session-orchestrator 3.20.0 → 3.22.0

package/scripts/lib/reconcile/renderer.mjs

@@ -262,10 +262,23 @@ export function renderRule(learning, metadata) {
   // purely by `host-class:` (loads only on a matching host) — the intended
   // behavior, and still never always-on (host-class IS an activation axis).
   if (globs.length > 0) {
-    fm.push('globs:');
-    for (const glob of globs) {
-      // Always double-quote — keeps `*`/`[`/`{` safe; loader strips quotes.
-      fm.push(`  - "${glob}"`);
+    // TWO keys, same list, on purpose (#1108). `globs:` is what THIS repo's
+    // `rule-loader.mjs` and Cursor read; `paths:` is the ONLY key Claude Code's
+    // own loader honours, and a rule without it is loaded UNCONDITIONALLY into
+    // every agent (https://code.claude.com/docs/en/memory § Path-specific
+    // rules). Emitting `globs:` alone therefore produced a rule that LOOKS
+    // scoped, IS scoped for us, and is always-on for the harness — measured
+    // 2026-08-22: 16 such rules put 72_195 bytes (~18_300 tokens) into every
+    // single dispatch. `check-rules.mjs` now hard-FAILs that shape, so a
+    // globs-only rule emitted here would be rejected by the gate the moment it
+    // lands. Keep the two lists IDENTICAL: divergence is its own FAIL class,
+    // because it would scope Claude Code and Cursor to different rule sets.
+    for (const key of ['globs', 'paths']) {
+      fm.push(`${key}:`);
+      for (const glob of globs) {
+        // Always double-quote — keeps `*`/`[`/`{` safe; loader strips quotes.
+        fm.push(`  - "${glob}"`);
+      }
     }
   }
   if (hostClass !== undefined) {

package/scripts/lib/reconcile/writer.mjs

@@ -123,12 +123,37 @@ function writeTextAtomic(destPath, content) {
  *    `globs=null, meta={}, parseError=true` → always-on again, and with empty
  *    meta it passes every gate by design.
  *
- * Scope note: the checks below fire only for a document that DECLARES
- * `auto-generated: true` (plus the parse check, which applies to every
- * document). The module's contract stays general — a caller may still write a
- * document with no frontmatter — but every document the reconcile pipeline
- * actually produces carries `auto-generated: true` on its first frontmatter
- * line, so the machine-authored path is fully covered.
+ * Scope (#1018 L2) — three tiers, deliberately not one:
+ *
+ *  1. PARSE — every document. Unparseable means unsafe, not unknown.
+ *  2. `alwaysApply: true` — every document, regardless of any marker. A rule
+ *     file that DECLARES itself always-on is precisely the outcome this gate
+ *     exists to prevent, and declaring it must not be the way around the gate.
+ *     Before #1018 this check sat behind the `auto-generated: true` branch, so
+ *     a document with `alwaysApply: true` and no `auto-generated` key was
+ *     written to disk unexamined — measured, not inferred: a `writeApprovedRules`
+ *     probe returned `written: 1` for exactly that input.
+ *  3. The never-always-on invariant set (activation axis, non-empty globs,
+ *     `learning-key`, `expires-at`) — every document carrying ANY machine-
+ *     provenance marker (`auto-generated: true`, `learning-key`, or
+ *     `expires-at`). Keying on the marker SET rather than on `auto-generated`
+ *     alone means a document that loses its `auto-generated` line to truncation
+ *     but keeps its provenance keys is still held to the invariant.
+ *
+ * Why tier 3 is marker-scoped and not universal — measured against the live
+ * corpus, not assumed: applying the invariant set to EVERY document would
+ * refuse 16 of the 29 files currently in `.claude/rules/`. Those 16 are the
+ * hand-authored always-on rules (`development.md`, `security.md`,
+ * `parallel-sessions.md`, …), for which always-on is the intended, correct
+ * shape — they carry no frontmatter at all. A universal gate would therefore
+ * refuse the legitimate majority of the corpus to catch a machine-path defect.
+ * Marker-scoped refuses 0 of 29. The module's general contract survives: a
+ * caller may still write a document with no frontmatter.
+ *
+ * CEILING (BV-004): the marker set is a fixed three-key list, not a schema
+ * lookup. Revisit if the renderer gains a fourth provenance key, or if a second
+ * non-reconcile caller of `writeApprovedRules` appears — today there is exactly
+ * one production caller and it passes renderer output.
  *
  * Mirrors `scripts/lib/validate/check-rules.mjs`, which enforces the same
  * invariants as a CI gate. Two enforcement points, one invariant: CI catches
@@ -147,37 +172,51 @@ function frontmatterRefusalReason(content) {
   }
 
   const { globs, meta } = parsed;
-
-  // Not a machine-authored auto-generated rule → the never-always-on invariant
-  // does not bind (see the scope note above).
-  if (meta['auto-generated'] !== true) return null;
+  const hasKey = (key) => Object.prototype.hasOwnProperty.call(meta, key);
 
   const problems = [];
 
