session-orchestrator 3.21.0 → 3.22.0

package/scripts/lib/ci-status-banner.mjs

@@ -18,6 +18,7 @@ import { promisify } from 'node:util';
 import {
   resolveRepoSpec,
   resolveRepoHost,
+  resolveGitlabProjectTarget,
   redactUrlCredentials,
   detectVcsFamily,
   isQueryFailure,
@@ -191,42 +192,19 @@ async function getHeadSha(repoRoot, deps = {}) {
 }
 
 /**
- * Get GitLab project ID via glab.
+ * Run a host-pinned `glab api <path>` request and return parsed JSON.
  *
- * #872: pins to `deps.repoSpec` via `-R` when resolved (host-pinning —
- * `glab repo view` otherwise falls back to the ambient `GITLAB_HOST`).
- *
- * @param {string} repoRoot
- * @param {{ execFile?: Function, timeoutMs?: number, repoSpec?: string }} deps
- * @returns {Promise<number>}
- */
-async function getGlabProjectId(repoRoot, deps = {}) {
-  const args = ['repo', 'view', '--output', 'json'];
-  if (deps.repoSpec) args.push('-R', deps.repoSpec);
-  const result = await execWithTimeout(
-    'glab',
-    args,
-    { cwd: repoRoot, timeoutMs: deps.timeoutMs ?? DEFAULT_TIMEOUT_MS, execFile: deps.execFile },
-  );
-  const parsed = JSON.parse(result.stdout);
-  return parsed.id;
-}
-
-/**
- * Run `glab api <path>` and return parsed JSON.
- *
- * #872: `glab api` has no repo/`-R` concept — it accepts only `--hostname`
- * to pin which GitLab instance the request targets. Pinned via
- * `deps.repoHost` when resolved.
+ * GitLab's API accepts neither a remote URL nor `-R`; callers provide the host
+ * proven by `resolveGitlabProjectTarget` so this helper cannot fall back to
+ * ambient `GITLAB_HOST` configuration.
  *
  * @param {string} apiPath
  * @param {string} repoRoot
- * @param {{ execFile?: Function, timeoutMs?: number, repoHost?: string }} deps
+ * @param {{ execFile?: Function, timeoutMs?: number, repoHost: string }} deps
  * @returns {Promise<unknown>}
  */
 async function glabApi(apiPath, repoRoot, deps = {}) {
-  const args = ['api', apiPath];
-  if (deps.repoHost) args.push('--hostname', deps.repoHost);
+  const args = ['api', apiPath, '--hostname', deps.repoHost];
   const result = await execWithTimeout(
     'glab',
     args,
@@ -276,17 +254,32 @@ function ageDaysFrom(isoDate, now) {
  *
  * @param {string} repoRoot
  * @param {number} now
- * @param {{ execFile?: Function, timeoutMs?: number, repoSpec?: string, repoHost?: string }} deps
+ * @param {{
+ *   execFile?: Function,
+ *   timeoutMs?: number,
+ *   gitlabProject?: { host: string, encodedProjectPath: string },
+ * }} deps
  * @returns {Promise<object|null>}
  */
 async function checkGitlab(repoRoot, now, deps = {}) {
-  const projectId = await getGlabProjectId(repoRoot, deps);
-  const currentSha = await getHeadSha(repoRoot, deps);
+  const project = deps.gitlabProject;
+  if (
+    !project ||
+    typeof project.host !== 'string' ||
+    typeof project.encodedProjectPath !== 'string' ||
+    project.host === '' ||
+    project.encodedProjectPath === ''
+  ) {
+    return null;
+  }
 
+  const currentSha = await getHeadSha(repoRoot, deps);
+  const apiDeps = { ...deps, repoHost: project.host };
+  const projectPath = `projects/${project.encodedProjectPath}`;
   const pipelines = await glabApi(
-    `projects/${projectId}/pipelines?order_by=updated_at&sort=desc&per_page=15`,
+    `${projectPath}/pipelines?order_by=updated_at&sort=desc&per_page=15`,
     repoRoot,
-    deps,
+    apiDeps,
   );
 
