@ai-sdlc/orchestrator 0.9.0 → 0.10.0

package/dist/__test-helpers/git-env.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Hermetic git env for orchestrator test fixtures (AISDLC-257).
+ *
+ * Cross-link: mirrors `pipeline-cli/src/__test-helpers/git-env.ts` (AISDLC-253).
+ * See that file for the canonical rationale. This copy exists so orchestrator
+ * tests don't take a cross-package import dependency on pipeline-cli's test
+ * helpers.
+ *
+ * Why this exists
+ * ───────────────
+ * Test fixtures that shell out to `git` (e.g. `execSync('git init', { cwd: d })`)
+ * are vulnerable to env-var bleed from the parent shell:
+ *
+ *   - `GIT_DIR=...` overrides cwd-based repo discovery — every git command
+ *     writes into the parent shell's GIT_DIR, NOT the fixture's `cwd`.
+ *   - `GIT_WORK_TREE=...` ditto for the working tree.
+ *   - `core.hooksPath` from system/global config can fire husky hooks during
+ *     fixture commits.
+ *   - `commit.gpgsign=true` from operator config can break unattended commits.
+ *
+ * The `cleanGitEnv()` helper in `orchestrator/src/runtime/git-env.ts` strips
+ * GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE but still inherits `process.env`
+ * in full, meaning `git config user.email` writes still land wherever git
+ * resolves config (which may be a polluted GIT_DIR or the operator's global
+ * config). AISDLC-257 identified `worktree-pool.integration.test.ts` as the
+ * confirmed leak source.
+ *
+ * `makeGitEnv()` uses an ALLOW-LIST approach rather than a DENY-LIST: it
+ * constructs a minimal env from scratch, deliberately omitting GIT_DIR and
+ * GIT_WORK_TREE. Identity is provided via `GIT_AUTHOR_*` / `GIT_COMMITTER_*`
+ * env vars so fixtures never need `git config user.email`.
+ *
+ * Pattern (matches pipeline-cli AISDLC-253 + orchestrator AISDLC-241/246):
+ *
+ *   const env = makeGitEnv();
+ *   execSync('git init -b main', { cwd: repoDir, env, stdio: 'pipe' });
+ *   // No `git config user.email` needed — identity comes from GIT_AUTHOR_*
+ */
+export declare function makeGitEnv(): NodeJS.ProcessEnv;
+//# sourceMappingURL=git-env.d.ts.map