-  const hasEmptyGlobs = Array.isArray(globs) && globs.length === 0;
-  const hasGlobs = Array.isArray(globs) && globs.length > 0;
-  const hasHostClass = Object.prototype.hasOwnProperty.call(meta, 'host-class');
-
-  if (hasEmptyGlobs) {
-    // NOT the "no axis" case and NOT always-on — the opposite: rule-loader.mjs
-    // excludes on `globs.length === 0` unconditionally, AFTER gating, so the
-    // rule never loads in ANY context even alongside a host-class: key.
-    problems.push('empty globs array (globs: []) — the rule would match nothing and never load in ANY context');
-  } else if (!hasGlobs && !hasHostClass) {
-    problems.push('no activation axis (globs absent AND host-class absent) — the rule would load always-on');
-  }
-  if (!Object.prototype.hasOwnProperty.call(meta, 'learning-key')) {
-    problems.push('missing required frontmatter key: learning-key');
-  }
-  if (!Object.prototype.hasOwnProperty.call(meta, 'expires-at')) {
-    problems.push('missing required frontmatter key: expires-at');
-  }
+  // ── Tier 2: binds on EVERY document (see the scope note above) ────────────
+  // Not gated behind any marker: a document that declares itself always-on is
+  // the exact outcome this gate prevents, so the declaration cannot be the
+  // escape hatch. The renderer only ever emits `alwaysApply: false`.
   if (meta.alwaysApply === true) {
-    problems.push('alwaysApply: true on an auto-generated rule — the renderer only ever emits false');
+    problems.push(
+      'alwaysApply: true — a rule written through this writer must never declare itself always-on (the renderer only ever emits false)',
+    );
+  }
+
+  // ── Tier 3: binds on any machine-provenance-bearing document ──────────────
+  // Marker-scoped rather than universal so the hand-authored always-on corpus
+  // (16 of 29 live rule files) keeps writing; marker-scoped rather than
+  // `auto-generated`-only so a document that loses that line to truncation but
+  // keeps its provenance keys is still held to the invariant.
+  const isProvenanceBearing =
+    meta['auto-generated'] === true || hasKey('learning-key') || hasKey('expires-at');
+
+  if (isProvenanceBearing) {
+    const hasEmptyGlobs = Array.isArray(globs) && globs.length === 0;
+    const hasGlobs = Array.isArray(globs) && globs.length > 0;
+    const hasHostClass = hasKey('host-class');
+
+    if (hasEmptyGlobs) {
+      // NOT the "no axis" case and NOT always-on — the opposite: rule-loader.mjs
+      // excludes on `globs.length === 0` unconditionally, AFTER gating, so the
+      // rule never loads in ANY context even alongside a host-class: key.
+      problems.push('empty globs array (globs: []) — the rule would match nothing and never load in ANY context');
+    } else if (!hasGlobs && !hasHostClass) {
+      problems.push('no activation axis (globs absent AND host-class absent) — the rule would load always-on');
+    }
+    if (!hasKey('learning-key')) {
+      problems.push('missing required frontmatter key: learning-key');
+    }
+    if (!hasKey('expires-at')) {
+      problems.push('missing required frontmatter key: expires-at');
+    }
   }
 
   if (problems.length === 0) return null;
-  return `auto-generated rule fails the never-always-on invariant: ${problems.join('; ')}`;
+  return `rule fails the never-always-on invariant: ${problems.join('; ')}`;
 }
 
