/src/hwlab-node-web-sentinel-cicd-shared.ts

@@ -2,7 +2,7 @@
 // Responsibility: shared types, config helpers and text render utilities for web-probe sentinel CI/CD.
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import { resolveCliChildJsonCommandResult } from "./cli-child-json-recovery";
 import type { CommandResult } from "./command";
 import { repoRoot, rootPath } from "./config";
@@ -320,7 +320,7 @@ export function monitorWebBuildkitStatePlan(cicd: Record<string, unknown>): Reco
 }
 
 export function secretSourcePaths(sourceRef: string): string[] {
-  if (sourceRef.startsWith(".env/")) return ownerFileSourcePaths(sourceRef);
+  if (isAbsolute(sourceRef)) return [sourceRef];
   const paths = [join(repoRoot, ".state", "secrets", sourceRef)];
   const marker = "/.worktree/";
   const index = repoRoot.indexOf(marker);
@@ -328,14 +328,6 @@ export function secretSourcePaths(sourceRef: string): string[] {
   return [...new Set(paths)];
 }
 
-export function ownerFileSourcePaths(sourceRef: string): string[] {
-  if (sourceRef.includes("..") || sourceRef.includes("\0")) return [];
-  const marker = "/.worktree/";
-  const index = repoRoot.indexOf(marker);
-  const roots = index >= 0 ? [repoRoot.slice(0, index), repoRoot] : [repoRoot];
-  return [...new Set(roots.map((root) => join(root, sourceRef)))];
-}
-
 export function parseEnvFile(textValue: string): Record<string, string> {
   const values: Record<string, string> = {};
   for (const rawLine of textValue.split(/\r?\n/u)) {