session-orchestrator 5.2.0 → 5.4.0

package/scripts/lib/validate/check-agents-skills.mjs

@@ -11,16 +11,16 @@
  *      inode, or byte-identical).
  *   B. root `plugin.json` — the agent-plugins.org 1.0.0 manifest; its `version`
  *      must equal `package.json`'s and the two existing plugin manifests'.
- *   C. `.agents/skills/<name>/SKILL.md` — one spec-legal mirror per source
- *      skill, no orphans, agentskills.io field list only, description ≤ 1024.
+ *   C. `.agents/skills/<name>/SKILL.md` — one spec-legal mirror per skill or
+ *      command, no orphans, agentskills.io field list only, description ≤ 1024.
  *
  * INDEPENDENCE (load-bearing). This checker deliberately imports NOTHING from
  * `scripts/generate-agents-skills.mjs` and re-derives the spec field list, the
  * 1024 cap and the alias rule from the spec, not from the generator. A
  * generator-vs-generator check only proves the generator is self-consistent —
  * that is how the Cursor `argument-hint` defect survived. The oracles here are
- * the repository's own filesystem (`skills/`, `CLAUDE.md`, `package.json`) and
- * the published field list.
+ * the repository's own filesystem (`skills/`, `commands/`, `CLAUDE.md`,
+ * `package.json`) and the published field list.
  *
  * Usage: node scripts/lib/validate/check-agents-skills.mjs <plugin-root>
  * Exit codes: 0 — all checks passed · 1 — one or more failures.
@@ -195,6 +195,7 @@ console.log('');
 console.log('--- Check C: .agents/skills/ portable mirror ---');
 {
   const skillsDir = join(pluginRoot, 'skills');
+  const commandsDir = join(pluginRoot, 'commands');
   const mirrorDir = join(pluginRoot, '.agents', 'skills');
 
   const sourceSkills = existsSync(skillsDir) && statSync(skillsDir).isDirectory()
@@ -204,12 +205,21 @@ console.log('--- Check C: .agents/skills/ portable mirror ---');
       .filter((n) => existsSync(join(skillsDir, n, 'SKILL.md')))
       .sort()
     : [];
+  const sources = new Map(sourceSkills.map((name) => [name, `skills/${name}/SKILL.md`]));
+  if (existsSync(commandsDir) && statSync(commandsDir).isDirectory()) {
+    for (const entry of readdirSync(commandsDir, { withFileTypes: true })) {
+      if (!entry.isFile() || !entry.name.endsWith('.md') || /^[._]/.test(entry.name)) continue;
+      // Commands own public names when an internal skill has the same name.
+      sources.set(entry.name.slice(0, -3), `commands/${entry.name}`);
+    }
+  }
+  const sourceNames = [...sources.keys()].sort();
 
   if (!existsSync(mirrorDir)) {
-    if (sourceSkills.length === 0) {
-      pass('no skills/ and no .agents/skills/ — nothing to mirror');
+    if (sourceNames.length === 0) {
+      pass('no skill or command sources and no .agents/skills/ — nothing to mirror');
     } else {
-      fail(`.agents/skills/ is missing but ${sourceSkills.length} source skill(s) exist `
+      fail(`.agents/skills/ is missing but ${sourceNames.length} source entry(s) exist `
         + '(remedy: node scripts/generate-agents-skills.mjs)');
     }
   } else {
@@ -218,12 +228,12 @@ console.log('--- Check C: .agents/skills/ portable mirror ---');
       .map((e) => e.name)
       .sort();
 
