session-orchestrator 4.0.0 → 4.1.0

package/scripts/lib/validate/check-owner-leakage.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 /**
  * check-owner-leakage.mjs — Scan tracked files for owner-privacy leakage patterns.
+ * Add --include-untracked to also scan new files that Git does not ignore.
  *
  * Implements the #462 audit trail durable CI guard (#471).
  * Canonicalization-before-matching refactor (issue #661): the historical
@@ -19,7 +20,7 @@
  * toward over-matching: this is a security guard, a false-positive is cheap, a
  * false-negative ships a leak to the public mirror.
  *
- * Usage: check-owner-leakage.mjs <plugin-root>
+ * Usage: check-owner-leakage.mjs <plugin-root> [--include-untracked]
  *
  * Forbidden patterns (canonical rules CP1–CP10):
  *   CP1  personal home path `/Users/bernhardg…` — matched on the CANONICAL form,
@@ -128,8 +129,9 @@ const isMain =
 
 // CLI: single positional arg required (only enforced when run directly).
 const pluginRoot = argv[2];
+const includeUntracked = argv.slice(3).includes('--include-untracked');
 if (isMain && !pluginRoot) {
-  console.error('Usage: check-owner-leakage.mjs <plugin-root>');
+  console.error('Usage: check-owner-leakage.mjs <plugin-root> [--include-untracked]');
   process.exit(1);
 }
 
@@ -751,7 +753,7 @@ function rawConfidentialNamesKeyState(ownerYamlPath) {
  * be called only from runScan() — NOT at module top-level. This module is
  * dual-mode (CLI entry point AND importable library, `isMain` guard); a top-level
  * fs read would fire on every library import (e.g. pseudonym-map.mjs importing
- * isOwnerLeakySegment). loadConfidentialNames caches per path, so calling this
+ * isOwnerLeakySegment). inspectConfidentialNames caches per path, so calling this
  * once per scan reads the file at most once.
  *
  * STANDALONE-SAFE: the two host-local helper modules are DYNAMICALLY imported
@@ -789,9 +791,10 @@ function rawConfidentialNamesKeyState(ownerYamlPath) {
  * exists to block. The operator knows their own path; the CLASS of failure is what
  * this line has to convey.
  *
+ * @param {{ loadHostPaths?: typeof import('../config/host-paths.mjs').loadHostPaths }} [opts]
  * @returns {Promise<{ patterns: RegExp[], disabledReason?: string, inertWarn?: string }>}
  */
-async function getConfidentialNamePatterns() {
+export async function getConfidentialNamePatterns({ loadHostPaths } = {}) {
   let helpers;
   try {
     helpers = {
@@ -803,7 +806,26 @@ async function getConfidentialNamePatterns() {
     };
   } catch (err) {
     if (err?.code === 'ERR_MODULE_NOT_FOUND' && isMissingDirectSibling(err)) {
-      // (a) standalone single-file vendoring — the documented degrade.
+      // (a) standalone single-file vendoring. The degrade is documented — but it
+      // must not swallow a CP11 that the operator DID configure (GitLab #1262).
+      // No helper resolved here, so the only configuration signal still readable
+      // is the raw env var: a literal mirror of ENV_KEYS['confidential-names-file']
+      // in scripts/lib/config/host-paths.mjs, which cannot be imported on this
+      // branch by construction.
+      //
+      // LIMIT (named, not hidden): an owner.yaml-configured names file is
+      // STRUCTURALLY undetectable in a standalone copy — resolveOwnerYamlPath()
+      // lives in the very module chain that failed to resolve, so there is no way
+      // to learn that owner.yaml even exists, let alone what it configures. Only
+      // the env route can fail closed here; the owner.yaml route degrades inert.
+      const envNamesPath = process.env.SO_CONFIDENTIAL_NAMES_FILE;
+      if (typeof envNamesPath === 'string' && envNamesPath.trim() !== '') {
+        return {
+          patterns: [],
+          disabledReason:
+            'CP11 configured via SO_CONFIDENTIAL_NAMES_FILE but the confidential-names helpers are not resolvable (standalone copy) — failing closed',
+        };
+      }
       return {
         patterns: [],
         inertWarn: 'CP11 inert — confidential-names helpers not resolvable (standalone copy)',
@@ -814,36 +836,61 @@ async function getConfidentialNamePatterns() {
   }
 