package/dist/__test-helpers/git-env.js

@@ -0,0 +1,73 @@
+/**
+ * Hermetic git env for orchestrator test fixtures (AISDLC-257).
+ *
+ * Cross-link: mirrors `pipeline-cli/src/__test-helpers/git-env.ts` (AISDLC-253).
+ * See that file for the canonical rationale. This copy exists so orchestrator
+ * tests don't take a cross-package import dependency on pipeline-cli's test
+ * helpers.
+ *
+ * Why this exists
+ * ───────────────
+ * Test fixtures that shell out to `git` (e.g. `execSync('git init', { cwd: d })`)
+ * are vulnerable to env-var bleed from the parent shell:
+ *
+ *   - `GIT_DIR=...` overrides cwd-based repo discovery — every git command
+ *     writes into the parent shell's GIT_DIR, NOT the fixture's `cwd`.
+ *   - `GIT_WORK_TREE=...` ditto for the working tree.
+ *   - `core.hooksPath` from system/global config can fire husky hooks during
+ *     fixture commits.
+ *   - `commit.gpgsign=true` from operator config can break unattended commits.
+ *
+ * The `cleanGitEnv()` helper in `orchestrator/src/runtime/git-env.ts` strips
+ * GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE but still inherits `process.env`
+ * in full, meaning `git config user.email` writes still land wherever git
+ * resolves config (which may be a polluted GIT_DIR or the operator's global
+ * config). AISDLC-257 identified `worktree-pool.integration.test.ts` as the
+ * confirmed leak source.
+ *
+ * `makeGitEnv()` uses an ALLOW-LIST approach rather than a DENY-LIST: it
+ * constructs a minimal env from scratch, deliberately omitting GIT_DIR and
+ * GIT_WORK_TREE. Identity is provided via `GIT_AUTHOR_*` / `GIT_COMMITTER_*`
+ * env vars so fixtures never need `git config user.email`.
+ *
+ * Pattern (matches pipeline-cli AISDLC-253 + orchestrator AISDLC-241/246):
+ *
+ *   const env = makeGitEnv();
+ *   execSync('git init -b main', { cwd: repoDir, env, stdio: 'pipe' });
+ *   // No `git config user.email` needed — identity comes from GIT_AUTHOR_*
+ */
+export function makeGitEnv() {
+    return {
+        // Minimal OS plumbing.
+        PATH: process.env['PATH'] ?? '/usr/bin:/bin',
+        HOME: process.env['HOME'] ?? '/tmp',
+        ...(process.env['TMPDIR'] ? { TMPDIR: process.env['TMPDIR'] } : {}),
+        ...(process.env['TEMP'] ? { TEMP: process.env['TEMP'] } : {}),
+        ...(process.env['TMP'] ? { TMP: process.env['TMP'] } : {}),
+        // Locale — prevent non-ASCII error strings in git output.
+        LANG: process.env['LANG'] ?? 'en_US.UTF-8',
+        LC_ALL: 'C',
+        // Git identity — supplied via env so `git config user.email/user.name`
+        // is never needed inside the fixture (those writes would land in either
+        // the fixture's .git/config or, if GIT_DIR is polluted, in the host
+        // worktree's config).
+        GIT_AUTHOR_NAME: 'Test',
+        GIT_AUTHOR_EMAIL: 'test@test.invalid',
+        GIT_COMMITTER_NAME: 'Test',
+        GIT_COMMITTER_EMAIL: 'test@test.invalid',
+        // Disable system + global git config to prevent gpgsign / hookPath /
+        // user-config bleed from the operator's machine.
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: '/dev/null',
+        // Disable husky so the calling project's pre-commit hooks don't fire.
+        HUSKY: '0',
+        // Suppress credential helpers / interactive prompts.
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_SSH_COMMAND: 'ssh -o BatchMode=yes',
+        // Note: deliberately NO `GIT_DIR` / `GIT_WORK_TREE` keys — by omitting
+        // them from the returned object, child processes inherit nothing for
+        // those vars (the env REPLACES the parent's env when passed to execSync,
+        // it doesn't merge). That's the load-bearing guarantee against the leak.
+    };
+}
+//# sourceMappingURL=git-env.js.map

package/dist/admission-composite.d.ts

@@ -64,4 +64,26 @@ export interface AdmissionCompositeOptions {
     priorityInputOverrides?: Partial<PriorityInput>;
 }
 export declare function computeAdmissionComposite(input: AdmissionInput, config?: PriorityConfig, options?: AdmissionCompositeOptions): AdmissionComposite;
+/**
+ * Compute admission confidence in [0, 1] as a 50/50 blend of two
+ * independent evidence channels:
+ *
+ *   1. **Mapper coverage** — fraction of `ADMISSION_MAPPER_FIELDS`
+ *      explicitly populated on the derived `PriorityInput`. Captures
+ *      "how much issue/backlog signal did `mapIssueToPriorityInput`
+ *      extract".
+ *
+ *   2. **Enrichment loaded** — fraction of RFC-0008 enrichment slots
+ *      present on the input (or supplied via `options`). Captures "how
+ *      much external context did the enrichment readers contribute".
+ *
+ * Bug fixed (AISDLC-172 / RFC-0009 §13 OQ-9): previously
+ * `computeConfidence(priorityInput)` from `priority.ts` was used, which
+ * counts against the full 16-field `SCORABLE_FIELDS` list and ignores
+ * enrichment success entirely. The result was a hard ~0.5 ceiling on
+ * admit confidence even when DID + DSB + maintainers + soul-tracks all
+ * loaded — those four positive observations contributed exactly zero
+ * to the formula's denominator and zero to its numerator.
+ */
+export declare function computeAdmissionConfidence(input: AdmissionInput, priorityInput: PriorityInput, options?: AdmissionCompositeOptions): number;
 //# sourceMappingURL=admission-composite.d.ts.map

