session-orchestrator 3.20.0 → 3.22.0

package/scripts/lib/validate/frontmatter-block.mjs

@@ -0,0 +1,61 @@
+// frontmatter-block.mjs — Extract the leading `---`-fenced YAML block from a Markdown file.
+//
+// SHARED: THE EXTRACTION. NOT SHARED: THE RULES.
+//
+// This module owns exactly one thing — finding the frontmatter block's byte range and
+// handing back its text. It deliberately owns NOTHING about what a valid frontmatter
+// contains. Do not grow it into a validator, and do not "unify" the callers' rules
+// against it: the three frontmatter checkers in this directory disagree on purpose.
+//
+//   * check-agents.mjs   BANS  `description: >` — the agent loader cannot read a folded
+//                              block scalar, so the form is a live defect for agents/*.md.
+//   * check-skills.mjs   ALLOWS `description: >` — for SKILL.md the sign is REVERSED: the
+//                              folded scalar is the only form that makes the `: `
+//                              collision inside an unquoted description structurally
+//                              impossible. Measured 2026-08-15: 23 of 46 SKILL.md files
+//                              use it, and porting the agent ban here would red 35 of 46.
+//   * check-commands.mjs has its own, narrower field contract again (`argument-hint`).
+//
+// Those divergences are the product requirement, not drift. What WAS drift is this
+// function: it stood verbatim in check-skills.mjs and check-commands.mjs, so the next
+// change to the block format (a BOM, a new delimiter tolerance) would have been made in
+// one copy and one gate would have started accepting what the other rejects — with no
+// test able to see it, because each gate tested its own copy.
+//
+// BEHAVIOUR IS PINNED, NOT ASPIRATIONAL. tests/lib/validate/frontmatter-block.test.mjs
+// documents what the body does today, including the two sharp edges below. Both are
+// intentional records of the status quo, NOT endorsements — changing either is a
+// behaviour change under two gates at once and needs its own task, not a drive-by edit.
+//
+//   1. CRLF input is handled: the split is `/\r?\n/`, so a CRLF file's first line
+//      compares equal to '---' and the returned yamlText is LF-normalised.
+//   2. A line that is exactly `---` INSIDE the block (e.g. an unindented `---` inside a
+//      multi-line string) terminates the block early. Only a column-0, whitespace-free
+//      `---` does this; an indented `  ---` is ordinary content.
+
+/**
+ * Extract the YAML frontmatter block delimited by the leading `---` fence.
+ *
+ * The opening fence must be the very first line of the file. The closing fence is the
+ * first subsequent line equal to `---`. Line endings may be LF or CRLF; the returned
+ * text is always LF-joined.
+ *
+ * @param {string} content - full file text
+ * @returns {{ ok: true, yamlText: string } | { ok: false, diagnostic: string }}
+ *   On success, `yamlText` is the block's inner text with no fences (empty string for an
+ *   empty block). On failure, `diagnostic` is a caller-printable reason and there is no
+ *   `yamlText` — callers must not fall through to a parse.
+ */
+export function extractInitialFrontmatter(content) {
+  const lines = content.split(/\r?\n/);
+  if (lines[0] !== '---') {
+    return { ok: false, diagnostic: 'missing YAML frontmatter opening delimiter' };
+  }
+
+  const closingDelimiter = lines.indexOf('---', 1);
+  if (closingDelimiter === -1) {
+    return { ok: false, diagnostic: 'missing YAML frontmatter closing delimiter' };
+  }
+
+  return { ok: true, yamlText: lines.slice(1, closingDelimiter).join('\n') };
+}

package/scripts/lib/validate/tier-inference.mjs

@@ -25,7 +25,36 @@ const WRITE_TOOLS = new Set(['Edit', 'Write']);
 
