session-orchestrator 5.0.0 → 5.2.0

package/scripts/github-protection-audit.mjs

@@ -34,8 +34,8 @@
 
 import { execFile as _execFile } from 'node:child_process';
 import { promisify } from 'node:util';
-import { pathToFileURL } from 'node:url';
 import { resolveRepoSpec as _resolveRepoSpec, resolveRepoHost as _resolveRepoHost } from './lib/vcs-repo-spec.mjs';
+import { isMainModule } from './lib/is-main-module.mjs';
 
 const execFileAsync = promisify(_execFile);
 
@@ -347,8 +347,7 @@ export async function auditGithubBranchProtection(opts = {}, deps = {}) {
 }
 
 // CLI entry — only when run directly, not when imported (e.g. by tests).
-const isMain =
-  process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+const isMain =isMainModule(import.meta.url);
 
 if (isMain) {
   auditGithubBranchProtection({ repoRoot: process.cwd() }).then((result) => {

package/scripts/lib/agent-frontmatter.mjs

@@ -58,7 +58,12 @@ export function parseAgentFrontmatter(contents) {
     };
   }
 
-  const match = FRONTMATTER_RE.exec(contents);
+  // A UTF-8 BOM before `---` makes FRONTMATTER_RE miss the block entirely, so a
+  // BOM-prefixed SKILL.md would parse as "no frontmatter" and every flag in it
+  // (`user-invocable` included) silently disappear.
+  const text = contents.charCodeAt(0) === 0xfeff ? contents.slice(1) : contents;
+
+  const match = FRONTMATTER_RE.exec(text);
   if (!match) {
     return {
       ok: false,
@@ -76,19 +81,36 @@ export function parseAgentFrontmatter(contents) {
   const frontmatter = /** @type {Record<string,string>} */ ({});
   const lines = fmText.split(/\r?\n/);
 
+  // Indented lines belong to whatever the preceding top-level key opened (a
+  // nested mapping, or a block scalar) — they are NOT top-level keys. Without
+  // this, `metadata:\n  user-invocable: true` was HOISTED to top level and read
+  // as the slash-command marker, so the counters saw a skill no generator did.
+  let inNestedBlock = false;
+
   for (const rawLine of lines) {
     const line = rawLine.replace(/\s+$/, '');
     if (line === '' || /^\s*#/.test(line)) continue;
 
+    if (/^\s/.test(rawLine)) {
+      if (inNestedBlock) continue;
+    } else {
+      inNestedBlock = false;
+    }
+
     // Detect block-scalar indicators on a key line, e.g. `description: >` or `description: |`
     // These are valid YAML but break Claude Code's parser.
     const blockScalarMatch = /^(\w[\w-]*):\s*[>|]\s*$/.exec(line);
     if (blockScalarMatch) {
       // Store a sentinel so the validator can emit the correct rule.
       frontmatter[blockScalarMatch[1]] = '__BLOCK_SCALAR__';
+      inNestedBlock = true;
       continue;
     }
 
+    // A bare `key:` at top level opens a nested mapping (or an empty value);
+    // everything indented under it is that mapping's business, not ours.
+    if (/^\w[\w-]*:$/.test(line)) inNestedBlock = true;
+
     const idx = line.indexOf(':');
     if (idx === -1) continue;
     const key = line.slice(0, idx).trim();

package/scripts/lib/claude-md-budget-lint.mjs

@@ -67,6 +67,7 @@ import { basename, resolve, sep } from 'node:path';
 import { homedir } from 'node:os';
 import { resolveInstructionFile } from './common.mjs';
 import { isSessionConfigHeading } from './config/section-extractor.mjs';
+import { isMainModule } from './is-main-module.mjs';
 
 /** Thrown by `lintClaudeMd()` on any infra-level failure (missing/unreadable file). */
 export class ClaudeMdLintInfraError extends Error {
@@ -536,10 +537,6 @@ function main() {
 }
 
 const __filename = fileURLToPath(import.meta.url);
-const isMain =
-  typeof process !== 'undefined' &&
-  process.argv[1] !== null &&
-  process.argv[1] !== undefined &&
-  resolve(process.argv[1]) === resolve(__filename);
+const isMain =isMainModule(import.meta.url);
 
 if (isMain) main();

package/scripts/lib/command-blocker.mjs

@@ -743,6 +743,31 @@ export { splitSegments as splitChainSegments };
 