package/dist/admission-composite.js

@@ -27,7 +27,6 @@
 import { mapIssueToPriorityInput } from './admission-score.js';
 import { computeAutonomyFactor, computeDefectRiskFactor, computeReadinessFromDesignSystemContext, } from './admission-enrichment.js';
 import { computeAdmissionHumanCurve } from './admission-hc.js';
-import { computeConfidence } from './priority.js';
 const DEFAULT_SIGNAL = 0.5;
 export function computeAdmissionComposite(input, config, options) {
     const timestamp = new Date().toISOString();
@@ -114,7 +113,7 @@ export function computeAdmissionComposite(input, config, options) {
             // display continuity but do not multiply it into `composite`.
             calibration: clampCalibration(config?.calibrationCoefficient),
         },
-        confidence: computeConfidence(priorityInput),
+        confidence: computeAdmissionConfidence(input, priorityInput, options),
         timestamp,
     };
     return {
@@ -132,6 +131,90 @@ export function computeAdmissionComposite(input, config, options) {
         },
     };
 }
+// ── Admission confidence (AISDLC-172) ──────────────────────────────────
+/**
+ * `PriorityInput` fields that the admission mapper (`mapIssueToPriorityInput`)
+ * actually populates from issue/backlog signals. The full PPA `SCORABLE_FIELDS`
+ * list (used by `computeConfidence` in `priority.ts`) includes runtime-only
+ * dimensions like `regulatoryUrgency`, `techInflection`, `marketDivergence`,
+ * `meetingDecision`, `budgetUtilization`, and `dependencyClearance` — none of
+ * which the admission mapper ever sets. Counting against the full 16-field
+ * list capped admit confidence at ~9/16 ≈ 0.56 even for fully-shaped issues
+ * (RFC-0009 §13 OQ-9 "0.5 ceiling" bug). The mapper-relevant subset is the
+ * correct denominator for the mapper-evidence half of the blend.
+ */
+const ADMISSION_MAPPER_FIELDS = [
+    'soulAlignment',
+    'demandSignal',
+    'teamConsensus',
+    'builderConviction',
+    'complexity',
+    'bugSeverity',
+    'explicitPriority',
+    'competitiveDrift',
+    'customerRequestCount',
+];
+/**
+ * RFC-0008 enrichment slots whose presence on `AdmissionInput` indicates
+ * an enrichment reader successfully loaded its context. This is the
+ * "enrichment-success signal" referenced in the OQ-9 hypothesis:
+ *
+ *   - `designSystemContext`     ← DSB loader (catalog/token coverage)
+ *   - `autonomyContext`         ← AutonomyPolicy (DID-driven) loader
+ *   - `codeAreaQuality`         ← code-area metrics loader
+ *   - `designAuthoritySignal`   ← maintainers/principals loader
+ *   - `soulAlignmentOverride`   ← soul-tracks SA-1 loader (M5 path)
+ *
+ * Total slots is `5`. Each loaded slot contributes `1/5` to the
+ * enrichment-evidence half of the confidence blend.
+ */
+const ADMISSION_ENRICHMENT_SLOT_COUNT = 5;
+function countLoadedEnrichmentSlots(input, options) {
+    let loaded = 0;
+    if (input.designSystemContext)
+        loaded++;
+    if (input.autonomyContext)
+        loaded++;
+    if (input.codeAreaQuality)
+        loaded++;
+    if (input.designAuthoritySignal)
+        loaded++;
+    if (options?.soulAlignmentOverride !== undefined)
+        loaded++;
+    return loaded;
+}
+/**
+ * Compute admission confidence in [0, 1] as a 50/50 blend of two
+ * independent evidence channels:
+ *
+ *   1. **Mapper coverage** — fraction of `ADMISSION_MAPPER_FIELDS`
+ *      explicitly populated on the derived `PriorityInput`. Captures
+ *      "how much issue/backlog signal did `mapIssueToPriorityInput`
+ *      extract".
+ *
+ *   2. **Enrichment loaded** — fraction of RFC-0008 enrichment slots
+ *      present on the input (or supplied via `options`). Captures "how
+ *      much external context did the enrichment readers contribute".
+ *
+ * Bug fixed (AISDLC-172 / RFC-0009 §13 OQ-9): previously
+ * `computeConfidence(priorityInput)` from `priority.ts` was used, which
+ * counts against the full 16-field `SCORABLE_FIELDS` list and ignores
+ * enrichment success entirely. The result was a hard ~0.5 ceiling on
+ * admit confidence even when DID + DSB + maintainers + soul-tracks all
+ * loaded — those four positive observations contributed exactly zero
+ * to the formula's denominator and zero to its numerator.
+ */
+export function computeAdmissionConfidence(input, priorityInput, options) {
+    let providedMapper = 0;
+    for (const field of ADMISSION_MAPPER_FIELDS) {
+        if (priorityInput[field] !== undefined)
+            providedMapper++;
+    }
+    const mapperFraction = providedMapper / ADMISSION_MAPPER_FIELDS.length;
+    const loadedEnrichment = countLoadedEnrichmentSlots(input, options);
+    const enrichmentFraction = loadedEnrichment / ADMISSION_ENRICHMENT_SLOT_COUNT;
+    return 0.5 * mapperFraction + 0.5 * enrichmentFraction;
+}
 function clamp01(value) {
     return Math.min(1, Math.max(0, value));
 }