   try {
-    const { loadHostPaths, resolveHostPath } = helpers.hostPaths;
-    const { loadConfidentialNames } = helpers.confidentialNames;
-    const { loadOwnerConfig, resolveOwnerYamlPath } = helpers.ownerYaml;
+    const { resolveHostPath } = helpers.hostPaths;
+    const { inspectConfidentialNames } = helpers.confidentialNames;
+    const { resolveOwnerYamlPath } = helpers.ownerYaml;
+
+    // ONE owner.yaml load. Since #1251 loadHostPaths() passes the loader's own
+    // health (source / reason / droppedSections) straight through, so the
+    // env>owner.yaml>default precedence and the load's diagnosis come from the
+    // same read — no second loadOwnerConfig() call to recover what was discarded.
+    const hostCtx = (loadHostPaths ?? helpers.hostPaths.loadHostPaths)();
+
+    // FAIL-CLOSED on an unknowable load (LOW-2). `loadHostPaths` has its own
+    // defensive catch that swallows a THROWING owner loader and returns
+    // `{ ownerConfig: undefined, env, source: undefined, reason: undefined }`.
+    // Without this branch that shape resolves `namesPath` to '' , fires no
+    // reason branch, and returns `{ patterns: [] }` — a silent PASS.
+    // Only the throw produces all-undefined: `loadOwnerConfig` returns
+    // `{ config: getDefaults(), source: 'defaults', errors: [] }` for a
+    // genuinely ABSENT owner.yaml (owner-yaml.mjs:587-590) and `source:
+    // 'defaults'` with a `reason` for every read/parse failure — so a missing
+    // file keeps taking the normal path below. Latent today (the loader
+    // returns on every error path), load-bearing if that ever changes.
+    if (
+      hostCtx.ownerConfig === undefined &&
+      hostCtx.source === undefined &&
+      hostCtx.reason === undefined
+    ) {
+      return {
+        patterns: [],
+        disabledReason:
+          'CP11 could not determine whether a confidential-names file is configured (owner config loader failed) — failing closed',
+      };
+    }
 
-    // Load owner.yaml ONCE and hand the same result to loadHostPaths, so the
-    // env>owner.yaml>default precedence is unchanged while the load's own health
-    // (reason / droppedSections) stays visible here.
-    const owner = loadOwnerConfig();
-    const namesPath = resolveHostPath('confidential-names-file', '', loadHostPaths({ ownerLoader: () => owner }));
+    const namesPath = resolveHostPath('confidential-names-file', '', hostCtx);
 
     if (typeof namesPath !== 'string' || namesPath.trim() === '') {
       // Nothing resolves a names file. That is either (b) — genuinely
       // unconfigured — or a state in which the answer is UNKNOWABLE because the
       // owner.yaml that would carry it could not be read. Unknowable is (c).
       if (existsSync(resolveOwnerYamlPath())) {
-        if (owner.reason === 'yaml-parser-missing') {
+        if (hostCtx.reason === 'yaml-parser-missing') {
           return {
             patterns: [],
             disabledReason:
               "owner.yaml exists but 'js-yaml' is not installed, so a configured confidential-names-file cannot be resolved (run 'npm install')",
           };
         }
-        if (owner.reason === 'unparseable') {
+        if (hostCtx.reason === 'unparseable') {
           return {
             patterns: [],
             disabledReason:
               'owner.yaml exists but could not be parsed, so a configured confidential-names-file cannot be resolved',
           };
         }
-        if (owner.droppedSections?.some((d) => d.section === 'paths')) {
+        if (hostCtx.droppedSections?.some((d) => d.section === 'paths')) {
           // The paths: section was replaced by its default because SOME key in it
           // is invalid — which says nothing yet about whether CP11 was configured.
           // Re-read the RAW file for that one key (the loader does not expose it on
@@ -875,15 +922,37 @@ async function getConfidentialNamePatterns() {
       return { patterns: [] }; // (b) the ~99% default — inactive, silent.
     }
 