 // Tools that are acceptable in the read-only tier (Bash is fine — fine-grained
 // Bash control lives in hooks/pre-bash-destructive-guard.mjs, NOT here).
-const READ_ONLY_TOOLS = new Set(['Read', 'Grep', 'Glob', 'Bash', 'Skill']);
+//
+// SendMessage / ListAgents are pure agent-to-coordinator communication surfaces
+// with no filesystem write path, so they do not lift an agent out of read-only
+// (#1049, PRD § 2 A5). Without them here, every read-only agent that opts into
+// SendMessage silently infers `repo-write` and trips validateTierConsistency.
+const READ_ONLY_TOOLS = new Set([
+  'Read',
+  'Grep',
+  'Glob',
+  'Bash',
+  'Skill',
+  'SendMessage',
+  'ListAgents',
+]);
+
+/**
+ * Normalise one raw frontmatter tool entry to its lookup key.
+ *
+ * Single source of truth for the "Skill(...)" → "Skill" collapse: both
+ * inferTierFromTools and validateTierConsistency's detail text must agree on
+ * what a tool entry IS, or the error message names offenders the inference
+ * never objected to.
+ *
+ * @param {unknown} t - raw entry from the frontmatter tools array
+ * @returns {string} lookup key
+ */
+function normaliseTool(t) {
+  if (typeof t !== 'string') return String(t);
+  return t.startsWith('Skill(') ? 'Skill' : t.trim();
+}
 
 /**
  * Infer the sandbox tier from a parsed tools array.
@@ -47,10 +76,7 @@ export function inferTierFromTools(toolsArray) {
   }
 
   // Normalise "Skill(...)" → "Skill"
-  const normalised = toolsArray.map((t) => {
-    if (typeof t !== 'string') return String(t);
-    return t.startsWith('Skill(') ? 'Skill' : t.trim();
-  });
+  const normalised = toolsArray.map(normaliseTool);
 
   // Any write tool → repo-write
   for (const t of normalised) {
@@ -86,10 +112,22 @@ export function validateTierConsistency({ declared, inferred, tools }) {
 
   // 2. Read-only agent must not have write tools.
   if (declared === 'read-only' && inferred !== 'read-only') {
-    const writeToolsPresent = Array.isArray(tools)
-      ? tools.filter((t) => WRITE_TOOLS.has(t))
+    // Name EVERY tool responsible for the verdict, not only the write tools.
+    // inferTierFromTools falls through to `repo-write` for any UNRECOGNISED
+    // tool too, and filtering the detail text on WRITE_TOOLS alone reported
+    // "tools suggest repo-write" with no culprit named in exactly that case
+    // (#1049). Normalised via the same helper the inference uses, so a
+    // "Skill(...)" entry is never listed as an offender.
+    const offenders = Array.isArray(tools)
+      ? [
+          ...new Set(
+            tools
+              .map(normaliseTool)
+              .filter((t) => WRITE_TOOLS.has(t) || !READ_ONLY_TOOLS.has(t)),
+          ),
+        ]
       : [];
-    const detail = writeToolsPresent.length > 0 ? ` (tools include: ${writeToolsPresent.join(', ')})` : '';
+    const detail = offenders.length > 0 ? ` (tools include: ${offenders.join(', ')})` : '';
     return {
       ok: false,
       error: `agent declares sandbox-tier "read-only" but tools suggest "${inferred}"${detail}`,

package/scripts/lib/vault-backfill/glab.mjs

@@ -7,6 +7,9 @@
 
 import { spawnSync } from 'node:child_process';
 
+import { redactUrlCredentials } from '../vcs-repo-spec.mjs';
+import { isValidRepoPath } from './manifest.mjs';
+
 let _verbose = false;
 
 /** Enable verbose stderr logging. */
@@ -38,7 +41,7 @@ export function assertGlabExists(dieFn) {
  * Run a glab command, return { ok, stdout, stderr }.
  *
  * Host-pinning (#872): deliberately ambient — this module runs instance-wide
- * queries (e.g. `glab repo list -g <group>`) that are not scoped to a single
+ * queries (`glab api groups/<group>/projects`) that are not scoped to a single
  * repo/project, so there is no single `-R`/`--repo` spec to pin. If a
  * caller ever needs single-repo host-pinning here, use `--hostname` (the
  * flag `glab api` and instance-wide subcommands accept), NOT `-R`/`--repo` —
@@ -46,79 +49,129 @@ export function assertGlabExists(dieFn) {
  * `resolveRepoHost` (`--hostname`) contract this repo already established.
  */
 export function glabRun(glabArgs) {
-  vlog(`glab ${glabArgs.join(' ')}`);
+  vlog(`glab ${redactUrlCredentials(glabArgs.join(' '))}`);
   const result = spawnSync('glab', glabArgs, {
     encoding: 'utf8',
     maxBuffer: 10 * 1024 * 1024,
   });
 
