session-orchestrator 3.22.0 → 3.23.0

package/scripts/lib/spiral-carryover.mjs

@@ -43,6 +43,7 @@ import {
   formatBlockReason,
   resolveIssueBudgetSessionId,
 } from './issue-budget.mjs';
+import { resolveProjectDir } from './platform.mjs';
 import { resolveRepoSpec } from './vcs-repo-spec.mjs';
 
 /**
@@ -83,6 +84,27 @@ function isIssueCreateArgv(cmd, args) {
   return args[0] === 'issue' && (args[1] === 'create' || args[1] === 'new');
 }
 
+/**
+ * Under vitest, a `repoRoot` that resolves to the ambient working copy is almost
+ * always the default-parameter leak (#1105): the test meant to pass a synthetic
+ * `mkdtemp` root but did not, and the issue-budget ledger would be charged in
+ * the operator's real tree. Production keeps the cwd default unchanged; this
+ * gate only fires when `process.env.VITEST` is set.
+ *
+ * @param {string} budgetRoot — ledger root about to be passed to `chargeIssueBudget`
+ * @returns {string|null} refusal message, or null when charging may proceed
+ */
+function refuseAmbientLedgerUnderVitest(budgetRoot) {
+  if (!process.env.VITEST) return null;
+  if (path.resolve(budgetRoot) === path.resolve(process.cwd())) {
+    return (
+      'spiral-carryover: refusing to charge the issue-budget ledger at the ambient ' +
+      'repo root under VITEST — pass an explicit synthetic repoRoot'
+    );
+  }
+  return null;
+}
+
 /**
  * Run a CLI command and return { ok, stdout, stderr }. Never throws.
  *
@@ -97,14 +119,46 @@ function isIssueCreateArgv(cmd, args) {
  * exactly the session-end promise at SKILL.md:319 / :1113 being preserved. It
  * bites for any FUTURE non-exempt producer added to this module.
  *
+ * REPO BINDING (#1058 follow-on). The ledger root is the `repoRoot` the CALLER
+ * named — the same value that already decides the `-R` host-pinning spec a few
+ * lines down. Before this parameter existed, `runCli` re-derived it from
+ * `process.env.CLAUDE_PROJECT_DIR || process.cwd()`, so one call could file an
+ * issue into repo A (via `-R`) while charging repo B's budget ledger. Two
+ * answers to "which repo" inside one call path is the defect; the caller's
+ * answer is the authoritative one.
+ *
+ * That split brain was also a live test leak, measured 2026-08-23: a sandboxed
+ * `CLAUDE_PROJECT_DIR=$(mktemp -d) npx vitest run tests/lib/spiral-carryover.test.mjs`
+ * left `{"sessionId":"1c2e5507-…","count":0,"exempt":15}` in the sandbox — 15
+ * bookings per run, carrying the REAL session id, which under a plain
+ * `npm test` land in this repo's live issue-budget ledger (since #1141 the
+ * per-session file `.orchestrator/runtime/issue-budget/<hash>.json`; the path
+ * is owned by `budgetStateRel` in `scripts/lib/issue-budget.mjs` — no caller,
+ * including this one, spells it out).
+ *
+ * The `repoRoot`-less fallback is `resolveProjectDir()` from `platform.mjs` —
+ * the SAME resolver `hooks/pre-bash-issue-budget.mjs` uses, so both producers
+ * of this ledger agree on which file they are charging. It strictly supersedes
+ * the hand-rolled expression it replaces: env fast-path first (including the
+ * Codex/Cursor/pi variants), then a walk-up for the instruction file — `CLAUDE.md`
+ * on Claude Code, `AGENTS.md` on Codex CLI (transparent aliases) — or `.git`, then cwd.
+ *
  * @param {string} cmd
  * @param {string[]} args
+ * @param {string} [repoRoot] — repo whose issue-budget ledger this call is
+ *   charged against. Falls back to `resolveProjectDir()` when absent.
  * @returns {{ ok: boolean, stdout: string, stderr: string, budgetBlocked?: boolean }}
  */
-function runCli(cmd, args) {
+function runCli(cmd, args, repoRoot) {
   if (isIssueCreateArgv(cmd, args)) {
     try {
-      const repoRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+      const budgetRoot = (typeof repoRoot === 'string' && repoRoot.trim())
+        ? repoRoot
+        : (resolveProjectDir() || process.cwd());
