session-orchestrator 3.21.0 → 3.22.0

package/scripts/lib/validate/check-hooks-symmetry.mjs

@@ -84,6 +84,16 @@ const DOCUMENTED_ASYMMETRIES = {
         // Cursor IDE and Pi v1 have no parallel agent dispatch at all
         // (skills/session-plan/SKILL.md Platform Note), and Codex has no payload
         // adapter for it. A matcher that can never fire is not enforcement.
+        // pre-auq-clarity (#1107): NOT ported by construction. The hook matches
+        // the `AskUserQuestion` tool, which this platform does not have — it
+        // renders a numbered Markdown list instead (docs/codex-setup.md:112,
+        // docs/cursor-setup.md:86), and pi-hook-bridge's TOOL_NAME_MAP carries
+        // no `askuserquestion` entry. A matcher on a tool that never fires is a
+        // dead entry: maintenance cost that ASSERTS a protection it does not
+        // provide. Revisit the day the platform gains the tool — the mechanical
+        // witness for that day is the mapPiToolName assertion in
+        // tests/hooks/pre-auq-clarity-wiring.test.mjs, which goes red then.
+        'pre-auq-clarity.mjs',
         'pre-task-scope-disjoint.mjs',
         'skill-invocation-telemetry.mjs',
         'enforce-scope.mjs',
@@ -132,6 +142,16 @@ const DOCUMENTED_ASYMMETRIES = {
         // Cursor IDE and Pi v1 have no parallel agent dispatch at all
         // (skills/session-plan/SKILL.md Platform Note), and Codex has no payload
         // adapter for it. A matcher that can never fire is not enforcement.
+        // pre-auq-clarity (#1107): NOT ported by construction. The hook matches
+        // the `AskUserQuestion` tool, which this platform does not have — it
+        // renders a numbered Markdown list instead (docs/codex-setup.md:112,
+        // docs/cursor-setup.md:86), and pi-hook-bridge's TOOL_NAME_MAP carries
+        // no `askuserquestion` entry. A matcher on a tool that never fires is a
+        // dead entry: maintenance cost that ASSERTS a protection it does not
+        // provide. Revisit the day the platform gains the tool — the mechanical
+        // witness for that day is the mapPiToolName assertion in
+        // tests/hooks/pre-auq-clarity-wiring.test.mjs, which goes red then.
+        'pre-auq-clarity.mjs',
         'pre-task-scope-disjoint.mjs',
         'skill-invocation-telemetry.mjs',
         'pre-bash-sessions-ledger-guard.mjs', // #958
@@ -160,6 +180,16 @@ const DOCUMENTED_ASYMMETRIES = {
         // Cursor IDE and Pi v1 have no parallel agent dispatch at all
         // (skills/session-plan/SKILL.md Platform Note), and Codex has no payload
         // adapter for it. A matcher that can never fire is not enforcement.
+        // pre-auq-clarity (#1107): NOT ported by construction. The hook matches
+        // the `AskUserQuestion` tool, which this platform does not have — it
+        // renders a numbered Markdown list instead (docs/codex-setup.md:112,
+        // docs/cursor-setup.md:86), and pi-hook-bridge's TOOL_NAME_MAP carries
+        // no `askuserquestion` entry. A matcher on a tool that never fires is a
+        // dead entry: maintenance cost that ASSERTS a protection it does not
+        // provide. Revisit the day the platform gains the tool — the mechanical
+        // witness for that day is the mapPiToolName assertion in
+        // tests/hooks/pre-auq-clarity-wiring.test.mjs, which goes red then.
+        'pre-auq-clarity.mjs',
         'pre-task-scope-disjoint.mjs',
         'skill-invocation-telemetry.mjs',    // #919
         'enforce-scope.mjs',                 // #919