 const ENV_ASSIGN_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
 
+/**
+ * Verbs that name a WRITE TARGET as a bare operand — no redirect operator, no
+ * wrapper flag (#1366). A sibling of WRAPPER_UNWRAP's `fileArgFlags`: that table
+ * answers "does this WRAPPER flag's operand name a file the wrapper writes?",
+ * this one "does this VERB's operand name a file the verb writes?".
+ *
+ * Spec fields:
+ *   - prefix:   the operand's literal prefix (`of=`), matched on a token AFTER
+ *               the resolved verb.
+ *   - mode:     the default redirect mode the write is equivalent to.
+ *   - appendRe: operands that turn the write into an APPEND. `dd` truncates by
+ *               default (`conv=notrunc` / `oflag=append` do not), so reporting
+ *               `truncate` unconditionally would over-report a rule class that
+ *               deliberately permits `>>`.
+ *
+ * Deliberately narrow — one entry, measured. `tee`/`sponge` and in-process
+ * writers (`node -e fs.writeFileSync`) are NOT here: they are not redirect-shaped
+ * and belong to a different rule class (see the `redirect-harness-memory`
+ * rationale in .orchestrator/policy/blocked-commands.json). REVISIT TRIGGER: a
+ * second `<verb> <prefix>file` writer showing up in a transcript census.
+ */
+const VERB_FILE_OPERANDS = new Map([
+  ['dd', { prefix: 'of=', mode: 'truncate', appendRe: /^(?:conv=.*\bnotrunc\b|oflag=.*\bappend\b)/ }],
+]);
+
 /**
  * Transparent process-wrapper table for verb resolution (#982), keyed by
  * basename. Each spec describes how to skip a wrapper's own options so the
@@ -946,15 +971,37 @@ function resolveCore(segment, unknownFlagsTakeValue) {
       if (spec.splitString
           && (text === '-S' || text === '--split-string'
             || text.startsWith('--split-string=') || text.startsWith('-S'))) {
+        // env(1) APPENDS the remaining argv to the split string: `env -S bash
+        // -c '…'` runs `bash -c '…'`, not `bash` (#1366). Collecting only the
+        // operand made the trailing `-c '…'` execute unseen — the segment then
+        // resolved to `verb: 'echo x > CLAUDE.md'` (the quoted payload read as
+        // the verb) and neither the match surface nor the redirect surface ever
+        // saw it. So the payload is the operand PLUS every remaining token, and
+        // the wrapper CONSUMES the segment: nothing is left to resolve as a
+        // verb, which is why this now yields `verb: null, index: -1`.
+        let operand = null;
         if (text.startsWith('--split-string=')) {
-          payloads.push(text.slice('--split-string='.length));
+          operand = text.slice('--split-string='.length);
+          i++;
         } else if (text !== '-S' && text !== '--split-string') {
-          payloads.push(text.slice(2)); // attached form: -S'string'
-        } else if (i + 1 < segment.length) {
-          payloads.push(segment[i + 1].text);
+          operand = text.slice(2); // attached form: -S'string'
           i++;
+        } else if (i + 1 < segment.length) {
+          operand = segment[i + 1].text;
+          i += 2;
+        } else {
+          i++; // `env -S` with no operand at all — nothing to collect
+        }
+        if (operand !== null) {
+          // Raw token texts, joined by one space. Quoting is NOT re-applied:
+          // the tokenizer already stripped it, and re-inventing it would be a
+          // second quoting grammar. The direction of that loss is safe — an
+          // over-wide payload can only make MORE text visible to the matcher
+          // (fail-closed), never hide a redirect operator.
+          const rest = segment.slice(i).map((t) => t.text);
+          payloads.push(rest.length > 0 ? [operand, ...rest].join(' ') : operand);
+          i = segment.length;
         }
-        i++;
         continue;
       }
       if (spec.shellFlags && spec.shellFlags.has(text)) { sawShellFlag = true; i++; continue; }
@@ -1189,15 +1236,65 @@ function dedupedSegmentPayloads(segment, resolved) {
   if (resolved.verb && DASH_C_SHELLS.has(resolved.verb)) {
     for (const p of dashCPayloads(segment, resolved.index)) payloadSet.add(p);
   }
+  addArgJoinedPayload(segment, resolved.verb, resolved.index, payloadSet);
   if (resolved.alt) {
     for (const p of resolved.alt.payloads) payloadSet.add(p);
     if (resolved.alt.verb && DASH_C_SHELLS.has(resolved.alt.verb)) {
       for (const p of dashCPayloads(segment, resolved.alt.index)) payloadSet.add(p);
     }
+    addArgJoinedPayload(segment, resolved.alt.verb, resolved.alt.index, payloadSet);
   }
   return [...payloadSet];
 }
 