   if (result.error) {
-    return { ok: false, stdout: '', stderr: result.error.message };
+    return { ok: false, stdout: '', stderr: redactUrlCredentials(result.error.message) };
   }
   return {
     ok: result.status === 0,
     stdout: result.stdout || '',
-    stderr: result.stderr || '',
+    stderr: redactUrlCredentials(result.stderr || ''),
+  };
+}
+
+const PROJECT_VISIBILITIES = new Set(['private', 'internal', 'public']);
+const ISO_TIMESTAMP = /^(?<year>[1-9]\d{3})-(?<month>\d{2})-(?<day>\d{2})T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
+
+/**
+ * GitLab returns `created_at` as an ISO-8601 timestamp. Validate the calendar
+ * components separately because Date normalizes impossible dates such as Feb 30.
+ */
+function isValidCreatedAt(value) {
+  if (typeof value !== 'string') return false;
+
+  const match = ISO_TIMESTAMP.exec(value);
+  if (!match?.groups) return false;
+
+  const { year, month, day } = match.groups;
+  const calendarDate = new Date(Date.UTC(Number(year), Number(month) - 1, Number(day)));
+  return (
+    calendarDate.getUTCFullYear() === Number(year) &&
+    calendarDate.getUTCMonth() === Number(month) - 1 &&
+    calendarDate.getUTCDate() === Number(day)
+  );
+}
+
+/**
+ * Reduce a GitLab project response to the fields vault-backfill consumes.
+ *
+ * The group API with `simple=true` still includes presentation and URL fields.
+ * Keeping only this projection prevents those opaque project objects from
+ * flowing into logs or downstream actions.
+ */
+function normalizeRepo(project) {
+  return {
+    id: project.id,
+    path: project.path_with_namespace ?? project.path,
+    visibility: project.visibility === undefined ? 'private' : project.visibility,
+    createdAt: project.created_at === undefined ? '' : project.created_at.slice(0, 10),
   };
 }
 
+function isSimpleProject(project) {
+  const path = project?.path_with_namespace ?? project?.path;
+  return (
+    project !== null &&
+    typeof project === 'object' &&
+    !Array.isArray(project) &&
+    Number.isInteger(project.id) &&
+    project.id > 0 &&
+    isValidRepoPath(path) &&
+    (project.visibility === undefined || PROJECT_VISIBILITIES.has(project.visibility)) &&
+    (project.created_at === undefined || isValidCreatedAt(project.created_at))
+  );
+}
+
 /**
- * Parse `glab repo list --output json` output (JSON array or JSONL).
- * Returns array of { id, path, name, visibility, createdAt }.
+ * Parse `glab api --paginate --slurp` output (a project array or page arrays).
+ *
+ * Returns an array of { id, path, visibility, createdAt }, or null when an
+ * exit-zero response does not fully match the simple-project list contract.
  */
 export function parseRepoList(stdout) {
   const trimmed = stdout.trim();
-  if (!trimmed) return [];
+  if (!trimmed) return null;
 
+  let data;
   try {
-    const data = JSON.parse(trimmed);
-    if (!Array.isArray(data)) return [];
-    return data.map((r) => ({
-      id: r.id ?? 0,
-      path: r.path_with_namespace ?? r.path ?? '',
-      name: r.name ?? '',
-      visibility: r.visibility ?? 'private',
-      createdAt: (r.created_at ?? '').slice(0, 10),
-    }));
+    data = JSON.parse(trimmed);
   } catch {
-    // Try line-by-line JSONL
-    const repos = [];
-    for (const line of trimmed.split('\n')) {
-      const l = line.trim();
-      if (!l) continue;
-      try {
-        const r = JSON.parse(l);
-        repos.push({
-          id: r.id ?? 0,
-          path: r.path_with_namespace ?? r.path ?? '',
-          name: r.name ?? '',
-          visibility: r.visibility ?? 'private',
-          createdAt: (r.created_at ?? '').slice(0, 10),
-        });
-      } catch {
-        // skip malformed line
-      }
-    }
-    return repos;
+    return null;
   }
+
+  if (!Array.isArray(data)) return null;
+  if (data.length === 0) return [];
+
+  const projects = data.every(isSimpleProject)
+    ? data
+    : data.every(Array.isArray)
+      ? data.flat()
+      : null;
+
+  if (!projects || !projects.every(isSimpleProject)) return null;
+  return projects.map(normalizeRepo);
 }
 