package/scripts/lib/validate/check-rules.mjs

@@ -30,6 +30,51 @@
 //           parse error as always-on with empty meta, so the skipped file is
 //           exactly the one that loads everywhere and clears every gate. See
 //           the inline rationale at the parse site below.
+//       (e) HARNESS-PARITY (#1108): a rule that expresses a path restriction
+//           must express it in `paths:`, because `paths:` is the ONLY key
+//           Claude Code's own rule loader reads. Its documentation
+//           (code.claude.com/docs/en/memory § "Path-specific rules") is
+//           explicit: rules are scoped "using YAML frontmatter with the
+//           `paths` field", and "rules without a `paths` field are loaded
+//           unconditionally and apply to all files". `globs:` is the CURSOR
+//           field name. A `globs:`-only rule is therefore scoped for
+//           rule-loader.mjs (#795 alias) and for Cursor, yet ALWAYS-ON for
+//           Claude Code — the rule *looks* scoped everywhere it is inspected
+//           and is silently loaded everywhere it is used.
+//           Measured 2026-08-22 before the fix: 16 of 31 rule files carried
+//           `globs:` and 0 carried `paths:`, so all 31 loaded unconditionally
+//           — 186,993 bytes ≈ 46,700 tokens per dispatch, 72,195 of them
+//           unwanted (testing.md alone is 36,431 bytes and carries
+//           `tier: wave-only`, i.e. is explicitly meant to be conditional).
+//           This check is the recurrence guard for that fix, not the fix.
+//           It is formulated as a PARITY check rather than a presence check,
+//           which folds two defects into one invariant: the rule must load in
+//           the SAME contexts under Claude Code's loader (which reads
+//           `paths:`, treating absence as always-on) as under rule-loader.mjs
+//           (which reads `globs:` and falls back to `paths:` — #795, globs
+//           wins). Two ways to violate it:
+//             - `globs:` present and non-empty, `paths:` ABSENT → always-on
+//               in Claude Code.
+//             - both present with DIFFERENT pattern sets → Claude Code scopes
+//               on one list, rule-loader.mjs and Cursor on the other.
+//           Order and duplicates are irrelevant (a glob list is matched
+//           any-of), so the comparison is over the sorted unique set.
+//           NOT flagged: `paths:` alone. It is the form the native
+//           documentation prescribes and the form the primary downstream
+//           consumer uses exclusively (projects-baseline: 26 rule files, all
+//           `paths:`, 0 `globs:` — rule-loader.mjs module doc). The
+//           `globs:`-is-canonical preference for VENDORED rules is a separate,
+//           warn-level concern already owned by
+//           scripts/lib/validate-vendored-rules.mjs (~:289, issue #742) and is
+//           deliberately not duplicated here.
+//           NOT flagged either: an EMPTY `globs: []`. That shape is already
+//           owned — with an accurate, opposite message — by the dedicated
+//           empty-globs branches below (#880 QA Defect 1 / #892), and firing
+//           a second, contradictory-sounding finding ("never loads" beside
+//           "always-on in Claude Code") on one file is exactly the confusion
+//           those fixes went out of their way to remove. The parity check
+//           therefore requires a NON-EMPTY `globs:` list; populating it is the
+//           prescribed remedy for `globs: []`, at which point parity binds.
 //
 // (2) HANDWRITTEN rules (no `auto-generated: true` — #880 FA5, WARN-only,
 //     NEVER affects the exit code). The auto-generated brandmauer above only
@@ -70,9 +115,10 @@
 //
 // Usage: check-rules.mjs <plugin-root>
 // Outputs lines of the form "  PASS: ..." / "  FAIL: ..." / "  WARN: ...".
-// Exit 0 = all AUTO-GENERATED invariants satisfied (WARN lines from the
-// handwritten check NEVER affect the exit code); exit 1 = at least one
-// auto-generated FAIL.
+// Exit 0 = all AUTO-GENERATED invariants plus the two cohort-independent
+// invariants (d) frontmatter-parses and (e) harness-parity are satisfied (WARN
+// lines from the handwritten check NEVER affect the exit code); exit 1 = at
+// least one FAIL.
 
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -132,6 +178,69 @@ function hasFrontmatterKey(contents, key) {
   return Boolean(keyMatch && keyMatch[1] && keyMatch[1].trim() !== '');
 }
 