+/**
+ * Interpreters that JOIN their remaining arguments with a space and execute the
+ * result — no `-c` flag, no wrapper option to key on (#1366).
+ *
+ * `eval` is the whole set today. It was already in SHELL_EXEC_INTERPRETERS, but
+ * that set only powers the QUOTED-TOKEN match in matchSegments — it never fed
+ * the payload traversal, so `eval 'echo x > CLAUDE.md'` carried a redirect no
+ * redirect rule ever saw (`resolveSegmentVerb` reports `payloads: []` for it).
+ *
+ * NAMED CEILING (BV-004): only a LITERAL payload is reachable. `eval "$CMD"` and
+ * `eval $(…)` do not exist as command text at hook time and stay in the existing
+ * `unresolved` class (#641). REVISIT TRIGGER: a second arg-joining interpreter
+ * showing up in a transcript census — extend the set, never special-case `eval`.
+ */
+const ARG_JOINING_INTERPRETERS = new Set(['eval']);
+
+/**
+ * Add the joined post-verb argument text as a recursion payload when `verb` is
+ * an arg-joining interpreter. No-op otherwise — every other caller shape keeps
+ * the pre-#1366 payload set byte-identical.
+ *
+ * Quoting is not re-applied for the same reason as the `env -S` tail (see
+ * resolveCore): the tokenizer stripped it, and a wider payload can only make
+ * more text visible to the matcher, never hide an operator.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} segment
+ * @param {string|null} verb
+ * @param {number} index — the verb's token index (`-1` when unresolved)
+ * @param {Set<string>} payloadSet — mutated in place
+ */
+function addArgJoinedPayload(segment, verb, index, payloadSet) {
+  if (!verb || index < 0 || !ARG_JOINING_INTERPRETERS.has(verb)) return;
+  const words = [];
+  for (let i = index + 1; i < segment.length; i++) {
+    if (segment[i].redirect) {
+      // A redirect belongs to the SEGMENT (`eval 'x' > f` redirects eval's own
+      // stdout), never to the joined argv — the segment scan already reported
+      // it, and re-reporting it through the payload would duplicate the entry.
+      const end = redirectSpanEnd(segment, i);
+      if (end > i) i = end;
+      continue;
+    }
+    words.push(segment[i].text);
+  }
+  const joined = words.join(' ').trim();
+  if (joined.length > 0) payloadSet.add(joined);
+}
+
 /**
  * Match a blocked-pattern regex against tokenized chain segments — the shared
  * core of commandMatchesBlocked, recursion-capable for `-c` payloads (#982).
@@ -1347,6 +1444,37 @@ function collectRedirectTargets(segments, out, depth, budget) {
       out.push({ target: wa.value, mode: 'truncate', fd: null });
     }
 