package/dist/admission-enrichment.js

@@ -225,16 +225,26 @@ export function computeDesignAuthorityWeight(signal) {
 function buildDesignAuthoritySignal(input, ctx) {
     if (!ctx.designSystemBinding)
         return undefined;
+    // AISDLC-171: surface whether the DSB declares any design authority
+    // principals at all. This is a diagnostic flag — it does NOT participate
+    // in the HC_design weight calculation (per RFC-0008 §14.2, only
+    // principals who participate as author/commenter can emit HC_design).
+    // Surfacing it lets pillarBreakdown distinguish "DSB has no design
+    // authority structure" from "DSB has design authority but no principal
+    // participated in this issue".
+    const principalsDeclared = (ctx.designSystemBinding.spec.stewardship.designAuthority.principals?.length ?? 0) > 0;
     const { isDesignAuthority, signalType } = checkDesignAuthority({
         authorLogin: input.authorLogin,
         commenterLogins: input.commenterLogins,
         labels: input.labels,
     }, ctx.designSystemBinding);
-    if (!isDesignAuthority)
-        return { isDesignAuthority: false };
+    if (!isDesignAuthority) {
+        return { isDesignAuthority: false, principalsDeclared };
+    }
     return {
         isDesignAuthority: true,
         signalType,
+        principalsDeclared,
         ...(ctx.areaComplianceScore !== undefined
             ? { areaComplianceScore: ctx.areaComplianceScore }
             : {}),

package/dist/admission-hc.d.ts

@@ -34,8 +34,27 @@ export interface AdmissionHumanCurveResult {
     hcConsensus: number;
     /** Signed meeting-decision signal in [-1, 1] (0 = neutral when absent). */
     hcDecision: number;
-    /** Signed design-authority signal in [-1, 1]. */
+    /**
+     * Signed design-authority signal in [-1, 1].
+     *
+     * AISDLC-171: this channel ONLY fires when one of the issue's
+     * participants (author or commenters) is a principal listed in
+     * `DesignSystemBinding.spec.stewardship.designAuthority.principals`.
+     * Per RFC-0008 §14.2, non-principal participants' design opinions
+     * route through `hcConsensus` instead — `hcDesign` carries
+     * specifically the design-authority leadership signal. To distinguish
+     * "no DSB at all" from "DSB exists but no design principal
+     * participated", consult `designAuthorityConfigured` on this result
+     * (and on `pillarBreakdown.shared.hcComposite`).
+     */
     hcDesign: number;
+    /**
+     * Diagnostic flag (AISDLC-171) — true when the resolved DSB declared
+     * `stewardship.designAuthority.principals` entries. Always undefined
+     * when no DSB was supplied (preDesignSystem). Surfaces the
+     * "configured but inactive" state without altering hcDesign weight.
+     */
+    designAuthorityConfigured?: boolean;
     /** Weighted sum before tanh. */
     hcRaw: number;
     /** `tanh(hcRaw)` — the HC value consumed by the admission composite. */

package/dist/admission-hc.js

@@ -70,12 +70,23 @@ export function computeAdmissionHumanCurve(input) {
     const hcConsensus = deriveHcConsensus(input);
     const hcDecision = deriveHcDecision(input);
     const hcDesign = deriveHcDesign(input.designAuthoritySignal);
+    // AISDLC-171: surface the diagnostic flag from the enriched signal so
+    // pillarBreakdown can render the "configured but inactive" state.
+    const designAuthorityConfigured = input.designAuthoritySignal?.principalsDeclared;
     const hcRaw = HC_WEIGHTS.explicit * hcExplicit +
         HC_WEIGHTS.consensus * hcConsensus +
         HC_WEIGHTS.decision * hcDecision +
         HC_WEIGHTS.design * hcDesign;
     const hcComposite = Math.tanh(hcRaw);
-    return { hcExplicit, hcConsensus, hcDecision, hcDesign, hcRaw, hcComposite };
+    return {
+        hcExplicit,
+        hcConsensus,
+        hcDecision,
+        hcDesign,
+        hcRaw,
+        hcComposite,
+        ...(designAuthorityConfigured !== undefined ? { designAuthorityConfigured } : {}),
+    };
 }
 function clamp(value, min, max) {
     return Math.min(max, Math.max(min, value));

