session-orchestrator 3.17.0 → 3.20.0

package/scripts/lib/hardening.mjs

@@ -3,18 +3,21 @@
  *
  * The original 691-line module bundled THREE structurally-independent concerns.
  * They now live in dedicated modules (Epic A4 split); this file is a pure
- * re-export barrel that preserves the original import surface (all 11 symbols)
+ * re-export barrel that preserves the surviving import surface (9 symbols)
  * so existing importers keep working UNCHANGED:
- *   - hooks/enforce-commands.mjs, hooks/enforce-scope.mjs,
- *     hooks/post-edit-validate.mjs, hooks/pre-bash-destructive-guard.mjs,
+ *   - hooks/enforce-commands.mjs, hooks/enforce-scope.mjs (both bind the barrel
+ *     via armGuard), hooks/post-bash-write-verify.mjs, hooks/post-edit-validate.mjs,
  *     hooks/pre-bash-memory-propose-audit.mjs, hooks/wave-scope-commit-guard.mjs
- *   - scripts/lib/io.mjs, scripts/lib/pre-dispatch-check.mjs,
- *     scripts/lib/worktree-freshness.mjs
+ *   - scripts/lib/pre-dispatch-check.mjs, scripts/lib/worktree-freshness.mjs
  *
  * Concern split:
  *   A) Env / runtime checks                → ./env-check.mjs
  *   B) Scope / pattern primitives          → ./scope-gate.mjs
- *   C) Command-blocking tokenizer + matcher → ./command-blocker.mjs
+ *   C) Command-blocking tokenizer + matcher → ./command-blocker.mjs. The
+ *      command-blocker primitives (tokenizeCommand, commandMatchesBlocked,
+ *      suggestForCommandBlock) were re-exported through this barrel until #996.3;
+ *      consumers now import them DIRECTLY from ./command-blocker.mjs, so this
+ *      barrel no longer touches concern C.
  *
  * The new modules MUST NOT import from this barrel (would cycle).
  *
@@ -38,6 +41,3 @@ export {
   extractBashWriteTargets,
   suggestForScopeViolation,
 } from './scope-gate.mjs';
-
-// C) Command-blocking tokenizer + matcher
-export { tokenizeCommand, commandMatchesBlocked, suggestForCommandBlock } from './command-blocker.mjs';

package/scripts/lib/harness-audit/categories/category4.mjs

@@ -12,6 +12,7 @@ import { join, relative, sep } from 'node:path';
 
 import { parseFrontmatter, safeRead, parseJsonl, pass, fail } from './helpers.mjs';
 import { isRealSession } from '../../session-schema/filters.mjs';
+import { findSessionConfigBlock } from '../../config/section-extractor.mjs';
 
 // Default session-lock TTL in hours — mirrors DEFAULT_TTL_HOURS in
 // scripts/lib/session-lock.mjs. Inlined to keep this category stdlib-only
@@ -159,9 +160,14 @@ export function runCategory4(root) {
     const relPath = 'skills/vault-sync/validator.mjs';
     // Parse CLAUDE.md Session Config for vault-integration.enabled
     const claudeMd = safeRead(join(root, 'CLAUDE.md')) || safeRead(join(root, 'AGENTS.md')) || '';
-    // Extract ## Session Config block
-    const scMatch = /^## Session Config\s*\n([\s\S]*?)(?=^## |\s*$)/m.exec(claudeMd);
-    const scBlock = scMatch ? scMatch[1] : '';
+    // Extract ## Session Config block via the SSOT (#968). The previous local
+    // regex `/^## Session Config\s*\n([\s\S]*?)(?=^## |\s*$)/m` was not merely
+    // a looser heading test — its `\s*$` lookahead (with /m, `$` matches at
+    // every line end) truncated the body to the block's FIRST line. On this
+    // repo's own CLAUDE.md it captured 17 chars ("persistence: true") of 2877,
+    // so `vault-integration.enabled: true` was invisible and this check
+    // reported "not enabled — skip" at full 2/2 credit.
+    const scBlock = findSessionConfigBlock(claudeMd)?.body ?? '';
     const vaultEnabledMatch = /vault-integration\.enabled:\s*true/i.exec(scBlock) ||
       /vault-integration:\s*\n\s+enabled:\s*true/im.exec(scBlock);
     const vaultEnabled = Boolean(vaultEnabledMatch);