session-orchestrator 3.16.0

package/scripts/lib/vault-mirror/auto-commit.mjs

@@ -0,0 +1,203 @@
+/**
+ * auto-commit.mjs — Auto-commit phase for vault-mirror (Issue #31, #283 split).
+ *
+ * After a successful mirror pass, optionally commits all staged mirror artifacts
+ * in 40-learnings/ and 50-sessions/ as a single chore(vault) commit.
+ *
+ * Exports: autoCommitVaultMirror
+ */
+
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const GENERATOR_MARKER = 'session-orchestrator-vault-mirror@1';
+const MIRROR_DIRS = ['40-learnings', '50-sessions'];
+
+function isMirrorArtifact(absPath) {
+  try {
+    const head = readFileSync(absPath, 'utf8').slice(0, 4096);
+    return head.includes(`_generator: ${GENERATOR_MARKER}`);
+  } catch {
+    return false;
+  }
+}
+
+function git(vaultDirPath, gitArgs) {
+  return spawnSync('git', ['-C', vaultDirPath, ...gitArgs], { encoding: 'utf8' });
+}
+
+/**
+ * Auto-commit mirror artifacts in the vault after a vault-mirror pass.
+ *
+ * Behaviour:
+ *   1. `git add 40-learnings/ 50-sessions/` (only paths that exist).
+ *      When `repo` is provided: scoped to `40-learnings/<repo>` and `50-sessions/<repo>`.
+ *   2. Enumerate staged paths; per-file frontmatter check for the generator marker.
+ *   3. All-mirror staged set → commit as `chore(vault): mirror <session-id> — N learnings + M sessions`.
+ *   4. Mismatch (any non-mirror staged path) → unstage all, log warn, no commit.
+ *   5. Empty staged set → idempotent no-op.
+ *   6. When `repo` is provided: any staged file belonging to a different repo namespace
+ *      → unstage all, log warn, emit `cross-repo-staged-changes`, no commit.
+ *
+ * @param {string} vaultDirPath - Absolute path to the vault git repo root.
+ * @param {string} sessionId - Session identifier used in the commit subject.
+ * @param {string|undefined|null} repo - Sanitised single-segment namespace (e.g. "session-orchestrator").
+ *   When omitted/null, behaves exactly as the pre-namespace version (whole-dir staging, no cross-repo check).
+ *
+ * Emits one JSON action line on stdout describing the outcome.
+ * Never throws — callers continue regardless of commit outcome.
+ */
+export function autoCommitVaultMirror(vaultDirPath, sessionId, repo) {
+  // Determine staging targets: whole dirs (legacy) or per-repo subfolders (namespaced).
+  const useNamespace = typeof repo === 'string' && repo.length > 0;
+
+  let stagingTargets;
+  if (useNamespace) {
+    // Stage only the per-repo subfolders; filter to those that exist.
+    const candidates = MIRROR_DIRS.map((d) => `${d}/${repo}`);
+    stagingTargets = candidates.filter((p) => existsSync(resolve(vaultDirPath, p)));
+  } else {
+    // Legacy: stage entire mirror dirs that exist.
+    stagingTargets = MIRROR_DIRS.filter((d) => existsSync(resolve(vaultDirPath, d)));
+  }
+
+  if (stagingTargets.length === 0) {
+    process.stdout.write(
+      JSON.stringify({ action: 'auto-commit-skipped', reason: 'no-mirror-dirs' }) + '\n',
+    );
+    return;
+  }
+
+  const repoCheck = git(vaultDirPath, ['rev-parse', '--git-dir']);
+  if (repoCheck.status !== 0) {
+    process.stdout.write(
+      JSON.stringify({ action: 'auto-commit-skipped', reason: 'not-a-git-repo' }) + '\n',
+    );
+    return;
+  }
+
+  const addResult = git(vaultDirPath, ['add', '--', ...stagingTargets]);
+  if (addResult.status !== 0) {
+    process.stderr.write(`vault-mirror: auto-commit git-add failed: ${addResult.stderr}\n`);
+    process.stdout.write(
+      JSON.stringify({ action: 'auto-commit-skipped', reason: 'git-add-failed' }) + '\n',
+    );
+    return;
+  }
+
+  const diff = git(vaultDirPath, ['diff', '--cached', '--name-only', '--', ...stagingTargets]);
+  if (diff.status !== 0) {
+    process.stderr.write(`vault-mirror: auto-commit git-diff failed: ${diff.stderr}\n`);
+    process.stdout.write(
+      JSON.stringify({ action: 'auto-commit-skipped', reason: 'git-diff-failed' }) + '\n',
+    );
+    return;
+  }
+
+  const stagedPaths = diff.stdout.split('\n').map((s) => s.trim()).filter(Boolean);
+
+  if (stagedPaths.length === 0) {
+    process.stdout.write(
+      JSON.stringify({ action: 'auto-commit-noop', reason: 'no-staged-changes' }) + '\n',
+    );
+    return;
+  }
+
+  const offenders = [];
+  const outOfNamespace = [];
+  let learningsCount = 0;
+  let sessionsCount = 0;
+  const vaultRootAbs = resolve(vaultDirPath);
+  for (const rel of stagedPaths) {
+    const abs = resolve(vaultDirPath, rel);
+    // Containment guard (#660 Q3-LOW-2): a staged path that resolves outside the
+    // vault dir (e.g. a crafted `..` entry in the index) is treated as a non-mirror
+    // offender — never read by isMirrorArtifact, never committed.