-    const missing = sourceSkills.filter((n) => !mirrored.includes(n));
-    const orphans = mirrored.filter((n) => !sourceSkills.includes(n));
-    if (missing.length === 0) pass(`every source skill has a mirror (${sourceSkills.length})`);
-    else fail(`${missing.length} source skill(s) have no mirror: ${missing.join(', ')}`);
+    const missing = sourceNames.filter((n) => !mirrored.includes(n));
+    const orphans = mirrored.filter((n) => !sources.has(n));
+    if (missing.length === 0) pass(`every source entry has a mirror (${sourceNames.length})`);
+    else fail(`${missing.length} source entry(s) have no mirror: ${missing.join(', ')}`);
     if (orphans.length === 0) pass('no orphan mirrors');
-    else fail(`${orphans.length} orphan mirror(s) with no source skill: ${orphans.join(', ')}`);
+    else fail(`${orphans.length} orphan mirror(s) with no skill or command source: ${orphans.join(', ')}`);
 
     let fmFail = 0;
     let keyFail = 0;
@@ -303,8 +313,9 @@ console.log('--- Check C: .agents/skills/ portable mirror ---');
         }
       }
 
-      if (!body.includes(`skills/${name}/SKILL.md`)) {
-        fail(`.agents/skills/${name}/SKILL.md body does not cite the canonical skills/${name}/SKILL.md `
+      const canonical = sources.get(name);
+      if (canonical && !body.includes(canonical)) {
+        fail(`.agents/skills/${name}/SKILL.md body does not cite the canonical ${canonical} `
           + '— the mirror is a pointer, and a pointer with no target is dead weight');
         pointerFail += 1;
       }
@@ -314,7 +325,7 @@ console.log('--- Check C: .agents/skills/ portable mirror ---');
     if (keyFail === 0 && mirrored.length > 0) pass('all mirrors use only agentskills.io spec fields');
     if (descFail === 0 && mirrored.length > 0) pass(`all mirror descriptions are non-empty and ≤ ${DESCRIPTION_MAX} chars`);
     if (sizeFail === 0 && mirrored.length > 0) pass(`all mirrors ≤ ${MIRROR_MAX_BYTES} bytes (total ${totalBytes} bytes)`);
-    if (pointerFail === 0 && mirrored.length > 0) pass('all mirrors cite their canonical SKILL.md');
+    if (pointerFail === 0 && mirrored.length > 0) pass('all mirrors cite their canonical source');
   }
 }
 

package/scripts/lib/validate/check-agents.mjs

@@ -327,7 +327,7 @@ if (mdFiles.length === 0) {
       if (modelVal === null || (!ALLOWED_MODEL_ALIASES.has(modelVal) && !MODEL_ID_RE.test(modelVal))) {
         const got = modelVal ?? '';
         const aliasList = [...ALLOWED_MODEL_ALIASES].join('|');
-        fail(`${agentName}: model must be ${aliasList} or a full model ID like 'claude-opus-4-7' or 'claude-sonnet-5' (got: '${got}')`);
+        fail(`${agentName}: model must be ${aliasList} or a full model ID like 'claude-opus-5-5' or 'claude-sonnet-5' (got: '${got}')`);
       }
     }
 

package/scripts/lib/validate/check-cursor-adapter.mjs

@@ -177,6 +177,7 @@ function runCli(pluginRoot) {
     } else {
       const detail = ((result.stdout ?? '') + (result.stderr ?? '')).trim();
       fail(`Cursor adapter wrappers are stale${detail ? `: ${detail}` : ''}`);
+      console.log('        Remedy: node scripts/generate-cursor-adapter.mjs');
     }
   }
 

package/scripts/lib/validate/check-entry-guard.mjs

@@ -76,6 +76,7 @@ import { readFileSync } from 'node:fs';
 import path from 'node:path';
 
 import { isMainModule } from '../is-main-module.mjs';
+import { maskSource } from '../js-mask.mjs';
 