+    // A VERB can name its write target as a bare operand, with no redirect
+    // operator and no wrapper flag: `dd of=CLAUDE.md` truncates CLAUDE.md while
+    // `> CLAUDE.md` is denied (measured ALLOW pre-#1366 against the real
+    // policy). Keyed on the RESOLVED verb, so `sudo dd of=X` is reached through
+    // the existing wrapper unwrap; both readings contribute, as above.
+    const seenVerbOperands = new Set();
+    for (const reading of resolved.alt ? [resolved, resolved.alt] : [resolved]) {
+      const spec = reading.verb ? VERB_FILE_OPERANDS.get(reading.verb) : null;
+      if (!spec || reading.index < 0) continue;
+      let operand = null;
+      let append = false;
+      for (let k = reading.index + 1; k < segment.length; k++) {
+        const text = segment[k].text;
+        if (segment[k].redirect) continue;
+        if (text.startsWith(spec.prefix)) operand = text.slice(spec.prefix.length);
+        else if (spec.appendRe?.test(text)) append = true;
+      }
+      if (operand === null || operand.length === 0) continue;
+      const mode = append ? 'append' : spec.mode;
+      const key = `${operand}:${mode}`;
+      if (seenVerbOperands.has(key)) continue;
+      seenVerbOperands.add(key);
+      if (/[$`]/.test(operand)) {
+        // Same fail-visible rule as a redirect operand (#983) — never guess at a
+        // variable or a command substitution, never silently drop it either.
+        out.push({ target: null, mode, fd: null, unresolved: true });
+        continue;
+      }
+      out.push({ target: operand, mode, fd: null });
+    }
+
     // Both readings of an ambiguous unknown flag contribute payloads (#1000),
     // UNIONED and de-duped (HIGH-2). Walking parse A only let
     // `env -Q x bash -c 'echo pwned > CLAUDE.md'` — which resolves to the
@@ -1663,18 +1791,90 @@ export function redirectRuleMatches(rule, command, opts = {}) {
   const denylist = Array.isArray(rule['target-denylist']) ? rule['target-denylist'] : [];
   if (denylist.length === 0) return false;
   const modes = new Set(Array.isArray(rule.modes) && rule.modes.length > 0 ? rule.modes : ['truncate']);
-  const regexes = denylist.map(redirectGlobToRegExp);
+
+  // #1362 — TWO denylist classes, deliberately kept apart:
+  //
+  //   REPO-RELATIVE (every pre-#1362 entry): judged against
+  //   `repoRelativeRedirectTarget`, which returns `null` for anything outside
+  //   the root. Behaviour is byte-identical to before, and that null is what
+  //   keeps a relative entry from ever reaching an out-of-repo path.
+  //
+  //   HOME-ANCHORED (`~/…`, new): judged against the EXPANDED ABSOLUTE target,
+  //   never relativized. Needed because the artefacts worth denying are not all
+  //   inside the repo — the harness auto-memory directory
+  //   (`~/.claude/projects/<encodeProjectDir(root)>/memory/`) is auto-injected
+  //   as trusted project context into every later session yet lives outside
+  //   `git diff`, CI review and the secret scanners. Measured 2026-09-13: with
+  //   only the repo-relative class, NO glob spelling could match it, because
+  //   `relativizeAgainstRoot` discards out-of-repo targets by design.
+  //
+  // The split is one-directional on purpose: a home-anchored entry cannot widen
+  // an existing repo-relative rule, and a repo-relative entry still cannot
+  // escape the root. An unexpandable `~` (no usable `home`) matches NOTHING —
+  // fail-closed for the new class, since an unexpanded `~` names no file.
+  const relRegexes = [];
+  const absRegexes = [];
+  for (const pattern of denylist) {
+    const text = String(pattern);
+    if (text === '~' || text.startsWith('~/')) {
+      const expanded = expandLeadingHome(text, home);
+      if (expanded === text) continue; // no usable home → no match, never a guess
+      absRegexes.push(redirectGlobToRegExp(foldAbsoluteTarget(expanded)));
+    } else {
+      relRegexes.push(redirectGlobToRegExp(text));
+    }
+  }
+  if (relRegexes.length === 0 && absRegexes.length === 0) return false;
 
   for (const entry of extractRedirectTargets(command)) {
     if (entry.unresolved) continue;
     if (!modes.has(entry.mode)) continue;
-    const target = repoRelativeRedirectTarget(entry.target, repoRoot, home);
-    if (target === null) continue;
-    if (regexes.some((re) => re.test(target))) return true;
+
+    if (absRegexes.length > 0) {
+      // A RELATIVE target is repo-root-relative here, exactly as the repo-relative
+      // class already treats it (#994 R1) — otherwise `> ../../.claude/projects/
+      // <enc>/memory/MEMORY.md` from the repo root names the very file the `~`
+      // spelling blocks, and only the spelling would be denied (measured
+      // 2026-09-13: relative `>`/`>>` ALLOW vs tilde/absolute BLOCK on one and
+      // the same resolved path). This resolves TARGETS, never ENTRIES: a
+      // repo-relative denylist entry keeps going through
+      // `repoRelativeRedirectTarget` below and still cannot reach out of the root.
+      const expandedTarget = expandLeadingHome(entry.target, home);
+      const absTarget = path.isAbsolute(expandedTarget)
+        ? expandedTarget
+        : repoRoot && path.isAbsolute(repoRoot)
+          ? path.resolve(repoRoot, expandedTarget)
+          : null;
+      if (absTarget !== null) {
+        const folded = foldAbsoluteTarget(absTarget);
+        if (absRegexes.some((re) => re.test(folded))) return true;
+      }
+    }
+
+    if (relRegexes.length > 0) {
+      const target = repoRelativeRedirectTarget(entry.target, repoRoot, home);
+      if (target !== null && relRegexes.some((re) => re.test(target))) return true;
+    }
   }
   return false;
 }
 