 /**
  * List all repos in a GitLab group. Returns repo array or null on API error.
  */
 export function listGroupRepos(group) {
+  const encodedGroup = encodeURIComponent(group);
   const { ok, stdout, stderr } = glabRun([
-    'repo', 'list', '-g', group, '--output', 'json', '--per-page', '100',
+    'api', `groups/${encodedGroup}/projects?simple=true&per_page=100`, '--paginate', '--slurp',
   ]);
 
   if (!ok) {
     process.stderr.write(
-      `[vault-backfill] WARN: glab repo list failed for group '${group}': ${stderr.trim()}\n`,
+      `[vault-backfill] WARN: glab api groups/<group>/projects failed for group '${group}': ${stderr.trim()}\n`,
+    );
+    return null;
+  }
+
+  const repos = parseRepoList(stdout);
+  if (repos === null) {
+    process.stderr.write(
+      `[vault-backfill] WARN: glab api groups/<group>/projects returned an unexpected project-list response shape for group '${group}'\n`,
     );
     return null;
   }
 
-  return parseRepoList(stdout);
+  return repos;
 }
 
 /**
@@ -150,23 +203,3 @@ export function checkVaultYaml(repoPath) {
   );
   return 'error';
 }
-
-/**
- * Fetch repo owner via glab API. Returns username or 'unknown' on failure.
- */
-export function fetchRepoOwner(repoId) {
-  const { ok, stdout } = glabRun(['api', `projects/${repoId}`]);
-  if (!ok) return 'unknown';
-
-  try {
-    const data = JSON.parse(stdout);
-    return (
-      data?.namespace?.path ||
-      data?.owner?.username ||
-      data?.namespace?.name ||
-      'unknown'
-    );
-  } catch {
-    return 'unknown';
-  }
-}

package/scripts/lib/vault-backfill/manifest.mjs

@@ -7,8 +7,34 @@
 
 const VALID_TIERS = new Set(['top', 'active', 'archived']);
 const VALID_VISIBILITIES = new Set(['public', 'internal', 'private']);
+const GITLAB_PATH_SEGMENT_RE = /^[A-Za-z0-9_.-]+$/;
 export const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 
+/**
+ * Return whether a value is a canonical GitLab namespace/project path.
+ *
+ * GitLab project paths have at least one namespace and one project segment.
+ * Each segment uses the slug character set; dot segments remain excluded so
+ * the result is safe to use as a path below a controlled staging directory.
+ *
+ * @param {unknown} value
+ * @returns {value is string}
+ */
+export function isValidRepoPath(value) {
+  if (typeof value !== 'string') return false;
+
+  const segments = value.split('/');
+  return (
+    segments.length >= 2 &&
+    segments.every(
+      (segment) =>
+        segment !== '.' &&
+        segment !== '..' &&
+        GITLAB_PATH_SEGMENT_RE.test(segment),
+    )
+  );
+}
+
 /**
  * Validate and normalise a manifest object.
  * Calls dieFn(1, ...) on any schema violation.
@@ -34,14 +60,8 @@ export function validateManifest(raw, dieFn) {
     const prefix = `manifest.repos[${i}]`;
 
     if (typeof entry.id !== 'number') dieFn(1, `${prefix}.id must be a number`);
-    if (typeof entry.path !== 'string' || !entry.path) {
-      dieFn(1, `${prefix}.path must be a non-empty string`);
-    }
-    if (entry.path.startsWith('/') || entry.path.split('/').includes('..')) {
-      dieFn(
-        1,
-        `${prefix}.path '${entry.path}' is invalid — must be a relative repo path (no leading '/' or '..' segments)`,
-      );
+    if (!isValidRepoPath(entry.path)) {
+      dieFn(1, `${prefix}.path must be a valid GitLab namespace/project path`);
     }
     if (typeof entry.slug !== 'string') dieFn(1, `${prefix}.slug must be a string`);
     if (!SLUG_RE.test(entry.slug)) {