 // ---------------------------------------------------------------------------

package/scripts/lib/redact-spans.mjs

@@ -0,0 +1,89 @@
+/**
+ * redact-spans.mjs — order-independent, overlap-safe span redaction primitive.
+ *
+ * Extracted verbatim from `scripts/lib/validate/check-owner-leakage.mjs` (issue
+ * #974) so that every redaction sink in the repo shares ONE implementation of the
+ * overlap-safe span merge rather than each re-deriving it (and each re-deriving
+ * the prefix/suffix bug described below). Pure and synchronous — no I/O, no
+ * module state, no dependencies — because hot-path consumers import it.
+ *
+ * Behaviour is unchanged from the original: this module is a move, not a rewrite.
+ *
+ * DELIBERATE SECOND COPY — `check-owner-leakage.mjs` still carries its OWN inline
+ * `redactSpans()` and must keep it. That scanner is a documented standalone
+ * single-file vendoring target (`.claude/rules/security.md` § "Owner-Privacy
+ * Pre-Commit Hook"): consumer repos copy that ONE file, so a static import of this
+ * module throws ERR_MODULE_NOT_FOUND in every vendored copy and blocks all commits
+ * (proven by the three cases in `tests/husky/pre-commit-owner-leakage.test.mjs`).
+ * Unlike CP11's confidential-names helpers, a redaction sink cannot degrade to
+ * inert — an absent redaction prints confidential names into a PUBLIC CI log.
+ * So: THIS module serves in-tree consumers, the inline copy serves the vendored
+ * path, and `tests/lib/redact-spans.test.mjs` pins the two byte-for-byte against
+ * each other. Edit one → that drift guard goes red until both agree again.
+ */
+
+/**
+ * Redact every confidential-name span from `line`, ORDER-INDEPENDENTLY (Fix 1 + Fix 2).
+ *
+ * This is the single redaction sink for the confidential-names privacy invariant.
+ * In `check-owner-leakage.mjs` it is applied at the print choke-point over EVERY
+ * violation's lineContent — not only CP11 hits — because that scanner runs in a
+ * PUBLIC GitHub-Actions mirror: a confidential customer/repo name that co-occurs
+ * with a CP1–CP10 hit on the same line (e.g. a name beside an RFC1918 IP that
+ * fails CP8) would otherwise be echoed verbatim to the public CI log (Fix 1).
+ *
+ * ORDER-INDEPENDENCE (Fix 2): a naïve chain of `.replace()` calls is order-dependent
+ * — when one configured name is a PREFIX of another (`['acme','acme-corp-secret']`),
+ * redacting the shorter first destroys the longer's match and leaks a suffix residue
+ * (`[REDACTED]-corp-secret`). Instead we compute ALL match spans against the ORIGINAL
+ * (unmutated) string across every pattern, merge overlapping/adjacent intervals, and
+ * splice `[REDACTED]` per merged interval. No pattern ever sees a string another
+ * pattern already rewrote, so prefix/suffix overlap cannot leak regardless of list
+ * order.
+ *
+ * @param {string} line — the raw (already-trimmed) violation lineContent.
+ * @param {RegExp[]} patterns — confidential-name regexes (word-boundary, case-insensitive).
+ * @returns {string} the line with every configured name span replaced by [REDACTED].
+ */
+export function redactSpans(line, patterns) {
+  if (!Array.isArray(patterns) || patterns.length === 0) return line;
+
+  // 1. Collect [start, end) spans of every match of every pattern against the
+  //    ORIGINAL line (never a partially-mutated one). Global clone so exec() walks
+  //    all matches; zero-width guard prevents an infinite loop on a degenerate regex.
+  const spans = [];
+  for (const re of patterns) {
+    const g = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
+    let m;
+    while ((m = g.exec(line)) !== null) {
+      if (m[0].length === 0) {
+        g.lastIndex += 1;
+        continue;
+      }
+      spans.push([m.index, m.index + m[0].length]);
+    }
+  }
+  if (spans.length === 0) return line;
+
+  // 2. Merge overlapping / adjacent intervals (sorted by start).
+  spans.sort((a, b) => a[0] - b[0]);
+  const merged = [];
+  for (const [s, e] of spans) {
+    const last = merged[merged.length - 1];
+    if (last && s <= last[1]) {
+      last[1] = Math.max(last[1], e);
+    } else {
+      merged.push([s, e]);
+    }
+  }
+
+  // 3. Splice [REDACTED] per merged interval, left-to-right over the ORIGINAL line.
+  let out = '';
+  let cursor = 0;
+  for (const [s, e] of merged) {
+    out += line.slice(cursor, s) + '[REDACTED]';
+    cursor = e;
+  }
+  out += line.slice(cursor);
+  return out;
+}