+/**
+ * Normalize an ABSOLUTE path for home-anchored denylist comparison (#1362):
+ * same alias-collapse and case-fold `relativizeAgainstRoot` applies before its
+ * containment test, so the two classes agree on what `/private/tmp` and a
+ * case-insensitive volume mean. Applied to BOTH sides (pattern and target), so
+ * the folding can never make a pattern match more than its literal spelling.
+ *
+ * @param {string} abs
+ * @returns {string}
+ */
+function foldAbsoluteTarget(abs) {
+  return stripPathAliases(path.posix.normalize(String(abs).replace(/\\/g, '/'))).toLocaleLowerCase(
+    'en-US',
+  );
+}
+
 /**
  * Test whether a command string contains a blocked pattern with shell-aware
  * boundaries AND a quoted-payload guard (#641).

package/scripts/lib/config/drift-check.mjs

@@ -5,6 +5,25 @@ import { preprocessBlockLines } from './block-preprocess.mjs';
  * drift-check.mjs — Parser for the top-level `drift-check:` YAML block.
  *
  * Ported from config-yaml-parser.sh (v2).
+ *
+ * SCOPE NOTE — this file parses FLAGS ONLY; it implements no check. The
+ * `check-command-count` flag below toggles the `command-count` surface in
+ * `skills/claude-md-drift-check/checker.mjs`, which is where the counting lives.
+ *
+ * `command-count` STAYS on `ls commands/*.md | wc -l` on purpose. The checker is
+ * GENERIC over any consumer repo, where a slash command still IS a
+ * `commands/*.md` file. The 2026-09-16 command→skill fold (#1370) is a fact
+ * about THIS plugin — 24 command files folded into their same-named
+ * `skills/<name>/SKILL.md` behind an explicit `user-invocable: true` — so
+ * teaching the shared checker that union would mis-measure every repo that never
+ * folded. `scripts/site-numbers.mjs` `countCommands()` carries the union for this
+ * plugin's own tile, and names the divergence in its docblock.
+ *
+ * CONSEQUENCE for THIS repo, left deliberately visible rather than papered over:
+ * a prose claim of the shape "N commands" / "N slash commands" in a
+ * drift-check-scanned doc is compared against the `commands/` listing (2 after
+ * the fold), so such a claim must either be dropped or reworded off the
+ * `\b(\d+)\s+(?:\/)?commands?\b` pattern the checker matches.
  */
 
 /**

package/scripts/lib/convergence-monitor.mjs

@@ -45,7 +45,7 @@
 
 import { existsSync, statSync, openSync, readSync, closeSync } from 'node:fs';
 import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { isMainModule } from './is-main-module.mjs';
 
 const DEFAULT_INTERVAL_S = 2;
 const EVENTS_FILE_REL = '.orchestrator/metrics/events.jsonl';
@@ -502,7 +502,7 @@ function main() {
 
 // Run the tail loop only when executed as a script. Importing the module (for
 // unit tests over `classify`) must not parse vitest's argv and exit 1.
-if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMainModule(import.meta.url)) {
   main();
 }
 

package/scripts/lib/cursor-hook-bridge.mjs

@@ -18,10 +18,10 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
 
 import { matcherMatches, readHookDecision } from './pi-hook-bridge.mjs';
 import { resolvePluginRoot } from './plugin-root.mjs';
+import { isMainModule } from './is-main-module.mjs';
 
 export const CURSOR_TO_CANONICAL_EVENT = Object.freeze({
   sessionStart: 'SessionStart',
@@ -434,7 +434,7 @@ async function main() {
   process.stdout.write(`${JSON.stringify(toCursorHookOutput(eventName, result))}\n`);
 }
 
-const isMain = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+const isMain =isMainModule(import.meta.url);
 if (isMain) {
   main().catch((err) => {
     process.stderr.write(`cursor-hook-bridge: ${err instanceof Error ? err.message : err}\n`);

package/scripts/lib/description-surface.mjs

@@ -58,6 +58,7 @@
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { join, relative, resolve } from 'node:path';
+import { isMainModule } from './is-main-module.mjs';
 