-    // A names file IS configured. loadConfidentialNames() returns null for BOTH
-    // "unusable" and "deliberately empty list", so classify the file first — an
-    // empty list is an operator choice (inactive, silent), a missing/malformed
-    // one is (c).
-    const unusable = classifyNamesFile(namesPath);
-    if (unusable) return { patterns: [], disabledReason: unusable };
-
-    const names = loadConfidentialNames({ namesPath });
-    if (!names) return { patterns: [] }; // readable, well-formed, zero usable entries.
+    // A names file IS configured. Since #1250 the loader REPORTS the class it
+    // used to collapse into `null`, so the verdict reads straight off `status` —
+    // no second read of the file to re-derive it. Only `[]` ('empty') is an
+    // operator choice (inactive, silent); 'missing'/'malformed'/'all-dropped'
+    // mean a configured guard cannot run, which is (c) and fails closed. The
+    // reasons carry no path (see above). `inspectConfidentialNames` is the
+    // discriminated entry point; `loadConfidentialNames` keeps its 4.0.0
+    // `string[] | null` shape for external deep-importers and cannot express
+    // this distinction.
+    const { status, names } = inspectConfidentialNames({ namesPath });
+    if (status === 'missing') {
+      return { patterns: [], disabledReason: 'a confidential-names-file is configured but does not exist' };
+    }
+    if (status === 'malformed') {
+      return {
+        patterns: [],
+        disabledReason: 'the configured confidential-names-file is unreadable or not a JSON array of names',
+      };
+    }
+    if (status === 'all-dropped') {
+      // W4 finding F3 (fail-open): the file listed entries and validation rejected
+      // every one of them (non-strings, blanks, over-long). That is a CORRUPTED
+      // list, not the `[]` opt-out — CP11 would run with zero patterns and report
+      // the clean verdict it never earned. Same class as 'malformed'.
+      return {
+        patterns: [],
+        disabledReason:
+          'every entry in the configured confidential-names-file was rejected as invalid or oversized',
+      };
+    }
+    if (status !== 'ok') return { patterns: [] }; // 'empty' — the operator's `[]` opt-out.
     return { patterns: names.map((name) => new RegExp(`\\b${escapeRegex(name)}\\b`, 'i')) };
   } catch (err) {
     // The helpers resolved but something below threw. CP11 cannot run — fail closed.
@@ -891,40 +960,6 @@ async function getConfidentialNamePatterns() {
   }
 }
 
-/**
- * Classify a CONFIGURED confidential-names file as usable or not.
- *
- * `loadConfidentialNames()` collapses "file missing / unreadable / malformed /
- * not an array" and "well-formed but empty" into one `null` return, which is
- * exactly the distinction CP11's fail-closed verdict turns on. Rather than widen
- * that module's contract (it has four other consumers of its `null`), this reads
- * the file once more for classification only. It never returns file CONTENT — the
- * reason string carries the error CLASS alone, matching the confidential-names
- * privacy invariant and the no-path rule above.
- *
- * @param {string} namesPath
- * @returns {string|null} a reason string when unusable, null when usable.
- */
-function classifyNamesFile(namesPath) {
-  let raw;
-  try {
-    if (!existsSync(namesPath)) {
-      return 'a confidential-names-file is configured but does not exist';
-    }
-    raw = readFileSync(namesPath, 'utf8');
-  } catch (err) {
-    return `the configured confidential-names-file is unreadable (${err?.name ?? 'Error'})`;
-  }
-  try {
-    if (!Array.isArray(JSON.parse(raw))) {
-      return 'the configured confidential-names-file is not a JSON array';
-    }
-  } catch (err) {
-    return `the configured confidential-names-file contains malformed JSON (${err?.name ?? 'Error'})`;
-  }
-  return null;
-}
-
 // ---------------------------------------------------------------------------
 // Text-scan extension allowlist (spec A.2)
 // ---------------------------------------------------------------------------
@@ -955,6 +990,7 @@ function classifyNamesFile(namesPath) {
 // adding: all 7 tracked `.jsonl` files pass (1525 -> 1532 scanned, 0 findings).
 const TEXT_EXTS = new Set([
   '.md',
+  '.mdx',
   '.mjs',
   '.js',
   '.ts',
@@ -989,9 +1025,14 @@ function isTextFile(filePath) {
 