+      const vitestLedgerRefusal = refuseAmbientLedgerUnderVitest(budgetRoot);
+      if (vitestLedgerRefusal) {
+        return { ok: false, stdout: '', stderr: vitestLedgerRefusal, budgetBlocked: true };
+      }
       // The harness exports CLAUDE_CODE_SESSION_ID (measured 2026-08-21: it is
       // present in the Bash tool environment this module runs in). There is no
       // CLAUDE_SESSION_ID — reading that name made this whole block dead code
@@ -113,16 +167,43 @@ function runCli(cmd, args) {
       let currentSession = null;
       if (typeof nativeRawId === 'string' && nativeRawId.length > 0) {
         try {
-          currentSession = JSON.parse(
-            readFileSync(path.join(repoRoot, '.orchestrator', 'current-session.json'), 'utf8'),
+          const parsed = JSON.parse(
+            readFileSync(path.join(budgetRoot, '.orchestrator', 'current-session.json'), 'utf8'),
           );
+          // SESSION BINDING (#1058). `current-session.json` is repo-global —
+          // every session sharing this working copy writes the same path — so
+          // the file in hand may describe a PEER session, not us.
+          //
+          // The binding itself is not new: `resolveIssueBudgetSessionId`
+          // already requires `currentSession.session_id === nativeRawId` before
+          // it will adopt the file's semantic label, and falls back to the raw
+          // env id otherwise. What was missing is that the mismatch was
+          // INVISIBLE — the comparison lives one module over, so a foreign file
+          // was discarded with no trace, which is the same error class as using
+          // it silently. Deciding it HERE makes the outcome identical and the
+          // reason audible; it deliberately does not restate the wider
+          // multi-id-space classifier `scripts/lib/quality-gate.mjs` needs
+          // (that reader has no raw env id guaranteed in hand — this one does,
+          // by the `typeof nativeRawId === 'string'` guard above).
+          const foreignId = typeof parsed?.session_id === 'string' && parsed.session_id.length > 0
+            ? parsed.session_id
+            : null;
+          if (foreignId !== null && foreignId !== nativeRawId) {
+            process.stderr.write(
+              '⚠️  spiral-carryover: .orchestrator/current-session.json belongs to another ' +
+              `session (${foreignId}) — using the native session id for issue-budget ` +
+              'accounting. Another session is active in this working copy (PSA-001).\n',
+            );
+          } else {
+            currentSession = parsed;
+          }
         } catch {
           // Missing or malformed records conservatively retain the native env key.
         }
       }
       const titleIdx = args.indexOf('--title');
       const verdict = chargeIssueBudget({
-        repoRoot,
+        repoRoot: budgetRoot,
         sessionId: resolveIssueBudgetSessionId(nativeRawId, currentSession),
         command: [cmd, ...args].join(' '),
         title: titleIdx >= 0 ? (args[titleIdx + 1] ?? null) : null,
@@ -211,7 +292,7 @@ async function findExistingLabeledIssue({
         'number,url,body',
       ];
       if (spec) args.push('-R', spec);
-      const res = runCli('gh', args);
+      const res = runCli('gh', args, repoRoot);
       if (!res.ok) return { exists: false };
       let arr;
       try {
@@ -231,7 +312,7 @@ async function findExistingLabeledIssue({
     // Default: gitlab via glab.
     const args = ['issue', 'list', '--label', label, '--per-page', '100', '--output', 'json'];
     if (spec) args.push('-R', spec);
-    const res = runCli('glab', args);
+    const res = runCli('glab', args, repoRoot);
     if (!res.ok) return { exists: false };
     let arr;
     try {
@@ -420,7 +501,7 @@ export async function createSpiralCarryoverIssue({
     }
     if (spec) args.push('-R', spec);
 