+    if (!abs.startsWith(vaultRootAbs + sep)) {
+      offenders.push(rel);
+      continue;
+    }
+    if (!isMirrorArtifact(abs)) {
+      offenders.push(rel);
+      continue;
+    }
+    // Cross-repo isolation check (only when repo is provided).
+    if (useNamespace) {
+      // Extract the second path segment: `<mirrorDir>/<seg>/...`
+      const parts = rel.split('/');
+      const seg = parts[1]; // undefined for shallow paths; those pass through unguarded
+      if (seg !== undefined && seg !== repo) {
+        outOfNamespace.push(rel);
+        continue;
+      }
+    }
+    if (rel.startsWith('40-learnings/')) learningsCount++;
+    else if (rel.startsWith('50-sessions/')) sessionsCount++;
+  }
+
+  if (offenders.length > 0) {
+    git(vaultDirPath, ['restore', '--staged', '--', ...stagingTargets]);
+    process.stderr.write(
+      `vault-mirror: auto-commit skipped — ${offenders.length} non-mirror staged file(s): ${offenders.slice(0, 3).join(', ')}${offenders.length > 3 ? ', …' : ''}\n`,
+    );
+    process.stdout.write(
+      JSON.stringify({
+        action: 'auto-commit-skipped',
+        reason: 'non-mirror-staged-changes',
+        offenders,
+      }) + '\n',
+    );
+    return;
+  }
+
+  if (outOfNamespace.length > 0) {
+    // Derive the foreign repo segments for the warning message (don't echo file contents).
+    const foreignSegs = [...new Set(outOfNamespace.map((rel) => rel.split('/')[1]).filter(Boolean))];
+    git(vaultDirPath, ['restore', '--staged', '--', ...stagingTargets]);
+    process.stderr.write(
+      `vault-mirror: auto-commit skipped — ${outOfNamespace.length} file(s) belong to foreign repo namespace(s): ${foreignSegs.join(', ')}\n`,
+    );
+    process.stdout.write(
+      JSON.stringify({
+        action: 'auto-commit-skipped',
+        reason: 'cross-repo-staged-changes',
+        foreignRepos: foreignSegs,
+      }) + '\n',
+    );
+    return;
+  }
+
+  const subject = `chore(vault): mirror ${sessionId} — ${learningsCount} learnings + ${sessionsCount} sessions`;
+  // --no-verify is intentional (issue #603). This is an unattended machine auto-commit at
+  // session-end Phase 3.7 / evolve Phase 3.5. Two reasons the vault's pre-commit hooks are
+  // bypassed here:
+  //   1. Redundant validation — every staged path has already passed isMirrorArtifact() above
+  //      (generator-marker frontmatter check), which supersets what the vault's frontmatter /
+  //      wiki-link validator hook would re-check. The files were written by vault-mirror's own
+  //      generator, which enforces conformant frontmatter before they ever reach this commit.
+  //   2. Must not block an unattended close — an interactive, slow, or failing vault-side hook
+  //      would stall session-end. Per .claude/rules/development.md Git Safety Protocol the bypass
+  //      is allowed because it is explicit, documented (skills/vault-mirror/SKILL.md), and the
+  //      committed content is already validated. See SKILL.md § "Pre-commit hook bypass (--no-verify)".