 function getTrackedFiles() {
   try {
-    const output = execFileSync('git', ['ls-files'], { cwd: pluginRoot, encoding: 'utf8' });
+    // NUL delimiters preserve Unicode, spaces and newlines without Git's quoted
+    // filename encoding. --exclude-standard applies only to untracked entries;
+    // tracked files remain visible even if an ignore rule now matches them.
+    const args = ['ls-files', '-z', '--cached'];
+    if (includeUntracked) args.push('--others', '--exclude-standard');
+    const output = execFileSync('git', args, { cwd: pluginRoot, encoding: 'utf8' });
     return output
-      .split('\n')
+      .split('\0')
       .filter(Boolean)
       .map((f) => join(pluginRoot, f));
   } catch {
@@ -1077,6 +1118,10 @@ function isAllowlisted(relPath, line) {
     'site/index.html',
     'site/impressum/index.html',
     'site/datenschutz/index.html',
+    // The German landing page (2026-09-07 redesign) carries the same publisher
+    // identity (JSON-LD @id + footer rel="author") as site/index.html. Exact
+    // path, never a site/de/ prefix — site/guide/index.html stays outside.
+    'site/de/index.html',
   ]);
   const inAllowlistedFile = ALLOWLISTED_URL_PATHS.has(norm);
 
@@ -1366,7 +1411,7 @@ if (violations.length === 0) {
 }
 
 console.log('');
-console.log(`Results: ${passed} passed, ${failed} failed`);
+console.log(`Results: ${passed} passed, ${failed} failed (${scanFiles.length} scanned files)`);
 process.exit(failed === 0 ? 0 : 1);
 }
 

package/scripts/lib/validate/check-skill-links.mjs

@@ -43,13 +43,36 @@
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, dirname, resolve, relative, sep } from 'node:path';
 
-/** Surfaces whose markdown is instruction, i.e. read and acted on. */
-export const SCAN_DIRS = Object.freeze(['skills', 'commands', 'agents', '.claude/rules']);
+/**
+ * Surfaces whose markdown is instruction, i.e. read and acted on.
+ *
+ * `docs/` joined the list in #1258 after the annotate-before-widen step the sibling
+ * `check-skill-script-paths.mjs` ran for #1208: a read-only re-scan (`dirs: ['docs']`,
+ * 2026-09-07) returned 92 files / 111 relative links / 8 findings — six of them GitLab
+ * `-/issues/N` renderer links now carved out by `SKIP_TARGET`, two of them genuinely dangling
+ * links to PRDs that had been archived to the private Meta-Vault. Both classes were resolved
+ * before the widening, so the widening itself lands at 0 findings.
+ */
+export const SCAN_DIRS = Object.freeze(['skills', 'commands', 'agents', '.claude/rules', 'docs']);
 
 /** Path segments that end the walk: vendored or machine-owned trees, never instruction. */
 export const PRUNE_DIRS = new Set(['node_modules', '.git', 'coverage', 'dist', '.pnpm']);
 
-const SKIP_TARGET = /^(https?:|mailto:|#|\/)/i;
+/**
+ * Targets this checker never resolves against the filesystem.
+ *
+ * The `-/issues/N` · `-/merge_requests/N` branch is a GitLab RENDERER convention, not a link
+ * defect: `../../../-/issues/174` is how a doc nested two levels deep points at the project's
+ * issue tracker, and GitLab resolves it correctly in its own Markdown view. It leaves the repo
+ * by construction, so a filesystem checker can only ever call it dangling. Measured 2026-09-07:
+ * 6 of the 8 `docs/` findings were exactly this shape, all in `docs/owner-config-schema.md`.
+ *
+ * The branch is anchored at BOTH ends. Left-unanchored it would still be a carve-out, but
+ * right-unanchored it swallowed every path that merely PASSES THROUGH such a segment —
+ * `docs/-/issues/12/../../secrets.md` is a genuinely dangling link and was SKIPped. The
+ * optional trailing `#note_123` is kept because GitLab issue links legitimately carry one.
+ */
+const SKIP_TARGET = /^(https?:|mailto:|#|\/)|(^|\/)-\/(issues|merge_requests)\/\d+(#[\w-]*)?$/i;
 const LINK_RE = /\[[^\]]*\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g;
 const INLINE_CODE_RE = /(`+)[^`]*?\1/g;
 