   if (!Array.isArray(pipelines)) return null;
@@ -316,9 +309,9 @@ async function checkGitlab(repoRoot, now, deps = {}) {
     let allowFailureJobs;
     try {
       const jobs = await glabApi(
-        `projects/${projectId}/pipelines/${currentPipeline.id}/jobs`,
+        `${projectPath}/pipelines/${currentPipeline.id}/jobs`,
         repoRoot,
-        deps,
+        apiDeps,
       );
       if (Array.isArray(jobs)) {
         const softFailed = jobs
@@ -383,9 +376,9 @@ async function checkGitlab(repoRoot, now, deps = {}) {
     let failingJobName;
     try {
       const jobs = await glabApi(
-        `projects/${projectId}/pipelines/${currentPipeline.id}/jobs`,
+        `${projectPath}/pipelines/${currentPipeline.id}/jobs`,
         repoRoot,
-        deps,
+        apiDeps,
       );
       if (Array.isArray(jobs)) {
         const failedJob = jobs.find((j) => j.status === 'failed');
@@ -433,9 +426,9 @@ async function checkGitlab(repoRoot, now, deps = {}) {
  * `[HOST/]OWNER/REPO` shape `resolveRepoSpec({ vcs: 'github' })` returns is
  * exactly the positional's documented input format.
  *
- * The asymmetry with `getGlabProjectId` is real and deliberate: `glab repo
- * view` DOES accept `-R`, and `gh api`/`glab api` accept neither `-R` nor a
- * positional — only `--hostname`. Do not unify these three call sites.
+ * GitLab CI differs deliberately: it derives a host-pinned API target from
+ * the selected remote, while GitHub still needs this lookup because its API
+ * path requires `nameWithOwner`. Do not unify these call sites.
  *
  * `nameWithOwner` is NOT derivable from `deps.repoSpec`, so this lookup
  * cannot be dropped: the spec carries a HOST prefix the `repos/<owner>/<repo>`
@@ -540,10 +533,11 @@ async function checkGithub(repoRoot, deps = {}) {
  *   execFile?: Function,
  *   resolveRepoSpec?: (opts: { repoRoot: string, vcs: 'gitlab'|'github' }) => string|undefined,
  *   resolveRepoHost?: (opts: { repoRoot: string, vcs: 'gitlab'|'github' }) => string|undefined,
- * }} deps  Dependency-injection seam for testing. `resolveRepoSpec`/
- *   `resolveRepoHost` default to the real `vcs-repo-spec.mjs` exports
- *   (#872 host-pinning — see that module for the `-R` vs `--hostname`
- *   contract).
+ *   resolveGitlabProjectTarget?: (opts: { repoRoot: string }) =>
+ *     { host: string, encodedProjectPath: string }|undefined,
+ * }} deps  Dependency-injection seam for testing. GitLab defaults to
+ *   `resolveGitlabProjectTarget`, which proves host and project path from one
+ *   sanitized remote; GitHub retains the #872 spec/host resolvers.
  * @returns {Promise<null | {
  *   status: 'green'|'red'|'unknown',
  *   ok: boolean,
@@ -572,6 +566,7 @@ export async function checkCiStatus(opts = {}, deps = {}) {
 
   const resolveRepoSpecDep = deps.resolveRepoSpec ?? resolveRepoSpec;
   const resolveRepoHostDep = deps.resolveRepoHost ?? resolveRepoHost;
+  const resolveGitlabProjectTargetDep = deps.resolveGitlabProjectTarget ?? resolveGitlabProjectTarget;
 
   const depsWithExec = { execFile: execFileDep, timeoutMs };
 
@@ -605,22 +600,33 @@ export async function checkCiStatus(opts = {}, deps = {}) {
       vcs = detected.vcs;
     }
 