 /**
  * Files whose `process.argv[1]` comparison the oracle flags but which are NOT
@@ -102,50 +103,20 @@ const SELF_EXEMPT = 'scripts/lib/is-main-module.mjs';
 /**
  * Remove comments while preserving character offsets (so line numbers survive).
  *
+ * A thin wrapper over the shared lexer `maskSource` in `keepLiterals` mode:
+ * string, template and regex literals are skipped INTACT. That is load-bearing
+ * twice over — the V1 idiom \`file://${process.argv[1]}\` carries a `//` that a
+ * naive scanner reads as a line comment, and a regex literal must be recognised
+ * as one (#1383: a `/` the lexer read as a division let the regex body's `/*`
+ * open a block comment that blanked the guard below it — a fail-open miss, for
+ * a quote-bearing regex, a `/[/*]/` character class, and a regex after a keyword
+ * alike).
+ *
  * @param {string} src module source
  * @returns {string} same length, comment bytes replaced by spaces
  */
 export function stripComments(src) {
-  const out = src.split('');
-  let i = 0;
-  let mode = 'code';
-  while (i < src.length) {
-    const two = src.slice(i, i + 2);
-    if (mode === 'code') {
-      if (two === '//') mode = 'line';
-      else if (two === '/*') mode = 'block';
-      else if (src[i] === '`' || src[i] === "'" || src[i] === '"') {
-        // Skip OVER the literal to its closing delimiter, leaving the contents
-        // intact. This is load-bearing, not hygiene: the V1 idiom is
-        // \`file://${process.argv[1]}\` and the `//` in `file://` reads as a line
-        // comment to a naive scanner, which blanks the rest of the line and
-        // makes the most common variant of the defect class invisible.
-        const quote = src[i];
-        i++;
-        while (i < src.length && src[i] !== quote) {
-          if (src[i] === '\\') i++;
-          i++;
-        }
-        i++;
-        continue;
-      }
-    }
-    if (mode === 'line') {
-      if (src[i] === '\n') mode = 'code';
-      else out[i] = ' ';
-    } else if (mode === 'block') {
-      if (src[i] !== '\n') out[i] = ' ';
-      if (two === '*/') {
-        out[i] = ' ';
-        out[i + 1] = ' ';
-        i += 2;
-        mode = 'code';
-        continue;
-      }
-    }
-    i++;
-  }
-  return out.join('');
+  return maskSource(src, { keepLiterals: true });
 }
 
 /**
@@ -153,16 +124,8 @@ export function stripComments(src) {
  * Scanned rather than matched in one shot so the RECEIVER can be judged from the
  * text preceding each hit — a `.endsWith()` on anything other than
  * `process.argv[1]` is not this defect class.
- *
- * The quote characters are spelled `\x27` / `\x22` / `\x60` rather than
- * literally, and that is load-bearing for THIS file specifically: `stripComments`
- * below has no notion of a regex literal, so a bare `'` inside one reads as the
- * start of a string and desynchronises the scanner for the rest of the module —
- * measured 2026-09-17, a literal-quote version of this regex made the census
- * report a line-comment 40 lines further down as a finding. Same rule applies to
- * every regex added to this module.
  */
-const ENDS_WITH_LITERAL = /endsWith\(\s*([\x27\x22\x60])([^\x27\x22\x60]*)\1\s*\)/g;
+const ENDS_WITH_LITERAL = /endsWith\(\s*(['"`])([^'"`]*)\1\s*\)/g;
 
 /**
  * The receiver chain, whitespace-stripped, that makes an `.endsWith()` call a
@@ -170,7 +133,7 @@ const ENDS_WITH_LITERAL = /endsWith\(\s*([\x27\x22\x60])([^\x27\x22\x60]*)\1\s*\
  * wrapper (`String(...)`, `path.basename(...)`) still matches; anchored at the
  * END so only the call immediately downstream of `process.argv[1]` counts.
  */
-const ARGV_RECEIVER_TAIL = /process\.argv\[1\](?:\|\|\x27\x27|\|\|\x22\x22)?\)*\??\.$/;
+const ARGV_RECEIVER_TAIL = /process\.argv\[1\](?:\|\|''|\|\|"")?\)*\??\.$/;
 
 /**
  * Findings for one module body.