+// ---------------------------------------------------------------------------
+// Per-key list access for the harness-parity check (#1108).
+//
+// `parseGlobsFrontmatter()` deliberately COLLAPSES `globs:` and `paths:` into
+// one value ("callers never see which key produced the value" — rule-loader.mjs
+// module doc, #795 precedence). The parity check needs both lists separately,
+// and re-deriving list parsing here would be a second frontmatter parser — the
+// exact drift class that produced #840. So instead of re-parsing, the OTHER key
+// is MASKED to a name the parser ignores (any key that is neither globs/paths
+// nor in SCALAR_META_KEYS is dropped without error, and its indented `  - x`
+// continuation lines are skipped as "another block's continuation"), and the
+// SAME parser then returns the surviving key's list verbatim — flow style,
+// block style, quote stripping and provenance-header tolerance included.
+//
+// Masking cannot make a parseable file unparseable: it renames a key, so the
+// line keeps its colon. Callers reach this only for files that already parsed.
+// ---------------------------------------------------------------------------
+const MASKED_KEY_PREFIX = 'x-check-rules-masked-';
+
+/**
+ * Returns the value of exactly ONE of the two scope keys, ignoring the other —
+ * `null` when that key is absent, `[]` when present but empty.
+ *
+ * @param {string} contents - raw file contents (must already parse)
+ * @param {'globs'|'paths'} key - the key whose list to return
+ * @returns {string[] | null}
+ */
+function scopeKeyValue(contents, key) {
+  const other = key === 'globs' ? 'paths' : 'globs';
+  const masked = contents.replace(
+    new RegExp(`^${other}:`, 'gm'),
+    `${MASKED_KEY_PREFIX}${other}:`,
+  );
+  return parseGlobsFrontmatter(masked).globs;
+}
+
+/** Sorted, de-duplicated copy — glob lists are matched any-of, so neither
+ * order nor repetition changes which files a rule applies to. */
+function normalizePatterns(list) {
+  return [...new Set(list)].sort();
+}
+
+/**
+ * Harness-parity verdict for one rule file (#1108) — see module doc (e).
+ *
+ * @param {string} contents - raw file contents (must already parse)
+ * @returns {{ ok: true } | { ok: false, kind: 'missing-paths'|'divergent', globs: string[], paths: string[] | null }}
+ */
+function checkHarnessParity(contents) {
+  const globs = scopeKeyValue(contents, 'globs');
+  // Only a NON-EMPTY globs list expresses a path restriction. Absent globs →
+  // whatever `paths:` says is what every loader sees. Empty globs → owned by
+  // the dedicated empty-globs branches, which prescribe populating it.
+  if (!Array.isArray(globs) || globs.length === 0) return { ok: true };
+
+  const paths = scopeKeyValue(contents, 'paths');
+  if (paths === null) return { ok: false, kind: 'missing-paths', globs, paths };
+
+  const same =
+    JSON.stringify(normalizePatterns(globs)) === JSON.stringify(normalizePatterns(paths));
+  return same ? { ok: true } : { ok: false, kind: 'divergent', globs, paths };
+}
+
 // ============================================================================
 // Check: .claude/rules/ rule invariants
 // ============================================================================
@@ -207,17 +316,44 @@ for (const name of mdFiles.sort()) {
   const { globs, meta } = parsed;
   const rel = `.claude/rules/${name}`;
 
+  // (e) HARNESS-PARITY (#1108) — cohort-independent, like the parse check
+  // above: `paths:` is the only scope key Claude Code's own loader reads, so a
+  // `globs:`-only or divergently-scoped rule loads differently there than it
+  // does under rule-loader.mjs. Emitted here, in file order, and recorded on
+  // the entry so the cohort branches below suppress their PASS line — a file
+  // must never both PASS and FAIL.
+  const parity = checkHarnessParity(contents);
+  if (!parity.ok && parity.kind === 'missing-paths') {
+    fail(
+      `${rel} — declares globs: (${parity.globs.length} pattern(s)) but no paths: — Claude Code's native rule ` +
+        'loader reads ONLY the `paths` frontmatter field and treats a rule without it as unconditional ' +
+        '("rules without a paths field are loaded unconditionally and apply to all files" — ' +
+        'code.claude.com/docs/en/memory § Path-specific rules). `globs:` is the Cursor field name, so this rule ' +
+        'is scoped for rule-loader.mjs and Cursor but loads ALWAYS-ON in Claude Code — a silent instruction-budget ' +
+        'failure (#1108). Add a paths: key carrying the same patterns as globs: (keep globs: — it stays the ' +
+        'canonical form for vendored rules, validate-vendored-rules.mjs #742).',
+    );
+  } else if (!parity.ok && parity.kind === 'divergent') {
+    fail(
+      `${rel} — globs: and paths: declare DIFFERENT pattern sets (globs: ${JSON.stringify(parity.globs)} vs ` +
+        `paths: ${JSON.stringify(parity.paths)}) — Claude Code's native loader scopes on paths:, while ` +
+        'rule-loader.mjs and Cursor scope on globs: (globs: wins silently when both are present, #795). The rule ' +
+        'therefore loads in different contexts on different harnesses (#1108). Make the two lists carry the same ' +
+        'patterns — order and duplicates are irrelevant.',
+    );
+  }
+
   if (meta['auto-generated'] === true) {
-    autoGeneratedEntries.push({ rel, globs, meta });
+    autoGeneratedEntries.push({ rel, globs, meta, parityOk: parity.ok });
   } else {
-    handwrittenEntries.push({ rel, globs, meta, contents });
+    handwrittenEntries.push({ rel, globs, meta, contents, parityOk: parity.ok });
   }
 }
 