@@ -89,11 +112,15 @@ function fencedLineNumbers(text) {
  * these four directories would also be checked — there are none, and one would be a finding worth
  * seeing anyway.
  *
+ * @param {string} repoRoot
+ * @param {{dirs?: readonly string[]}} [options] `dirs` defaults to {@link SCAN_DIRS}; it exists so
+ *   an annotate-before-widen dry-run over a candidate surface needs no re-implementation of this
+ *   predicate (same shape as `scanSkillScriptPaths({ dirs })`).
  * @returns {string[]} repo-relative paths, sorted for stable output
  */
-export function listMarkdown(repoRoot) {
+export function listMarkdown(repoRoot, { dirs = SCAN_DIRS } = {}) {
   const out = [];
-  for (const dir of SCAN_DIRS) {
+  for (const dir of dirs) {
     const abs = join(repoRoot, dir);
     let entries;
     try { entries = readdirSync(abs, { recursive: true, withFileTypes: true }); } catch { continue; }
@@ -112,12 +139,15 @@ export function listMarkdown(repoRoot) {
 }
 
 /**
+ * @param {string} [repoRoot]
+ * @param {{dirs?: readonly string[]}} [options] `dirs` defaults to {@link SCAN_DIRS} — see
+ *   {@link listMarkdown}.
  * @returns {{ok: boolean, checked: number, files: number, findings: Array<{file: string, line: number, target: string}>}}
  */
-export function checkSkillLinks(repoRoot = process.cwd()) {
+export function checkSkillLinks(repoRoot = process.cwd(), { dirs = SCAN_DIRS } = {}) {
   const findings = [];
   let checked = 0;
-  const files = listMarkdown(repoRoot);
+  const files = listMarkdown(repoRoot, { dirs });
 
   for (const rel of files) {
     const abs = join(repoRoot, rel);

package/scripts/lib/validate/check-test-git-config-target.mjs

@@ -40,6 +40,37 @@
  * measures that second population so the gap is visible in the OUTPUT, not
  * only in this comment.
  *
+ * ## Wrapper-aware: `fixtureGit` / `fixtureGitSpawn` are git invocations
+ *
+ * Since 2026-09-06 most fixtures do not spawn `git` themselves — they call
+ * `fixtureGit(args, cwd, opts)` / `fixtureGitSpawn(…)` from
+ * `tests/_helpers/tmp-fixture.mjs`, which prepend `...NO_BACKGROUND_WRITER` and
+ * spawn the binary inside the helper. Two consequences, both measured
+ * 2026-09-07 against this tree:
+ *
+ *  - Resolving only the helper's own two `execFileSync`/`spawnSync` lines
+ *    (i.e. teaching {@link classifyArgv} to skip the allowlisted flag-only
+ *    spread, see {@link NOOP_PREFIX_SPREADS}) changes NOTHING: `applicable`
+ *    stays at **17**, because the token after the allowlisted spread is
+ *    `...args` — an unknown spread the census must still refuse to guess past.
+ *  - Recognising the two helpers BY NAME, and reading the argv array's first
+ *    element as the subcommand, lifts `applicable` to **~200** with **0**
+ *    findings (197 → 198 → 200 across the 2026-09-07 re-measurements as
+ *    sibling waves added fixtures; re-measure before quoting) — the census
+ *    then sees the real test population instead of a residue. That population is **244** `fixtureGit`/`fixtureGitSpawn` call
+ *    sites, measured 2026-09-07 with
+ *    `rg -o "\bfixtureGit(Spawn)?\s*\(" tests/ -g '*.mjs' | wc -l`
+ *    (the header claimed 239 until that re-measurement; `applicable` is the
+ *    smaller number because read-only and unresolved-argv calls are excluded).
+ *
+ * Wrapper-aware is therefore the mode this file implements. It costs one extra
+ * rule: the helper takes its target as the SECOND POSITIONAL, not as a `cwd:`
+ * key, and `undefined`, `null` or an ABSENT second positional all mean "no
+ * destination was handed to the helper" — see {@link wrapperHasCwd}, which
+ * judges the COMMENT-STRIPPED tail so an inline comment cannot stand in for the
+ * argument. Judging a wrapper call by the `cwd:` scan alone would have reported
+ * nearly every routed fixture as untargeted.
+ *
  * Further named gaps:
  *  - **A non-literal argv array is never judged.** `execFileSync('git', args, …)`
  *    cannot be classified from the call site; counted as `unresolvedArgv`.
@@ -163,6 +194,16 @@ const TARGET_DECLARING_GLOBALS = Object.freeze(['-C', '--git-dir', '--work-tree'
 /** Call shapes that hand an argv ARRAY to a `git` binary. */
 const ARGV_CALL_RE = /\b(?:execFileSync|execFile|spawnSync|spawn)\s*\(\s*['"]git['"]\s*,\s*/g;
 