+  const commit = git(vaultDirPath, ['commit', '-m', subject, '--no-verify']);
+  if (commit.status !== 0) {
+    process.stderr.write(`vault-mirror: auto-commit git-commit failed: ${commit.stderr}\n`);
+    process.stdout.write(
+      JSON.stringify({ action: 'auto-commit-skipped', reason: 'git-commit-failed' }) + '\n',
+    );
+    return;
+  }
+
+  const sha = git(vaultDirPath, ['rev-parse', 'HEAD']).stdout.trim();
+  process.stdout.write(
+    JSON.stringify({
+      action: 'auto-commit-created',
+      sha,
+      subject,
+      learnings: learningsCount,
+      sessions: sessionsCount,
+      files: stagedPaths.length,
+    }) + '\n',
+  );
+}

package/scripts/lib/vault-mirror/namespace.mjs

@@ -0,0 +1,152 @@
+/**
+ * namespace.mjs — Per-project vault namespace resolver (Issue #660).
+ *
+ * Derives a single-segment, sanitised, leak-guarded directory name that scopes
+ * vault writes under `40-learnings/<repoNs>/` and `50-sessions/<repoNs>/`.
+ *
+ * Contract:
+ *   resolveRepoNamespace({ vaultName?, cwd? }) → string
+ *
+ *   - Pure + deterministic (given the same git remote / cwd / vaultName input,
+ *     and the same host-local pseudonym map).
+ *   - Returns a lowercase kebab slug safe for use as a filesystem path segment.
+ *   - Host-local pseudonym mapping (Epic #725 D5): consulted ONLY at the redaction
+ *     site (only when a segment is owner-leaky). If such a repo (raw or sanitised)
+ *     appears in the operator's host-local namespace map, its stable pseudonym is
+ *     returned INSTEAD of collapsing to 'redacted-repo'. This preserves per-repo
+ *     write-isolation (#660) for the N owner-leaky private repos AND keeps
+ *     cross-repo attribution stable — without ever writing the real name to the
+ *     vault. The map is resolved lazily (owner.yaml / env SO_NAMESPACE_MAP) and
+ *     cached per process; the lazy read is touched only on the leaky path, so clean
+ *     repos add zero fs I/O.
+ *   - Redacts UNMAPPED owner-privacy leaks (CP1/CP6/CP10) to 'redacted-repo' +
+ *     stderr WARN — identical to pre-#725 behaviour when no map is configured.
+ *   - Falls back to 'unknown-repo' when slug derivation produces an empty string.
+ */
+
+import { deriveRepo } from './process.mjs';
+import { subjectToSlug } from './utils.mjs';
+import { isOwnerLeakySegment } from '../../lib/validate/check-owner-leakage.mjs';
+import { loadPseudonymMap } from './pseudonym-map.mjs';
+import { loadHostPaths, resolveHostPath } from '../config/host-paths.mjs';
+
+// ── Lazy pseudonym-map path resolution (Epic #725 D5) ────────────────────────
+// The map path comes from env SO_NAMESPACE_MAP > owner.yaml paths.namespace-map-path
+// > '' (unconfigured). resolveRepoNamespace is called once per mirrored record, so
+// the resolved PATH is cached per process (the parsed MAP itself is cached inside
+// pseudonym-map.mjs). `_mapPathOverride` is a TEST-ONLY seam: `undefined` = resolve
+// lazily from host-paths; `null` = force "no map"; a string = use that path — this
+// lets namespace.test.mjs stay deterministic and insulated from the machine's real
+// owner.yaml.
+let _mapPathOverride;
+let _lazyPathResolved = false;
+let _lazyPath = '';
+
+/** Test-only: pin the pseudonym-map path (`null` = no map, string = explicit path). */
+export function _setNamespaceMapPath(value) {
+  _mapPathOverride = value;
+}
+
+/** Test-only: clear the map-path override AND the lazy path cache. */
+export function _resetNamespaceMapState() {
+  _mapPathOverride = undefined;
+  _lazyPathResolved = false;
+  _lazyPath = '';
+}
+
+/** Resolve the pseudonym-map path (test override → cached lazy host-path resolution). */
+function currentMapPath() {
+  if (_mapPathOverride !== undefined) return _mapPathOverride;
+  if (_lazyPathResolved) return _lazyPath;
+  _lazyPathResolved = true;
+  try {
+    const ctx = loadHostPaths();
+    _lazyPath = resolveHostPath('namespace-map-path', '', ctx) ?? '';
+  } catch {
+    _lazyPath = '';
+  }
+  return _lazyPath;
+}
+
+/**
+ * Look up a stable pseudonym for this repo. Checks the sanitised segment first
+ * (the canonical, stable key) then the raw base (covers a vaultName override
+ * passed verbatim). Returns null when no map is configured or no entry matches.