 // ---------------------------------------------------------------------------
 // Auto-generated branch (FA4 #697) — UNCHANGED behaviour, hard-fail.
 // ---------------------------------------------------------------------------
-for (const { rel, globs, meta } of autoGeneratedEntries) {
+for (const { rel, globs, meta, parityOk } of autoGeneratedEntries) {
   // (a) never-always-on: must have at least one activation axis.
   // globs is one of: null (no frontmatter / no globs key), [] (key present
   // but EMPTY — the #892 QA-Defect special case, see module doc), or a
@@ -264,9 +400,11 @@ for (const { rel, globs, meta } of autoGeneratedEntries) {
   // an empty globs array, which is dead-not-passing regardless of host-class)
   // AND learning-key AND expires-at. When any failed, the FAIL line(s) above
   // already emitted.
+  // `parityOk` joins the conjunction for the same reason `hasEmptyGlobs` does:
+  // its FAIL already emitted above, and a file must never both PASS and FAIL.
   const lkOk = Object.prototype.hasOwnProperty.call(meta, 'learning-key');
   const eaOk = Object.prototype.hasOwnProperty.call(meta, 'expires-at');
-  if (!hasEmptyGlobs && (hasGlobs || hasHostClass) && lkOk && eaOk) {
+  if (!hasEmptyGlobs && (hasGlobs || hasHostClass) && lkOk && eaOk && parityOk) {
     pass(`${rel} — auto-generated rule satisfies all invariants`);
   }
 }
@@ -283,7 +421,7 @@ console.log(
   '--- Check: .claude/rules/ handwritten-rule activation + review-date (warn mode, #880) ---',
 );
 
-for (const { rel, globs, meta, contents } of handwrittenEntries) {
+for (const { rel, globs, meta, contents, parityOk } of handwrittenEntries) {
   // `globs` (the merged globs/paths value from parseGlobsFrontmatter — #795
   // alias, `globs:` wins when both are present) is one of:
   //   - null                     → neither key present
@@ -333,7 +471,13 @@ for (const { rel, globs, meta, contents } of handwrittenEntries) {
     );
   }
 
-  if (!hasEmptyGlobs && hasAxis && hasReviewDate) {
+  // `parityOk` joins the conjunction for the same reason `hasEmptyGlobs` does
+  // (#1108): its FAIL already emitted in the parse loop, and a file must never
+  // both PASS and FAIL. This is the one place a handwritten rule's PASS is
+  // withheld for a HARD-fail reason — the parity invariant is cohort-
+  // independent by construction, so it is not part of this branch's
+  // deliberately warn-only posture.
+  if (!hasEmptyGlobs && hasAxis && hasReviewDate && parityOk) {
     pass(`${rel} — handwritten rule has an activation axis and a review-date`);
   }
 }

package/scripts/lib/vault-backfill/glab.mjs

@@ -7,6 +7,9 @@
 
 import { spawnSync } from 'node:child_process';
 
+import { redactUrlCredentials } from '../vcs-repo-spec.mjs';
+import { isValidRepoPath } from './manifest.mjs';
+
 let _verbose = false;
 
 /** Enable verbose stderr logging. */
@@ -38,7 +41,7 @@ export function assertGlabExists(dieFn) {
  * Run a glab command, return { ok, stdout, stderr }.
  *
  * Host-pinning (#872): deliberately ambient — this module runs instance-wide
- * queries (e.g. `glab repo list -g <group>`) that are not scoped to a single
+ * queries (`glab api groups/<group>/projects`) that are not scoped to a single
  * repo/project, so there is no single `-R`/`--repo` spec to pin. If a
  * caller ever needs single-repo host-pinning here, use `--hostname` (the
  * flag `glab api` and instance-wide subcommands accept), NOT `-R`/`--repo` —
@@ -46,79 +49,129 @@ export function assertGlabExists(dieFn) {
  * `resolveRepoHost` (`--hostname`) contract this repo already established.
  */
 export function glabRun(glabArgs) {
-  vlog(`glab ${glabArgs.join(' ')}`);
+  vlog(`glab ${redactUrlCredentials(glabArgs.join(' '))}`);
   const result = spawnSync('glab', glabArgs, {
     encoding: 'utf8',
     maxBuffer: 10 * 1024 * 1024,
   });
 