-    const res = runCli(cmd, args);
+    const res = runCli(cmd, args, repoRoot);
     if (!res.ok) {
       return { created: false, skipped: 'error', error: res.stderr.trim() || 'CLI invocation failed' };
     }
@@ -609,7 +690,7 @@ export async function createBrokenWindowIssue({
     }
     if (spec) args.push('-R', spec);
 
-    const res = runCli(cmd, args);
+    const res = runCli(cmd, args, repoRoot);
     if (!res.ok) {
       return { created: false, skipped: 'error', error: res.stderr.trim() || 'CLI invocation failed' };
     }

package/scripts/lib/state-md/frontmatter-mutators.mjs

@@ -239,11 +239,20 @@ function extractFrontmatterBlock(text) {
  *
  * Scoped to the frontmatter block only (see the "Frontmatter-safe round-trip
  * guard" comment above `DEFAULT_STATE_MD_SIZE_CEILING_BYTES` for the scoping
- * rationale). Content with no parseable frontmatter (`parseStateMd(after) ===
- * null`) is treated as SAFE — there is nothing frontmatter-shaped to verify,
- * and this keeps non-STATE.md-shaped writes (e.g. arbitrary test fixtures)
- * ungated by this check, matching `evaluateSizeCeiling`'s content-agnostic
- * posture for that case.
+ * rationale).
+ *
+ * `parseStateMd(after) === null` has TWO causes and they get OPPOSITE verdicts,
+ * because collapsing them is what made this guard blind:
+ *   - NO frontmatter fence in `after` → SAFE. There is nothing frontmatter-shaped
+ *     to verify, and non-STATE.md-shaped writes (arbitrary test fixtures, plain
+ *     body text) stay ungated, matching `evaluateSizeCeiling`'s content-agnostic
+ *     posture for that case.
+ *   - A fence IS present but its contents do not parse → UNSAFE. A write whose
+ *     frontmatter this repo's own parser cannot read back is precisely the
+ *     corruption class this guard exists to refuse; treating it as "nothing to
+ *     verify" let the single worst input pass unchecked (the 2026-08-24 #1111
+ *     regression, where one flow item nulled the whole document, sat in exactly
+ *     this hole).
  *
  * Never throws — mirrors the never-throw contract of yaml-parser.mjs.
  *
@@ -251,12 +260,20 @@ function extractFrontmatterBlock(text) {
  * @returns {{ unsafe: boolean, reason: string|null }}
  */
 export function evaluateFrontmatterSafe(after) {
+  const beforeBlock = extractFrontmatterBlock(after);
   const parsed = parseStateMd(after);
   if (parsed === null) {
-    return { unsafe: false, reason: null };
+    if (beforeBlock === null) {
+      return { unsafe: false, reason: null };
+    }
+    return {
+      unsafe: true,
+      reason:
+        `frontmatter block is present but parseStateMd could not read it back ` +
+        `(${Buffer.byteLength(beforeBlock, 'utf8')}B unparseable)`,
+    };
   }
   const reserialized = serializeStateMd(parsed);
-  const beforeBlock = extractFrontmatterBlock(after);
   const afterBlock = extractFrontmatterBlock(reserialized);
   if (beforeBlock !== afterBlock) {
     return {
@@ -320,7 +337,10 @@ function writeFileAtomic(filePath, contents) {
  * deliberately left unshipped when issue #739 first landed, because the
  * yaml-parser asymmetry it exists to catch made it false-positive on ordinary
  * content at the time) — #747 closed that asymmetry in yaml-parser.mjs, so
- * the check is safe to enforce. It catches FUTURE serializer/parser drift
+ * the check is safe to enforce. A frontmatter fence that is present but does
+ * NOT parse back is refused by the same guard (see `evaluateFrontmatterSafe`);
+ * only content with no fence at all leaves it inert. It catches FUTURE
+ * serializer/parser drift
  * that reintroduces a non-idempotent frontmatter round-trip — the exact
  * incident class behind #739 — rather than the symptom (file size) the
  * size-ceiling guard was limited to. Same non-throw, WARN-then-refuse
@@ -395,6 +415,19 @@ export async function writeStateMd(repoRoot, transformer, opts = {}) {
         return { written: false, path: statePath, contents: before, reason: 'frontmatter-unsafe' };
       }
 
+      // A list item the parser cannot represent is dropped on READ (see
+      // yaml-parser.mjs `parseBlockValue`), so this write is what makes the drop
+      // permanent on disk. Dropping is the right call — the alternatives are a
+      // mangled key or a dead no-op — but it must not be SILENT, which is the
+      // whole complaint the per-item scoping answers. Name the items, then write
+      // anyway: blocking here would re-create the no-op this fix removed.
+      const droppedItems = parseStateMd(before)?.warnings;
+      if (droppedItems !== undefined) {
+        process.stderr.write(
+          `⚠ writeStateMd: ${statePath} — dropping ${droppedItems.length} unrepresentable list item(s): ` +
+            `${droppedItems.map((w) => `${w.key}[${w.index}] (${w.reason})`).join(', ')}\n`
+        );
+      }
       writeFileAtomic(statePath, after);
       return { written: true, path: statePath, contents: after };
     },