-    // Step 1b (#872): resolve the -R/--hostname host-pinning spec ONCE per
-    // checkCiStatus call — a bare glab/gh spawn falls back to the ambient
-    // GITLAB_HOST/GH_HOST env var, which can silently target the wrong
-    // instance on a multi-instance host. `cwd: repoRoot` alone does not fix
-    // this (ambient env still wins over cwd).
-    const repoSpec = resolveRepoSpecDep({ repoRoot, vcs });
-    const repoHost = resolveRepoHostDep({ repoRoot, vcs });
-    const depsWithPinning = { ...depsWithExec, repoSpec, repoHost };
-
-    // Step 2: dispatch to VCS-specific implementation.
+    // Step 1b: GitLab's API target must be proven before its first glab spawn.
+    // A missing target is never permission to fall back to ambient
+    // GITLAB_HOST/repository configuration. GitHub retains its distinct
+    // repository lookup because its API path requires `nameWithOwner`.
+    //
+    // It is also not an ABSENCE: detectVcs just proved a GitLab remote exists,
+    // so `!gitlabProject` means "remote present, its form was rejected" — a
+    // QUERY FAILURE by the same rule the block above states. Returning null
+    // silently put this repo back in the pre-#1039 state where "CI green" and
+    // "could not ask" look identical. Reachable inputs measured 2026-08-21:
+    // `git://` scheme, a doubled slash in the path, a query string.
     if (vcs === 'gitlab') {
-      return await checkGitlab(repoRoot, now, depsWithPinning);
+      const gitlabProject = resolveGitlabProjectTargetDep({ repoRoot });
+      if (!gitlabProject) {
+        console.warn(
+          'WARN ci-status-banner: a GitLab remote was detected but its host/project path ' +
+            'could not be derived, banner suppressed — CI state is UNKNOWN, not "green".',
+        );
+        return null;
+      }
+      return await checkGitlab(repoRoot, now, { ...depsWithExec, gitlabProject });
     }
 
     if (vcs === 'github') {
-      return await checkGithub(repoRoot, depsWithPinning);
+      const repoSpec = resolveRepoSpecDep({ repoRoot, vcs });
+      const repoHost = resolveRepoHostDep({ repoRoot, vcs });
+      return await checkGithub(repoRoot, { ...depsWithExec, repoSpec, repoHost });
     }
 
     // Unknown VCS value — silent no-op.

package/scripts/lib/config/dispatcher-autonomy-capture.mjs

@@ -43,13 +43,36 @@ import { hasBlockHeader } from './block-header.mjs';
 const ALLOWED_AUTONOMY = ['off', 'advisory', 'autonomous-gated'];
 const DEFAULT_CONFIDENCE_FLOOR = 0.5;
 
+/**
+ * The display-only tail of an option LABEL, stripped before the enum match.
+ *
+ * The label and the stored value were the SAME string, which made the label
+ * unchangeable: both consumers (`skills/session-start/SKILL.md` Phase 1.1 and
+ * `skills/bootstrap/SKILL.md` Phase 3.5.1) hand the SELECTED LABEL straight to
+ * writeDispatcherAutonomyBlock(), and coerceAutonomy() falls back to 'off' on
+ * any value outside the enum. Putting AUQ-003's `(Recommended)` marker into the
+ * label would therefore have written `autonomy: off` for an operator who picked
+ * `advisory` — a silent downgrade, fail-closed and therefore invisible.
+ *
+ * Measured before this split (renderDispatcherAutonomyBlock, 2026-08-22):
+ *   'advisory'                => autonomy: advisory
+ *   'Advisory (surface only)' => autonomy: off      ← the downgrade
+ *
+ * Anchored at the end, so it can only ever strip a suffix. The enum values
+ * themselves are untouched and stay greppable.
+ */
+const RECOMMENDED_SUFFIX = /\s*\((?:Recommended|Empfohlen|Default)\)\s*$/u;
+
 /**
  * Coordinator-facing AUQ question definition for the one-time capture.
  * Mirrors the shape of `getInterviewQuestions()` entries in owner-interview.mjs:
  *   { question, header, options: [{ label, description }], multiSelect }
  *
- * Option labels match the ALLOWED_AUTONOMY enum so the selected label maps
- * directly to the `autonomy` value passed to writeDispatcherAutonomyBlock().
+ * Each label BEGINS with its ALLOWED_AUTONOMY value; option 1 additionally
+ * carries the `(Recommended)` marker AUQ-003 puts in the label. `coerceAutonomy()`
+ * strips that marker, so the selected label still maps to the enum value written
+ * by writeDispatcherAutonomyBlock() — see the comment on RECOMMENDED_SUFFIX for
+ * why the two halves must not be the same string.
  * Option 1 (`off`) is the recommended, fail-closed default.
  *
  * @returns {{ question: string, header: string, options: Array<{ label: string, description: string }>, multiSelect: boolean }}
@@ -57,23 +80,23 @@ const DEFAULT_CONFIDENCE_FLOOR = 0.5;
 export function getDispatcherAutonomyQuestion() {
   return {
     question:
-      'Cross-repo dispatcher autonomy: how should this repo participate when the free-repo dispatcher routes work to it?',
-    header: 'Dispatcher Autonomy (one-time)',
+      'When /dispatcher looks across your repos for the next one to work on, how may it treat this repo?',
+    header: 'Dispatcher',
     options: [
       {
-        label: 'off',
+        label: 'off (Recommended)',
         description:
-          '(Recommended) Fail-closed. The dispatcher never routes work to this repo automatically. No behaviour change.',
+          'Nothing changes: this repo is never offered and never started for you. Safe default — you keep picking the work.',
       },
       {
         label: 'advisory',
         description:
-          'The dispatcher surfaces ranked free-repo candidates for operator review — no automated dispatch.',
+          'This repo may appear in the ranked suggestions, so you can compare it against the others. You still start each session.',
       },
       {
         label: 'autonomous-gated',
         description:
-          'A deterministic confidence gate is checked first; only dispatches that clear the confidence-floor route automatically.',
+          'Work may start here without asking, but only when the ranking beats the confidence floor written next to this setting.',
       },
     ],
     multiSelect: false,
@@ -128,7 +151,7 @@ export function isDispatcherAutonomyBlockPresent(claudeMdContent) {
  */
 function coerceAutonomy(value) {
   if (value === null || value === undefined) return 'off';
-  const normalized = String(value).toLowerCase().trim();
+  const normalized = String(value).toLowerCase().replace(RECOMMENDED_SUFFIX, '').trim();
   return ALLOWED_AUTONOMY.includes(normalized) ? normalized : 'off';
 }
 