   if (result.error) {
-    return { ok: false, stdout: '', stderr: result.error.message };
+    return { ok: false, stdout: '', stderr: redactUrlCredentials(result.error.message) };
   }
   return {
     ok: result.status === 0,
     stdout: result.stdout || '',
-    stderr: result.stderr || '',
+    stderr: redactUrlCredentials(result.stderr || ''),
+  };
+}
+
+const PROJECT_VISIBILITIES = new Set(['private', 'internal', 'public']);
+const ISO_TIMESTAMP = /^(?<year>[1-9]\d{3})-(?<month>\d{2})-(?<day>\d{2})T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
+
+/**
+ * GitLab returns `created_at` as an ISO-8601 timestamp. Validate the calendar
+ * components separately because Date normalizes impossible dates such as Feb 30.
+ */
+function isValidCreatedAt(value) {
+  if (typeof value !== 'string') return false;
+
+  const match = ISO_TIMESTAMP.exec(value);
+  if (!match?.groups) return false;
+
+  const { year, month, day } = match.groups;
+  const calendarDate = new Date(Date.UTC(Number(year), Number(month) - 1, Number(day)));
+  return (
+    calendarDate.getUTCFullYear() === Number(year) &&
+    calendarDate.getUTCMonth() === Number(month) - 1 &&
+    calendarDate.getUTCDate() === Number(day)
+  );
+}
+
+/**
+ * Reduce a GitLab project response to the fields vault-backfill consumes.
+ *
+ * The group API with `simple=true` still includes presentation and URL fields.
+ * Keeping only this projection prevents those opaque project objects from
+ * flowing into logs or downstream actions.
+ */
+function normalizeRepo(project) {
+  return {
+    id: project.id,
+    path: project.path_with_namespace ?? project.path,
+    visibility: project.visibility === undefined ? 'private' : project.visibility,
+    createdAt: project.created_at === undefined ? '' : project.created_at.slice(0, 10),
   };
 }
 
+function isSimpleProject(project) {
+  const path = project?.path_with_namespace ?? project?.path;
+  return (
+    project !== null &&
+    typeof project === 'object' &&
+    !Array.isArray(project) &&
+    Number.isInteger(project.id) &&
+    project.id > 0 &&
+    isValidRepoPath(path) &&
+    (project.visibility === undefined || PROJECT_VISIBILITIES.has(project.visibility)) &&
+    (project.created_at === undefined || isValidCreatedAt(project.created_at))
+  );
+}
+
 /**
- * Parse `glab repo list --output json` output (JSON array or JSONL).
- * Returns array of { id, path, name, visibility, createdAt }.
+ * Parse `glab api --paginate --slurp` output (a project array or page arrays).
+ *
+ * Returns an array of { id, path, visibility, createdAt }, or null when an
+ * exit-zero response does not fully match the simple-project list contract.
  */
 export function parseRepoList(stdout) {
   const trimmed = stdout.trim();
-  if (!trimmed) return [];
+  if (!trimmed) return null;
 
+  let data;
   try {
-    const data = JSON.parse(trimmed);
-    if (!Array.isArray(data)) return [];
-    return data.map((r) => ({
-      id: r.id ?? 0,
-      path: r.path_with_namespace ?? r.path ?? '',
-      name: r.name ?? '',
-      visibility: r.visibility ?? 'private',
-      createdAt: (r.created_at ?? '').slice(0, 10),
-    }));
+    data = JSON.parse(trimmed);
   } catch {
-    // Try line-by-line JSONL
-    const repos = [];
-    for (const line of trimmed.split('\n')) {
-      const l = line.trim();
-      if (!l) continue;
-      try {
-        const r = JSON.parse(l);
-        repos.push({
-          id: r.id ?? 0,
-          path: r.path_with_namespace ?? r.path ?? '',
-          name: r.name ?? '',
-          visibility: r.visibility ?? 'private',
-          createdAt: (r.created_at ?? '').slice(0, 10),
-        });
-      } catch {
-        // skip malformed line
-      }
-    }
-    return repos;
+    return null;
   }
+
+  if (!Array.isArray(data)) return null;
+  if (data.length === 0) return [];
+
+  const projects = data.every(isSimpleProject)
+    ? data
+    : data.every(Array.isArray)
+      ? data.flat()
+      : null;
+
+  if (!projects || !projects.every(isSimpleProject)) return null;
+  return projects.map(normalizeRepo);
 }
 
