session-orchestrator 3.19.0 → 3.21.0

package/scripts/lib/redact-spans.mjs

@@ -0,0 +1,89 @@
+/**
+ * redact-spans.mjs — order-independent, overlap-safe span redaction primitive.
+ *
+ * Extracted verbatim from `scripts/lib/validate/check-owner-leakage.mjs` (issue
+ * #974) so that every redaction sink in the repo shares ONE implementation of the
+ * overlap-safe span merge rather than each re-deriving it (and each re-deriving
+ * the prefix/suffix bug described below). Pure and synchronous — no I/O, no
+ * module state, no dependencies — because hot-path consumers import it.
+ *
+ * Behaviour is unchanged from the original: this module is a move, not a rewrite.
+ *
+ * DELIBERATE SECOND COPY — `check-owner-leakage.mjs` still carries its OWN inline
+ * `redactSpans()` and must keep it. That scanner is a documented standalone
+ * single-file vendoring target (`.claude/rules/security.md` § "Owner-Privacy
+ * Pre-Commit Hook"): consumer repos copy that ONE file, so a static import of this
+ * module throws ERR_MODULE_NOT_FOUND in every vendored copy and blocks all commits
+ * (proven by the three cases in `tests/husky/pre-commit-owner-leakage.test.mjs`).
+ * Unlike CP11's confidential-names helpers, a redaction sink cannot degrade to
+ * inert — an absent redaction prints confidential names into a PUBLIC CI log.
+ * So: THIS module serves in-tree consumers, the inline copy serves the vendored
+ * path, and `tests/lib/redact-spans.test.mjs` pins the two byte-for-byte against
+ * each other. Edit one → that drift guard goes red until both agree again.
+ */
+
+/**
+ * Redact every confidential-name span from `line`, ORDER-INDEPENDENTLY (Fix 1 + Fix 2).
+ *
+ * This is the single redaction sink for the confidential-names privacy invariant.
+ * In `check-owner-leakage.mjs` it is applied at the print choke-point over EVERY
+ * violation's lineContent — not only CP11 hits — because that scanner runs in a
+ * PUBLIC GitHub-Actions mirror: a confidential customer/repo name that co-occurs
+ * with a CP1–CP10 hit on the same line (e.g. a name beside an RFC1918 IP that
+ * fails CP8) would otherwise be echoed verbatim to the public CI log (Fix 1).
+ *
+ * ORDER-INDEPENDENCE (Fix 2): a naïve chain of `.replace()` calls is order-dependent
+ * — when one configured name is a PREFIX of another (`['acme','acme-corp-secret']`),
+ * redacting the shorter first destroys the longer's match and leaks a suffix residue
+ * (`[REDACTED]-corp-secret`). Instead we compute ALL match spans against the ORIGINAL
+ * (unmutated) string across every pattern, merge overlapping/adjacent intervals, and
+ * splice `[REDACTED]` per merged interval. No pattern ever sees a string another
+ * pattern already rewrote, so prefix/suffix overlap cannot leak regardless of list
+ * order.
+ *
+ * @param {string} line — the raw (already-trimmed) violation lineContent.
+ * @param {RegExp[]} patterns — confidential-name regexes (word-boundary, case-insensitive).
+ * @returns {string} the line with every configured name span replaced by [REDACTED].
+ */
+export function redactSpans(line, patterns) {
+  if (!Array.isArray(patterns) || patterns.length === 0) return line;
+
+  // 1. Collect [start, end) spans of every match of every pattern against the
+  //    ORIGINAL line (never a partially-mutated one). Global clone so exec() walks
+  //    all matches; zero-width guard prevents an infinite loop on a degenerate regex.
+  const spans = [];
+  for (const re of patterns) {
+    const g = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
+    let m;
+    while ((m = g.exec(line)) !== null) {
+      if (m[0].length === 0) {
+        g.lastIndex += 1;
+        continue;
+      }
+      spans.push([m.index, m.index + m[0].length]);
+    }
+  }
+  if (spans.length === 0) return line;
+
+  // 2. Merge overlapping / adjacent intervals (sorted by start).
+  spans.sort((a, b) => a[0] - b[0]);
+  const merged = [];
+  for (const [s, e] of spans) {
+    const last = merged[merged.length - 1];
+    if (last && s <= last[1]) {
+      last[1] = Math.max(last[1], e);
+    } else {
+      merged.push([s, e]);
+    }
+  }
+
+  // 3. Splice [REDACTED] per merged interval, left-to-right over the ORIGINAL line.
+  let out = '';
+  let cursor = 0;
+  for (const [s, e] of merged) {
+    out += line.slice(cursor, s) + '[REDACTED]';
+    cursor = e;
+  }
+  out += line.slice(cursor);
+  return out;
+}