package/dist/admission-score.d.ts

@@ -102,6 +102,20 @@ export interface DesignAuthoritySignal {
     signalType?: DesignAuthoritySignalType;
     /** The issue's code area compliance score in [0, 1] (used to modulate weight). */
     areaComplianceScore?: number;
+    /**
+     * Diagnostic flag (AISDLC-171) — true when the resolved DSB declared
+     * one or more `stewardship.designAuthority.principals` entries,
+     * regardless of whether any of them participated in this issue.
+     *
+     * This is intentionally NOT consumed by `computeDesignAuthorityWeight`
+     * — RFC-0008 §14.2 requires principal participation for HC_design to
+     * fire at any weight. The flag exists so `pillarBreakdown.shared.
+     * hcComposite.designAuthorityConfigured` can surface "design authority
+     * is configured but absent from this issue" — distinct from "no
+     * design authority structure exists at all" — without violating the
+     * RFC's §14.2 weighting constraint.
+     */
+    principalsDeclared?: boolean;
 }
 export interface AdmissionThresholds {
     minimumScore: number;

package/dist/admission-score.js

@@ -24,7 +24,13 @@ export function mapIssueToPriorityInput(input) {
     const backlog = input.backlogContext;
     // ── Backlog status veto ─────────────────────────────────────
     // Drafts aren't ready to admit; orchestrator should ignore them.
-    if (backlog?.status === 'Draft') {
+    // RFC-0011 Phase 4 (AISDLC-115.5): the same veto applies to
+    // `Needs Clarification` — running PPA on an unready issue burns
+    // scoring effort that gets invalidated on clarification (RFC §2.3 +
+    // §7.2). The PPA admission step short-circuits with soulAlignment=0
+    // so the composite scorer treats the issue as not-admissible without
+    // calling out to the design / autonomy / trust enrichment layers.
+    if (backlog?.status === 'Draft' || backlog?.status === 'Needs Clarification') {
         return {
             itemId: `#${input.issueNumber}`,
             title: input.title,

package/dist/cli/commands/git-remote.d.ts

@@ -39,6 +39,31 @@ export interface DetectRemoteOptions {
  * Detect the GitHub-style org/repo from the project's git origin remote.
  * Returns FALLBACK with detected=false when no remote is configured or
  * when the URL cannot be parsed.
+ *
+ * The git invocation is hardened against two failure modes (AISDLC-104):
+ *
+ *  1. **cwd inheritance race under parallel test workers.** Every git
+ *     command uses `git -C <cwd>` so the working dir is pinned at the
+ *     git argv level rather than relying solely on `child_process`
+ *     honouring the `cwd:` spawn option. Both should agree, but `git -C`
+ *     is a git-internal contract independent of any subprocess cwd
+ *     inheritance race that can happen when `process.chdir()` is
+ *     interleaved with subprocess spawn under thread/fork pools.
+ *
+ *  2. **Host-repo origin bleed via parent-directory walk-up.** If `cwd`
+ *     contains an invalid `.git` (e.g. an empty directory left by an
+ *     init test setup) git normally walks UP looking for a real `.git`
+ *     and can resolve to an ancestor repository — i.e. when run from
+ *     inside the ai-sdlc-framework checkout the test would silently see
+ *     the framework's own origin rather than the fallback. We defend by
+ *     calling `git rev-parse --show-toplevel` first and confirming the
+ *     reported toplevel matches `cwd` (after symlink resolution). When
+ *     it doesn't, we treat the directory as not-a-repo and return the
+ *     fallback rather than reporting the ancestor's remote. This was
+ *     preferred over `GIT_CEILING_DIRECTORIES` because the ceiling-list
+ *     semantics only block walking INTO the listed dirs, not up FROM
+ *     them — empirically `GIT_CEILING_DIRECTORIES=<cwd>` did not stop
+ *     git from finding a parent repo.
  */
 export declare function detectGitRemote(opts?: DetectRemoteOptions): RemoteInfo;
 /**