package/scripts/lib/config/vault-integration.mjs

@@ -192,9 +192,20 @@ function _parseInlineObject(raw) {
  */
 export function _parseResourceThresholds(kv) {
   return {
+    // Memory thresholds are denominated in the signal `evaluate()` actually
+    // judges on — memory_pressure > ram_available > ram_free, in that order
+    // (#1089). They are NOT compared against Darwin's `os.freemem()` unless
+    // nothing better is published, which on Darwin never happens.
     'ram-free-min-gb': _coerceInteger(kv, 'ram-free-min-gb', 4),
     'ram-free-critical-gb': _coerceInteger(kv, 'ram-free-critical-gb', 2),
-    'cpu-load-max-pct': _coerceInteger(kv, 'cpu-load-max-pct', 80),
+    // 80 → 90 (#1089). At 80 this fired on 15.6% of 1477 measured session
+    // starts, largely on the decaying tail of the coordinator's own gate run;
+    // at 90 it fires on 12.8%, and under the two-signal rule it no longer caps
+    // anything on its own. Both numbers are measurements, not preferences.
+    'cpu-load-max-pct': _coerceInteger(kv, 'cpu-load-max-pct', 90),
+    // Unchanged at 5 — but now compared against LIVE PEER SESSIONS rather than
+    // the Claude process count. Same number, different denominator: measured
+    // firing rate drops from 93.6% to 4.2% (median processes:sessions = 6.0).
     'concurrent-sessions-warn': _coerceInteger(kv, 'concurrent-sessions-warn', 5),
     'ssh-no-docker': _coerceBoolean(kv, 'ssh-no-docker', true),
   };

package/scripts/lib/dispatcher/rank.mjs

@@ -34,7 +34,7 @@ import path from 'node:path';
 
 import { scanBacklog } from '../backlog-scan.mjs';
 import { checkCiStatus as realCheckCiStatus } from '../ci-status-banner.mjs';
-import { probe as realProbe, evaluate as realEvaluate } from '../resource-probe.mjs';
+import { probe as realProbe, evaluate as realEvaluate, DEFAULT_RESOURCE_THRESHOLDS as CANONICAL_RESOURCE_THRESHOLDS } from '../resource-probe.mjs';
 import { isRealSession } from '../session-schema/filters.mjs';
 
 /** Staleness cap (days). Beyond this, additional age does not raise the score. */
@@ -49,12 +49,9 @@ const MS_PER_DAY = 86_400_000;
  * Used by the default `resourceVerdict` dep so ranking works standalone
  * without a parsed Session Config in hand.
  */
-const DEFAULT_RESOURCE_THRESHOLDS = {
-  'ram-free-min-gb': 4,
-  'ram-free-critical-gb': 2,
-  'cpu-load-max-pct': 80,
-  'concurrent-sessions-warn': 5,
-};
+// #1089: re-exported from the single canonical definition rather than a third
+// hand-maintained copy — the three copies had already drifted apart.
+const DEFAULT_RESOURCE_THRESHOLDS = { ...CANONICAL_RESOURCE_THRESHOLDS };
 