package/scripts/lib/scope-baseline.mjs

@@ -124,6 +124,7 @@ import { execFileSync } from 'node:child_process';
 
 import { parseStateMd, serializeStateMd, resolveStateMdPath, writeStateMd } from './state-md.mjs';
 import { pathMatchesPattern } from './scope-gate.mjs';
+import { resolveBaselineRange, isQueryFailure } from './vcs-repo-spec.mjs';
 
 // ---------------------------------------------------------------------------
 // DRIFT_EXCLUDE_PATTERNS — the SINGLE filter source for both the denominator
@@ -472,23 +473,60 @@ export async function writeBaseline({ repoRoot, intent, ownerBoundary, plannedFi
  *
  * Skip precedence (first match wins, so `reason` is deterministic):
  *   `no-state-md` → `unreadable-state-md` → `no-baseline` →
- *   `stale-baseline` → `unresolvable-ref`
+ *   `stale-baseline` → (`no-baseline-ref` | `unresolvable-ref`)
  *
- * `session-start-ref` handling — MISSING vs UNRESOLVABLE are different:
- *   - Field absent from frontmatter → falls back to
- *     `git diff --name-only origin/main...HEAD` (the documented fallback,
- *     skills/session-end/plan-verification.md:37). This is NOT a skip —
- *     `refUsed` reports the fallback ref actually used.
- *   - Field present but the diff against it fails (rebase, force-push,
- *     deleted commit, …) → skip with `reason: 'unresolvable-ref'`.
+ * `session-start-ref` handling — THREE outcomes, deliberately distinct.
+ * `skills/_shared/state-ownership.md:28` declares the field OPTIONAL
+ * ("readers MUST tolerate their absence"), so the absent-field branch is a
+ * REACHABLE production path, not a defensive corner:
+ *
+ *   - **Field present**, diff against it succeeds → measured; `refUsed`
+ *     reports the bare ref verbatim (NOT a range — pre-existing contract,
+ *     unchanged).
+ *   - **Field absent** → the range is RESOLVED via `resolveBaselineRange()`
+ *     (scripts/lib/vcs-repo-spec.mjs): preferred remote `R` →
+ *     `refs/remotes/<R>/HEAD` → `refs/remotes/<R>/{main,master}` → local
+ *     `{main,master}`. NOT a skip — `refUsed` reports the range actually
+ *     resolved (`gitlab/main...HEAD`, `origin/master...HEAD`, …).
+ *     This REPLACES the hard-coded `'origin/main...HEAD'` literal the
+ *     function carried until #1039, which hard-coded BOTH the remote name
+ *     AND the default branch in one string. In any repo whose remote is not
+ *     named `origin`, or whose default branch is not `main`, that diff
+ *     always failed → the tripwire skipped → and
+ *     `skills/wave-executor/wave-loop.md` renders every `skipped === true`
+ *     with NO WARN. A guard that neither bit nor reported that it was not
+ *     biting.
+ *   - **Field absent AND nothing resolves** (fresh `git init`, no remotes,
+ *     no `main`/`master` anywhere) → skip with `reason: 'no-baseline-ref'`.
+ *     This is an ABSENCE — there is genuinely no session base to measure
+ *     against — and is deliberately NOT folded onto `unresolvable-ref`,
+ *     which means the QUERY failed (not a git repo, git not on PATH, a
+ *     present-but-dead `session-start-ref` after a rebase/force-push).
+ *     The split follows `isQueryFailure()` from the same module, the single
+ *     predicate that separates "I could not ask" from "I asked; the answer
+ *     is no". Folding them was the pre-#1039 behaviour and made an operator
+ *     unable to tell a broken checkout from a fresh repo.
+ *
+ * Named ceiling (BV-004) on the local-branch tail of the resolution chain:
+ * when the chain lands on a LOCAL `main`/`master` and HEAD is already that
+ * branch, `main...HEAD` has merge-base === HEAD and the diff is empty, so
+ * the ratio reads `0` instead of skipping. That is the honest floor of the
+ * available information (no remote-tracking ref exists to say where the
+ * session started) and it is harmless here because both a `0` ratio and a
+ * skip are silent under `wave-loop.md`'s WARN-on-breach rule. Revisit if
+ * this function ever gains a non-warn consumer that treats `skipped:false`
+ * as "measured successfully".
  *
  * @param {object} args
  * @param {string|undefined} args.repoRoot
  * @param {number} [args.threshold] — breach threshold, `>=` counts as
  *   breached (default `2.0`).
- * @returns {{ ok: true, skipped: true, reason: 'no-state-md'|'unreadable-state-md'|'no-baseline'|'stale-baseline'|'unresolvable-ref' }
+ * @returns {{ ok: true, skipped: true, reason: 'no-state-md'|'unreadable-state-md'|'no-baseline'|'stale-baseline'|'no-baseline-ref'|'unresolvable-ref' }
  *   | { ok: true, skipped: false, filesRatio: number, plannedFiles: number,
  *       actualFiles: number, breached: boolean, threshold: number, refUsed: string }}
+ *   Additive since #1039: `no-baseline-ref` is a NEW member of the skip-reason
+ *   union. No existing member was renamed or removed, and the measured-result
+ *   shape (all eight keys) is byte-identical to the pre-#1039 contract.
  */
 export function computeDrift({ repoRoot, threshold = 2.0 } = {}) {
   const parsedFm = readFrontmatterOrReason(repoRoot);
@@ -514,18 +552,40 @@ export function computeDrift({ repoRoot, threshold = 2.0 } = {}) {
     ? baseline.sessionStartRef
     : null;
 