+/**
+ * Call shapes that route a `git` argv through this suite's fixture helpers.
+ *
+ * `fixtureGit(args, cwd, opts)` / `fixtureGitSpawn(args, cwd, opts)` from
+ * `tests/_helpers/tmp-fixture.mjs` ARE git invocations — the binary is inside
+ * the helper. Recognising them by name is what makes the census reflect the
+ * real test population; see § Wrapper-aware in the header.
+ */
+const WRAPPER_CALL_RE = /\b(?:fixtureGit|fixtureGitSpawn)\s*\(/g;
+
 /** Call shapes that hand a SHELL STRING opening with `git` to a shell. */
 const SHELL_CALL_RE = /\b(?:execSync|exec)\s*\(\s*(['"`])\s*git\s/g;
 
@@ -226,15 +267,30 @@ function matchBracket(text, open, openChar, closeChar) {
 }
 
 /**
- * @typedef {{t:'lit', v:string} | {t:'spread'} | {t:'expr'}} ArgvToken
- *   `lit` a string literal · `spread` a `...rest` element · `expr` any other
+ * @typedef {{t:'lit', v:string} | {t:'spread', name:string} | {t:'expr'}} ArgvToken
+ *   `lit` a string literal · `spread` a `...rest` element, carrying the spread
+ *   identifier (`''` when it is not a plain identifier) · `expr` any other
  *   expression (an identifier, a member access, an interpolated template).
  *
  * The `spread`/`expr` split is load-bearing, not cosmetic: `['init','-q',dir]`
  * carries its target in an `expr` positional, while `['-C',dir,...args]`
  * carries an unknowable tail in a `spread`. Folding both to "opaque" is what
  * produced the first measurement's 11 false positives.
+ *
+ * The spread's NAME is load-bearing in turn — see {@link NOOP_PREFIX_SPREADS}.
+ */
+
+/**
+ * Spread identifiers that are known to contain ONLY `git` global flags, so a
+ * leading `...NAME` may be skipped exactly as a literal `-c k=v` run is.
+ *
+ * An explicit allowlist, never a heuristic: any OTHER spread keeps the
+ * fail-closed `subcommand: null`, because guessing past an unknown spread is
+ * precisely what produced the 11 false positives named in the header.
+ *
+ * @type {ReadonlySet<string>}
  */
+const NOOP_PREFIX_SPREADS = new Set(['NO_BACKGROUND_WRITER']);
 