package/scripts/lib/vault-mirror/namespace.mjs

@@ -22,13 +22,31 @@
  *   - Redacts UNMAPPED owner-privacy leaks (CP1/CP6/CP10) to 'redacted-repo' +
  *     stderr WARN — identical to pre-#725 behaviour when no map is configured.
  *   - Falls back to 'unknown-repo' when slug derivation produces an empty string.
+ *
+ * Dependency direction (issue #734b): this module OWNS {@link deriveRepo}; it does
+ * NOT import from `./process.mjs`. Until #734b, `deriveRepo` lived in `process.mjs`
+ * while `process.mjs` imported `resolveRepoNamespace` from here — the repo's only
+ * import cycle (`namespace.mjs ↔ process.mjs`). The cycle was broken by moving the
+ * *identity* half down here (this module is the repo-identity resolver; `process.mjs`
+ * is the record-mirroring pipeline that CONSUMES an identity), and `process.mjs`
+ * re-exports `deriveRepo` from here so its public surface is unchanged.
+ *
+ * The direction is load-bearing beyond cycle-breaking: three modules
+ * (`vault-repo-backfill.mjs`, `vault-relocation-rules.mjs`, `scripts/vault-mirror.mjs`)
+ * import ONLY `resolveRepoNamespace` and previously dragged the entire `process.mjs`
+ * graph (secret-masker, render-learnings, render-sessions, session-schema/filters)
+ * in behind it. Keep this module leaf-ward: it may import `./utils.mjs`,
+ * `./pseudonym-map.mjs`, the leak-guard, host-paths and `../vcs-repo-spec.mjs`
+ * (itself a leaf — `node:child_process` only) — never the pipeline.
  */
 
-import { deriveRepo } from './process.mjs';
+import { basename } from 'node:path';
+
 import { subjectToSlug } from './utils.mjs';
 import { isOwnerLeakySegment } from '../../lib/validate/check-owner-leakage.mjs';
 import { loadPseudonymMap } from './pseudonym-map.mjs';
 import { loadHostPaths, resolveHostPath } from '../config/host-paths.mjs';
+import { isQueryFailure, resolvePreferredRemote } from '../vcs-repo-spec.mjs';
 
 // ── Lazy pseudonym-map path resolution (Epic #725 D5) ────────────────────────
 // The map path comes from env SO_NAMESPACE_MAP > owner.yaml paths.namespace-map-path
@@ -68,6 +86,133 @@ function currentMapPath() {
   return _lazyPath;
 }
 