package/dist/cli/commands/git-remote.js

@@ -9,6 +9,7 @@
  * remote is configured (e.g. a brand-new local-only repo).
  */
 import { execSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
 const FALLBACK = { org: 'your-org', repo: 'your-repo', detected: false };
 /**
  * Parse a single remote URL into org/repo. Supports:
@@ -50,13 +51,65 @@ export function parseRemoteUrl(url) {
  * Detect the GitHub-style org/repo from the project's git origin remote.
  * Returns FALLBACK with detected=false when no remote is configured or
  * when the URL cannot be parsed.
+ *
+ * The git invocation is hardened against two failure modes (AISDLC-104):
+ *
+ *  1. **cwd inheritance race under parallel test workers.** Every git
+ *     command uses `git -C <cwd>` so the working dir is pinned at the
+ *     git argv level rather than relying solely on `child_process`
+ *     honouring the `cwd:` spawn option. Both should agree, but `git -C`
+ *     is a git-internal contract independent of any subprocess cwd
+ *     inheritance race that can happen when `process.chdir()` is
+ *     interleaved with subprocess spawn under thread/fork pools.
+ *
+ *  2. **Host-repo origin bleed via parent-directory walk-up.** If `cwd`
+ *     contains an invalid `.git` (e.g. an empty directory left by an
+ *     init test setup) git normally walks UP looking for a real `.git`
+ *     and can resolve to an ancestor repository — i.e. when run from
+ *     inside the ai-sdlc-framework checkout the test would silently see
+ *     the framework's own origin rather than the fallback. We defend by
+ *     calling `git rev-parse --show-toplevel` first and confirming the
+ *     reported toplevel matches `cwd` (after symlink resolution). When
+ *     it doesn't, we treat the directory as not-a-repo and return the
+ *     fallback rather than reporting the ancestor's remote. This was
+ *     preferred over `GIT_CEILING_DIRECTORIES` because the ceiling-list
+ *     semantics only block walking INTO the listed dirs, not up FROM
+ *     them — empirically `GIT_CEILING_DIRECTORIES=<cwd>` did not stop
+ *     git from finding a parent repo.
  */
 export function detectGitRemote(opts = {}) {
     const cwd = opts.cwd ?? process.cwd();
     const exec = opts.execImpl ?? defaultExec;
+    // Step 1: confirm cwd is a real git repo whose toplevel IS cwd.
+    // If `git rev-parse --show-toplevel` errors OR returns an ancestor,
+    // treat as not-a-repo and return FALLBACK. This is the host-repo
+    // bleed defense: an empty/invalid `.git/` in cwd causes git to walk
+    // UP to a parent repo, and `--show-toplevel` then reports the parent
+    // — comparing realpaths catches it.
+    let toplevel;
+    try {
+        toplevel = exec(`git -C ${shellQuote(cwd)} rev-parse --show-toplevel`, {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return FALLBACK;
+    }
+    if (!sameDir(toplevel, cwd)) {
+        // git resolved to an ancestor repository — host-repo bleed. The
+        // operator is in a directory that isn't itself a real git root, so
+        // we deliberately do NOT report the ancestor's origin; emit
+        // FALLBACK so init prints the explicit "no git origin remote
+        // detected" message and substitutes `your-org`.
+        return FALLBACK;
+    }
+    // Step 2: ask for the origin URL. If unset (no remote configured)
+    // or unparseable, fall back.
     let url;
     try {
-        url = exec('git remote get-url origin', {
+        url = exec(`git -C ${shellQuote(cwd)} remote get-url origin`, {
             cwd,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'ignore'],
@@ -68,6 +121,32 @@ export function detectGitRemote(opts = {}) {
     const parsed = parseRemoteUrl(url);
     return parsed ?? FALLBACK;
 }
+/**
+ * Compare two filesystem paths after symlink + canonicalization to
+ * decide whether they refer to the same directory. macOS aliases /tmp
+ * to /private/tmp, so a string compare of `cwd` against the toplevel
+ * git reports would otherwise fail spuriously. Falls back to literal
+ * compare when realpath isn't available (deleted dir, permission).
+ */
+function sameDir(a, b) {
+    const norm = (p) => {
+        try {
+            return realpathSync(p);
+        }
+        catch {
+            return p;
+        }
+    };
+    return norm(a) === norm(b);
+}
+/**
+ * Quote a path for safe single-token interpolation into a shell command.
+ * Wraps in single quotes and escapes any embedded single quotes by
+ * closing the quote, emitting an escaped quote, then reopening.
+ */
+function shellQuote(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
 function defaultExec(cmd, opts) {
     return execSync(cmd, {
         cwd: opts.cwd,