 /**
  * Tokenize a literal argv array body into ordered tokens.
@@ -245,13 +301,13 @@ function matchBracket(text, open, openChar, closeChar) {
 export function tokenizeArgv(inner) {
   /** @type {ArgvToken[]} */
   const tokens = [];
-  const re = /(['"])((?:\\.|(?!\1)[^\\])*)\1|`([^`$]*)`|(\.\.\.)[\w$.[\]]*|([A-Za-z_$][\w$.[\]]*|`[^`]*`)/g;
+  const re = /(['"])((?:\\.|(?!\1)[^\\])*)\1|`([^`$]*)`|(\.\.\.)([\w$.[\]]*)|([A-Za-z_$][\w$.[\]]*|`[^`]*`)/g;
   /** @type {RegExpExecArray|null} */
   let m;
   while ((m = re.exec(inner)) !== null) {
     if (m[2] !== undefined) tokens.push({ t: 'lit', v: m[2] });
     else if (m[3] !== undefined) tokens.push({ t: 'lit', v: m[3] });
-    else if (m[4] !== undefined) tokens.push({ t: 'spread' });
+    else if (m[4] !== undefined) tokens.push({ t: 'spread', name: m[5] ?? '' });
     else tokens.push({ t: 'expr' });
   }
   return tokens;
@@ -268,8 +324,13 @@ export function classifyArgv(tokens) {
   let index = 0;
   while (index < tokens.length) {
     const token = tokens[index];
-    // A non-literal in leading-flag position makes the subcommand unknowable;
-    // never guess past it.
+    // An ALLOWLISTED flag-only spread is skipped exactly like a `-c k=v` run.
+    if (token.t === 'spread' && NOOP_PREFIX_SPREADS.has(token.name)) {
+      index += 1;
+      continue;
+    }
+    // Any other non-literal in leading-flag position makes the subcommand
+    // unknowable; never guess past it.
     if (token.t !== 'lit') return { hasArgvTarget, subcommand: null, rest: [] };
     if (!token.v.startsWith('-')) break;
 
@@ -416,6 +477,84 @@ export function insideStringLiteral(body, index) {
   return quote !== null;
 }
 
+/**
+ * Replace every comment in `text` with a single space, leaving string literals
+ * untouched.
+ *
+ * Not cosmetic: {@link wrapperHasCwd} judges the SECOND POSITIONAL textually,
+ * so an inline `/* … *\/` between the comma and the argument used to shift the
+ * argument out of view and the call read as targeted — a comment that says
+ * "no cwd" measured as a cwd. `inCommentLine` cannot serve here: it answers a
+ * question about a whole LINE, while this one runs inside a call expression.
+ *
+ * @param {string} text
+ * @returns {string} same length semantics, comments blanked to one space
+ */
+export function stripComments(text) {
+  let out = '';
+  /** @type {string|null} */
+  let quote = null;
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    if (quote !== null) {
+      out += ch;
+      if (ch === '\\') {
+        out += text[i + 1] ?? '';
+        i += 1;
+      } else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === '`') {
+      quote = ch;
+      out += ch;
+      continue;
+    }
+    if (ch === '/' && text[i + 1] === '*') {
+      const end = text.indexOf('*/', i + 2);
+      i = end === -1 ? text.length : end + 1;
+      out += ' ';
+      continue;
+    }
+    if (ch === '/' && text[i + 1] === '/') {
+      const end = text.indexOf('\n', i);
+      i = end === -1 ? text.length : end - 1;
+      out += ' ';
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+
+/**
+ * Decide whether a fixture-helper call names a working directory.
+ *
+ * `fixtureGit(args, cwd, opts)` takes the target as its SECOND POSITIONAL, not
+ * as a `cwd:` key — so the textual `cwd:` scan that judges a raw `execFileSync`
+ * would report every one of these as untargeted.
+ *
+ * Three shapes are explicitly NOT a target, because none of them hands the
+ * helper a destination: a literal `undefined` (the documented "the argv names
+ * the target" form), a literal `null` (same at runtime — `spawnSync` inherits
+ * the ambient cwd for both), and an ABSENT second positional. Judging is done
+ * on the COMMENT-STRIPPED tail: `fixtureGit([…], /* no cwd *\/ undefined)` read
+ * as targeted before 2026-09-07 — the comment, not the argument, was what the
+ * second-positional scan saw.
+ *
+ * @param {string} tail call arguments AFTER the argv array's `]`, bounded by
+ *   the call's closing paren
+ * @returns {boolean}
+ */
+export function wrapperHasCwd(tail) {
+  const clean = stripComments(tail);
+  const m = /^\s*,\s*/.exec(clean);
+  if (m) {
+    const second = clean.slice(m[0].length);
+    if (second !== '' && !/^(?:undefined|null)\b/.test(second) && !/^,/.test(second)) return true;
+  }
+  return CWD_OPTION_RE.test(clean);
+}
+
 /**
  * Scan one file for `git` invocations.
  *
@@ -428,7 +567,7 @@ export function scanFile(relative, body, tally) {
   /** @type {Array<{kind: string, file: string, line: number, form: string, command: string, message: string}>} */
   const findings = [];
 