+// ── Repo identity (issue #343; moved here from process.mjs for #734b) ────────
+
+let _cachedRepo = null;
+
+/** scp-like SSH remote: `git@host:org/name.git` (no `://`, an `@` before any `/`). */
+const SCP_LIKE_REMOTE_RE = /^[^@/\s]+@[^:/\s]+:(.+)$/;
+
+/** `scheme://[authority]/path` remote: https, ssh, git, file, … */
+const SCHEME_REMOTE_RE = /^([a-z][a-z0-9+.-]*):\/\/[^/]*\/(.+)$/i;
+
+/**
+ * Split a remote's path portion into meaningful segments: drop a trailing
+ * `.git` (with any trailing slashes), then discard empty and `.`/`..` segments.
+ *
+ * The `.`-dropping is the load-bearing part: `git clone <path>/.` records the
+ * origin VERBATIM as `/…/<repo>/.`, so the final segment of a filesystem remote
+ * is routinely a bare dot (measured golden record, 2026-08-19).
+ *
+ * @param {string} path
+ * @returns {string[]}
+ */
+function remotePathSegments(path) {
+  return path
+    .replace(/\.git\/*$/i, '')
+    .split('/')
+    .map((segment) => segment.trim())
+    .filter((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+
+/**
+ * Derive the RAW repo identifier from one git remote URL.
+ *
+ * - Hosted remote (scp-like SSH or a non-`file` scheme URL) → the last two path
+ *   segments, `org/name` — byte-identical to the pre-#1039 regex for every
+ *   hosted shape, so no existing vault namespace moves.
+ * - Filesystem remote (`git clone <path>`, `file://…`) → the repo DIRECTORY
+ *   name alone. A local clone has no owner segment, so `org/name` is not
+ *   derivable and inventing one from the parent directory would namespace vault
+ *   notes under an arbitrary path component.
+ *
+ * Returns `''` when nothing usable can be derived (caller falls back).
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+function repoIdentifierFromRemoteUrl(url) {
+  const value = String(url ?? '').trim();
+  if (value === '') return '';
+
+  const scp = SCP_LIKE_REMOTE_RE.exec(value);
+  const asUrl = scp === null ? SCHEME_REMOTE_RE.exec(value) : null;
+  const isFileUrl = asUrl !== null && asUrl[1].toLowerCase() === 'file';
+
+  if (scp !== null || (asUrl !== null && !isFileUrl)) {
+    const segments = remotePathSegments(scp !== null ? scp[1] : asUrl[2]);
+    if (segments.length === 0) return '';
+    return segments.length >= 2
+      ? `${segments[segments.length - 2]}/${segments[segments.length - 1]}`
+      : segments[segments.length - 1];
+  }
+
+  const segments = remotePathSegments(isFileUrl ? asUrl[2] : value);
+  return segments.length === 0 ? '' : segments[segments.length - 1];
+}
+
+/**
+ * Derive the canonical repo identifier for cross-repo vault aggregation (issue #343).
+ *
+ * Strategy (#1039): ask the shared remote-resolution core for the repo's
+ * PREFERRED remote — `resolvePreferredRemote` without a `vcs`, i.e. the
+ * `origin` → `gitlab` → `github` order, plus its sole-remote fallback — then
+ * derive `org/name` (hosted) or the repo directory name (filesystem clone) from
+ * that remote's URL. The pre-#1039 implementation read the hard-coded literal
+ * `git remote get-url origin`, which produced two live defects:
+ *
+ *   1. A repo whose remotes are named `gitlab`/`github` (no `origin`) silently
+ *      namespaced its vault notes under the CHECKOUT DIRECTORY name.
+ *   2. A `git clone <path>` origin (`/…/<repo>/.` — what the pre-push hook's
+ *      clone records) parsed to `<repo>/.`, whose slug is empty, so
+ *      {@link resolveRepoNamespace} returned `'unknown-repo'`. Measured
+ *      2026-08-19; it turned a namespace assertion red and blocked a push.
+ *
+ * Fallback: `path.basename(process.cwd())`, as before — but the two reasons for
+ * reaching it are no longer indistinguishable. A QUERY FAILURE (not a git repo,
+ * git not on PATH, git errored — {@link isQueryFailure}) emits a stderr WARN,
+ * because the identity under which vault notes are written was GUESSED. A real
+ * ABSENCE (a repo with no remotes) stays silent: that is a legitimate repo state
+ * and the directory name is the best available identity, not a degraded one.
+ * An `ok` resolution whose URL yields no usable identifier also falls back
+ * silently — the query succeeded and the answer was simply unusable.
+ *
+ * Cached per-process — repo identity does not change mid-run, and the cache also
+ * keeps the WARN to at most one line per process.
+ *
+ * NOTE — this is the RAW identifier and is NOT leak-guarded. Never write its
+ * output to the vault directly; route it through {@link resolveRepoNamespace}
+ * (which is what the `vaultName`-less path below does). The WARN above therefore
+ * deliberately does NOT print the derived value.
+ *
+ * Re-exported by `./process.mjs` for backwards compatibility — that was its home
+ * until the #734b cycle break, and the module-level cache means there must remain
+ * exactly ONE definition.
+ *
+ * @returns {string} e.g. 'Kanevry/session-orchestrator' or a bare directory name.
+ */
+export function deriveRepo() {
+  if (_cachedRepo !== null) return _cachedRepo;
+
+  const resolved = resolvePreferredRemote({});
+  if (resolved.ok) {
+    const identifier = repoIdentifierFromRemoteUrl(resolved.url);
+    if (identifier !== '') {
+      _cachedRepo = identifier;
+      return _cachedRepo;
+    }
+  } else if (isQueryFailure(resolved.reason)) {
+    process.stderr.write(
+      `WARN vault-mirror/namespace: could not query git remotes (${resolved.reason}); ` +
+        'falling back to the checkout directory name — vault notes may be namespaced ' +
+        'under the directory rather than the repo identity\n',
+    );
+  }
+
+  _cachedRepo = basename(process.cwd());
+  return _cachedRepo;
+}
+
 /**
  * Look up a stable pseudonym for this repo. Checks the sanitised segment first
  * (the canonical, stable key) then the raw base (covers a vaultName override