+ *
+ * @param {string} base - raw repo identifier.
+ * @param {string} seg  - sanitised kebab segment derived from `base`.
+ * @returns {string|null}
+ */
+function lookupPseudonym(base, seg) {
+  const mapPath = currentMapPath();
+  if (typeof mapPath !== 'string' || mapPath.trim() === '') return null;
+  const map = loadPseudonymMap({ mapPath });
+  if (!map) return null;
+  if (seg && map.has(seg)) return map.get(seg);
+  if (base && map.has(base)) return map.get(base);
+  return null;
+}
+
+/**
+ * Resolve the sanitised repository namespace segment for vault path scoping.
+ *
+ * @param {object}  [opts]
+ * @param {string|null} [opts.vaultName] - Optional override for the repo identifier.
+ *   When non-empty and non-whitespace, used in place of the git-derived repo name.
+ *   When absent, the namespace is derived from the git origin via deriveRepo().
+ * @returns {string} A single kebab-slug path segment, e.g. 'session-orchestrator'.
+ *   Special returns:
+ *   - 'unknown-repo'  — slug derivation produced an empty string.
+ *   - 'redacted-repo' — the raw or slugified value matched an owner-leakage pattern
+ *     (CP1 personal home path / CP6 private slug / CP10 personal name in Projects path).
+ */
+export function resolveRepoNamespace({ vaultName = null } = {}) {
+  // Choose the base identifier: explicit override first, then git-derived.
+  const base = (vaultName && typeof vaultName === 'string' && vaultName.trim())
+    ? vaultName.trim()
+    : deriveRepo();
+
+  // Sanitise: collapse to last path segment, lowercase, strip non-[a-z0-9-].
+  const seg = subjectToSlug(base);
+
+  // Leak-guard: check both the raw base AND the sanitised segment.
+  // A personal home path or a private project slug must be caught before writing
+  // to the vault. We check both forms because:
+  //   - CP1 matches the raw base (contains the personal home path prefix)
+  //   - CP6/CP10 may match either form depending on how the slug strips context
+  //
+  // Host-local pseudonym mapping (Epic #725 D5): the map is consulted ONLY at the
+  // redaction site — i.e. only when a segment IS owner-leaky. A mapped leaky repo
+  // returns its stable pseudonym INSTEAD of collapsing to 'redacted-repo' (which is
+  // the D5 goal: distinct per-repo namespaces + stable attribution for the N private
+  // repos, without ever writing the real name to the vault). Because the map (and its
+  // lazy owner.yaml read) is touched only on the leaky path, clean repos stay 100%
+  // side-effect-free — identical to pre-#725 behaviour, and no fs I/O is added to the
+  // common non-leaky path. Unmapped leaky segments fall through to redaction unchanged.
+  const rawMatch = isOwnerLeakySegment(base);
+  if (rawMatch !== null) {
+    const pseudonym = lookupPseudonym(base, seg);
+    if (pseudonym) return pseudonym;
+    process.stderr.write(
+      `WARN vault-mirror/namespace: owner-privacy leak detected in repo identifier (pattern: ${rawMatch}); redacting to 'redacted-repo'\n`,
+    );
+    return 'redacted-repo';
+  }
+
+  const segMatch = isOwnerLeakySegment(seg);
+  if (segMatch !== null) {
+    const pseudonym = lookupPseudonym(base, seg);
+    if (pseudonym) return pseudonym;
+    process.stderr.write(
+      `WARN vault-mirror/namespace: owner-privacy leak detected in sanitised namespace segment (pattern: ${segMatch}); redacting to 'redacted-repo'\n`,
+    );
+    return 'redacted-repo';
+  }
+
+  // Fallback for degenerate inputs (empty slug after sanitisation).
+  if (!seg) {
+    return 'unknown-repo';
+  }
+
+  return seg;
+}