-  /** @type {Array<{index: number, form: 'argv'|'shell', tokens: Array<string|null>, tail: string}>} */
+  /** @type {Array<{index: number, form: 'argv'|'shell'|'wrapper', tokens: Array<string|null>, tail: string}>} */
   const calls = [];
 
   ARGV_CALL_RE.lastIndex = 0;
@@ -454,6 +593,35 @@ export function scanFile(relative, body, tally) {
     });
   }
 
+  WRAPPER_CALL_RE.lastIndex = 0;
+  while ((m = WRAPPER_CALL_RE.exec(body)) !== null) {
+    const openParen = m.index + m[0].length - 1;
+    const callEnd = matchBracket(body, openParen, '(', ')');
+    if (callEnd === -1) {
+      tally.unresolvedArgv += 1;
+      continue;
+    }
+    const argsText = body.slice(openParen + 1, callEnd);
+    const arrayStart = argsText.search(/\S/);
+    if (arrayStart === -1 || argsText[arrayStart] !== '[') {
+      // `fixtureGit(args, dir)` — a variable argv, unjudgeable like its
+      // `execFileSync` counterpart.
+      tally.unresolvedArgv += 1;
+      continue;
+    }
+    const close = matchBracket(argsText, arrayStart, '[', ']');
+    if (close === -1) {
+      tally.unresolvedArgv += 1;
+      continue;
+    }
+    calls.push({
+      index: m.index,
+      form: 'wrapper',
+      tokens: tokenizeArgv(argsText.slice(arrayStart + 1, close)),
+      tail: argsText.slice(close + 1),
+    });
+  }
+
   SHELL_CALL_RE.lastIndex = 0;
   while ((m = SHELL_CALL_RE.exec(body)) !== null) {
     const quote = m[1];
@@ -487,11 +655,20 @@ export function scanFile(relative, body, tally) {
     }
     tally.applicable += 1;
 
-    // The options object: everything up to the end of the call expression.
+    // The options object: everything up to the end of the call expression. For
+    // a wrapper call `call.tail` is ALREADY bounded by the call's own closing
+    // paren, and its second positional — not a `cwd:` key — carries the target.
+    const isWrapper = call.form === 'wrapper';
     const callEnd = matchBracket(call.tail, call.tail.indexOf('('), '(', ')');
-    const optionsText = callEnd === -1 ? call.tail.slice(0, 400) : call.tail.slice(0, callEnd);
-    const opaqueOptions = OPAQUE_OPTIONS_RE.test(call.tail);
-    const hasCwd = CWD_OPTION_RE.test(optionsText);
+    const optionsText = isWrapper
+      ? call.tail
+      : callEnd === -1
+        ? call.tail.slice(0, 400)
+        : call.tail.slice(0, callEnd);
+    const opaqueOptions = !isWrapper && OPAQUE_OPTIONS_RE.test(call.tail);
+    const hasCwd = isWrapper
+      ? wrapperHasCwd(call.tail)
+      : CWD_OPTION_RE.test(optionsText);
     const hasEnvTarget = GIT_ENV_TARGET_RE.test(optionsText);
     const hasTarget =
       hasArgvTarget || hasCwd || hasEnvTarget || hasSubcommandTarget(subcommand, rest);
@@ -582,7 +759,10 @@ export function inspectTestGitConfigTarget(pluginRoot) {
       });
       return result;
     }
-    if (!/['"`]\s*git[\s'"`]/.test(body)) continue;
+    // Cheap prefilter. The second alternative is load-bearing since the census
+    // became wrapper-aware: a file that only calls `fixtureGit([...])` never
+    // writes the quoted binary name and would otherwise be skipped unseen.
+    if (!/['"`]\s*git[\s'"`]/.test(body) && !/\bfixtureGit(?:Spawn)?\s*\(/.test(body)) continue;
     findings.push(...scanFile(relative, body, tally));
   }