 // ---------------------------------------------------------------------------
 // PURE core

package/scripts/lib/gates/gate-full.mjs

@@ -36,7 +36,7 @@ const startTime = Date.now();
 const tcResult = runCheck(typecheckCmd);
 const tcErrorCount =
   tcResult.status === 'fail'
-    ? extractCount(tcResult.output, /error TS\d+/)
+    ? extractCount(tcResult.fullOutput ?? tcResult.output, /error TS\d+/)
     : 0;
 
 // --- Test ---
@@ -46,14 +46,14 @@ const tcErrorCount =
 const testResult = runCheck(testCmd);
 const { passed: testPassed, failed: testFailed, total: testTotal } =
   testResult.status !== 'skip'
-    ? extractTestCounts(testResult.output)
+    ? extractTestCounts(testResult.fullOutput ?? testResult.output)
     : { passed: 0, failed: 0, total: 0 };
 
 // --- Lint ---
 const lintResult = runCheck(lintCmd);
 const lintWarnings =
   lintResult.status !== 'skip'
-    ? extractCount(lintResult.output, /warning/i)
+    ? extractCount(lintResult.fullOutput ?? lintResult.output, /warning/i)
     : 0;
 
 // --- Debug artifacts ---

package/scripts/lib/gates/gate-helpers.mjs

@@ -41,17 +41,28 @@ function isTestFile(filePath) {
 /**
  * Execute a shell command and return a structured result.
  *
+ * `output` is a bounded TAIL for humans. `fullOutput` is the complete captured
+ * text and is what every COUNT parse must read.
+ *
+ * Why both: the tail was 5 lines and was also the parser's input. Vitest prints
+ * its `Test Files` / `Tests` summary and THEN the per-failure detail, so on any
+ * real failure the summary sits hundreds of lines above the tail — measured
+ * 2026-08-22: line 174 of 936. `extractTestCounts` then found nothing and the
+ * gate reported `test: fail, total 0, passed 0, failed 0`, which reads as
+ * "the runner never produced results" and hides WHICH test failed. An hour was
+ * spent chasing that phantom before the real cause (one red test) was found.
+ *
  * @param {string} cmd - Shell command to run, or `"skip"` / empty to skip.
- * @returns {{ status: 'pass'|'fail'|'skip', output: string, exitCode: number, stubbed?: { kind: 'echo'|'noop' } }}
+ * @returns {{ status: 'pass'|'fail'|'skip', output: string, fullOutput: string, exitCode: number, stubbed?: { kind: 'echo'|'noop' } }}
  */
 export function runCheck(cmd) {
   if (!cmd || cmd === 'skip') {
-    return { status: 'skip', output: '', exitCode: 0 };
+    return { status: 'skip', output: '', fullOutput: '', exitCode: 0 };
   }
 
   const stub = detectStubCommand(cmd);
   if (stub.isStub) {
-    return { status: 'pass', output: `(stubbed: ${stub.kind})`, exitCode: 0, stubbed: { kind: stub.kind } };
+    return { status: 'pass', output: `(stubbed: ${stub.kind})`, fullOutput: `(stubbed: ${stub.kind})`, exitCode: 0, stubbed: { kind: stub.kind } };
   }
 
   try {
@@ -61,18 +72,18 @@ export function runCheck(cmd) {
       maxBuffer: RUN_CHECK_MAX_BUFFER_BYTES,
     });
     const output = raw.split('\n').slice(-5).join('\n').trim();
-    return { status: 'pass', output, exitCode: 0 };
+    return { status: 'pass', output, fullOutput: raw, exitCode: 0 };
   } catch (err) {
     const exitCode = typeof err.status === 'number' ? err.status : 1;
 
     // Exit code 127 means command not found — treat as skip.
     if (exitCode === 127) {
-      return { status: 'skip', output: 'command not found', exitCode };
+      return { status: 'skip', output: 'command not found', fullOutput: '', exitCode };
     }
 
     const combined = [err.stdout ?? '', err.stderr ?? ''].join('\n');
     const output = combined.split('\n').slice(-5).join('\n').trim();
-    return { status: 'fail', output, exitCode };
+    return { status: 'fail', output, fullOutput: combined, exitCode };
   }
 }