-  const diffArgs = rawRef !== null
-    ? ['diff', '--name-only', `${rawRef}..HEAD`]
-    : ['diff', '--name-only', 'origin/main...HEAD'];
-  const refUsed = rawRef ?? 'origin/main...HEAD';
+  // Resolve the diff range. The `session-start-ref` branch keeps its exact
+  // pre-#1039 shape (two-dot `<ref>..HEAD`, `refUsed` = the bare ref); only
+  // the absent-field branch changed, from a hard-coded literal to a real
+  // resolution. See the JSDoc above for the three outcomes.
+  let diffRange;
+  let refUsed;
+  if (rawRef !== null) {
+    diffRange = `${rawRef}..HEAD`;
+    refUsed = rawRef;
+  } else {
+    const resolved = resolveBaselineRange({ repoRoot: cwd });
+    if (!resolved.ok) {
+      // `isQueryFailure()` is the frozen predicate that keeps the two causes
+      // apart: a broken/absent git ⇒ `unresolvable-ref` (degraded
+      // measurement), a repo that simply has no baseline ref ⇒
+      // `no-baseline-ref` (a real, benign repo state).
+      return {
+        ok: true,
+        skipped: true,
+        reason: isQueryFailure(resolved.reason) ? 'unresolvable-ref' : 'no-baseline-ref',
+      };
+    }
+    diffRange = resolved.range;
+    refUsed = resolved.range;
+  }
 
   let stdout;
   try {
-    stdout = execFileSync('git', diffArgs, { cwd, encoding: 'utf8' });
+    stdout = execFileSync('git', ['diff', '--name-only', diffRange], { cwd, encoding: 'utf8' });
   } catch {
-    // Ref present-but-unresolvable (rebase, force-push, deleted commit) OR
-    // the fallback diff itself failed (e.g. no origin/main) — both land in
-    // the same skip bucket; neither can produce a trustworthy numerator.
+    // The range resolved but the diff against it failed — a present-but-dead
+    // `session-start-ref` (rebase, force-push, deleted commit), or a
+    // resolved base that vanished between resolution and diff. Neither can
+    // produce a trustworthy numerator.
     return { ok: true, skipped: true, reason: 'unresolvable-ref' };
   }