 /**
  * List all repos in a GitLab group. Returns repo array or null on API error.
  */
 export function listGroupRepos(group) {
+  const encodedGroup = encodeURIComponent(group);
   const { ok, stdout, stderr } = glabRun([
-    'repo', 'list', '-g', group, '--output', 'json', '--per-page', '100',
+    'api', `groups/${encodedGroup}/projects?simple=true&per_page=100`, '--paginate', '--slurp',
   ]);
 
   if (!ok) {
     process.stderr.write(
-      `[vault-backfill] WARN: glab repo list failed for group '${group}': ${stderr.trim()}\n`,
+      `[vault-backfill] WARN: glab api groups/<group>/projects failed for group '${group}': ${stderr.trim()}\n`,
+    );
+    return null;
+  }
+
+  const repos = parseRepoList(stdout);
+  if (repos === null) {
+    process.stderr.write(
+      `[vault-backfill] WARN: glab api groups/<group>/projects returned an unexpected project-list response shape for group '${group}'\n`,
     );
     return null;
   }
 
-  return parseRepoList(stdout);
+  return repos;
 }
 
 /**
@@ -150,23 +203,3 @@ export function checkVaultYaml(repoPath) {
   );
   return 'error';
 }
-
-/**
- * Fetch repo owner via glab API. Returns username or 'unknown' on failure.
- */
-export function fetchRepoOwner(repoId) {
-  const { ok, stdout } = glabRun(['api', `projects/${repoId}`]);
-  if (!ok) return 'unknown';
-
-  try {
-    const data = JSON.parse(stdout);
-    return (
-      data?.namespace?.path ||
-      data?.owner?.username ||
-      data?.namespace?.name ||
-      'unknown'
-    );
-  } catch {
-    return 'unknown';
-  }
-}

package/scripts/lib/vault-backfill/manifest.mjs

@@ -7,8 +7,34 @@
 
 const VALID_TIERS = new Set(['top', 'active', 'archived']);
 const VALID_VISIBILITIES = new Set(['public', 'internal', 'private']);
+const GITLAB_PATH_SEGMENT_RE = /^[A-Za-z0-9_.-]+$/;
 export const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 
+/**
+ * Return whether a value is a canonical GitLab namespace/project path.
+ *
+ * GitLab project paths have at least one namespace and one project segment.
+ * Each segment uses the slug character set; dot segments remain excluded so
+ * the result is safe to use as a path below a controlled staging directory.
+ *
+ * @param {unknown} value
+ * @returns {value is string}
+ */
+export function isValidRepoPath(value) {
+  if (typeof value !== 'string') return false;
+
+  const segments = value.split('/');
+  return (
+    segments.length >= 2 &&
+    segments.every(
+      (segment) =>
+        segment !== '.' &&
+        segment !== '..' &&
+        GITLAB_PATH_SEGMENT_RE.test(segment),
+    )
+  );
+}
+
 /**
  * Validate and normalise a manifest object.
  * Calls dieFn(1, ...) on any schema violation.
@@ -34,14 +60,8 @@ export function validateManifest(raw, dieFn) {
     const prefix = `manifest.repos[${i}]`;
 
     if (typeof entry.id !== 'number') dieFn(1, `${prefix}.id must be a number`);
-    if (typeof entry.path !== 'string' || !entry.path) {
-      dieFn(1, `${prefix}.path must be a non-empty string`);
-    }
-    if (entry.path.startsWith('/') || entry.path.split('/').includes('..')) {
-      dieFn(
-        1,
-        `${prefix}.path '${entry.path}' is invalid — must be a relative repo path (no leading '/' or '..' segments)`,
-      );
+    if (!isValidRepoPath(entry.path)) {
+      dieFn(1, `${prefix}.path must be a valid GitLab namespace/project path`);
     }
     if (typeof entry.slug !== 'string') dieFn(1, `${prefix}.slug must be a string`);
     if (!SLUG_RE.test(entry.slug)) {