 /** Block-scalar indicator on the `description:` line: '>' (folded) or '|' (literal), optional chomping '+'/'-'. */
 const BLOCK_SCALAR_RE = /^([>|])([+-]?)\s*$/;
@@ -526,10 +527,6 @@ function main() {
 }
 
 const __filename = fileURLToPath(import.meta.url);
-const isMain =
-  typeof process !== 'undefined' &&
-  process.argv[1] !== null &&
-  process.argv[1] !== undefined &&
-  resolve(process.argv[1]) === resolve(__filename);
+const isMain =isMainModule(import.meta.url);
 
 if (isMain) main();

package/scripts/lib/dispatcher/cli.mjs

@@ -32,6 +32,7 @@ import { warn } from '../common.mjs';
 import { acquire } from '../session-lock.mjs';
 import { enumerateCandidates, freeCandidates } from './enumerate.mjs';
 import { rankCandidates } from './rank.mjs';
+import { isMainModule } from '../is-main-module.mjs';
 
 const VERSION = '1.0.0';
 
@@ -247,7 +248,7 @@ export async function main(argv) {
 }
 
 // Run main only when executed directly, never on import.
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   main(process.argv.slice(2))
     .then((code) => process.exit(code))
     .catch((err) => {

package/scripts/lib/ecosystem-wizard.mjs

@@ -7,6 +7,7 @@
  */
 
 import { runEcosystemWizard } from './ecosystem-wizard/wizard-prompt.mjs';
+import { isMainModule } from './is-main-module.mjs';
 
 export { detectCiProvider } from './ecosystem-wizard/ci-detector.mjs';
 export {
@@ -31,7 +32,7 @@ export { runEcosystemWizard } from './ecosystem-wizard/wizard-prompt.mjs';
 // CLI entry
 // ---------------------------------------------------------------------------
 
-if (process.argv[1] && process.argv[1].endsWith('ecosystem-wizard.mjs')) {
+if (isMainModule(import.meta.url)) {
   const args = process.argv.slice(2);
   const repoRootIdx = args.indexOf('--repo-root');
   const dryRun = args.includes('--dry-run');

package/scripts/lib/fetch-baseline.mjs

@@ -30,6 +30,8 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { execSync } from 'node:child_process';
 
+import { isMainModule } from './is-main-module.mjs';
+
 // ---------------------------------------------------------------------------
 // Configuration defaults (mirrors the .sh defaults)
 // ---------------------------------------------------------------------------
@@ -296,14 +298,7 @@ async function _cliMain() {
   process.exit(3);
 }
 
-// Detect CLI invocation: import.meta.url matches the argv[1] path
-const isMain = process.argv[1] && (
-  process.argv[1] === new URL(import.meta.url).pathname ||
-  // Handle invocation without file:// prefix
-  process.argv[1].endsWith('fetch-baseline.mjs')
-);
-
-if (isMain) {
+if (isMainModule(import.meta.url)) {
   _cliMain().catch((err) => {
     process.stderr.write(`FATAL: ${err instanceof Error ? err.message : String(err)}\n`);
     process.exit(3);

package/scripts/lib/gitlab-ops/stale-mr-sweep.mjs

@@ -24,6 +24,7 @@ import { promisify } from 'node:util';
 
 import { detectVcsForRepo, discoverVaultRepos } from '../gitlab-portfolio/vcs-detect.mjs';
 import { resolveRepoSpec } from '../vcs-repo-spec.mjs';
+import { isMainModule } from '../is-main-module.mjs';
 
 const realExecFile = promisify(execFileCb);
 
@@ -455,7 +456,7 @@ export async function main(argv, deps = {}) {
 
 // ── CLI guard — prevent process.exit during test-time imports ─────────────────
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   main(process.argv.slice(2))
     .then((result) => {
       process.exit(result.exitCode);

package/scripts/lib/gitlab-portfolio/cli.mjs

@@ -36,6 +36,7 @@ import { expandTilde } from '../common.mjs';
 import { discoverVaultRepos } from './vcs-detect.mjs';
 import { fetchIssuesMultiRepo, summarizeRepo } from './aggregator.mjs';
 import { renderPortfolio, writePortfolio } from './markdown-writer.mjs';
+import { isMainModule } from '../is-main-module.mjs';
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
@@ -406,7 +407,7 @@ EXIT CODES
 
 // ── CLI guard — prevent process.exit during test-time imports ─────────────────
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   main(process.argv.slice(2)).then((result) => {
     process.exit(result.exitCode);
   }).catch((err) => {