session-orchestrator 5.3.0 → 5.5.0

package/scripts/sweep-expired-rules.mjs

@@ -29,6 +29,7 @@
  *      per-file error on the `--apply` path)
  */
 
+import path from 'node:path';
 import { emitEvent } from './lib/events.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 import {
@@ -100,7 +101,7 @@ export function parseArgs(argv) {
     } else if (a === '--repo-root') {
       const raw = argv[++i];
       if (typeof raw !== 'string' || raw.length === 0) usageError('--repo-root requires a path');
-      args.repoRoot = raw;
+      args.repoRoot = path.resolve(raw);
     } else if (a === '--learnings') {
       const raw = argv[++i];
       if (typeof raw !== 'string' || raw.length === 0) usageError('--learnings requires a path');

package/scripts/validate-plugin.mjs

@@ -513,6 +513,13 @@ runStrictShAdvisory();
 // session-end tail phases from their dispatcher.
 if (runCheck('check-skill-links.mjs') !== 0) checkFailed = 1;
 
+// BLOCKING (#1446 / GH#69): instruction prose that tells an agent to write
+// `learnings.jsonl` with a shell `>` / `>>`. The store is gitignored, so a bad
+// write has no VCS restore; the sanctioned writers (`apply-session-learnings.mjs`,
+// `sweep-expired-learnings.mjs --prune`) validate, snapshot `.bak` and archive.
+process.stdout.write('\n');
+if (runCheck('check-learnings-shell-writes.mjs') !== 0) checkFailed = 1;
+
 // WARN-only: a state-mutating `git` call in tests/ that names no target resolves
 // its destination from the ambient cwd (or an inherited GIT_DIR) — the 2026-08-19
 // incident, where fixture commits, a fixture remote and a fixture identity landed

package/scripts/validate-wave-scope.mjs

@@ -35,6 +35,9 @@
  *                           `git ls-files` — spawned HERE, in the CLI layer,
  *                           because scripts/lib/scope-gate.mjs is hook-safe and
  *                           must not spawn a process (see its module header).
+ *                           Runs even when the manifest fails schema validation
+ *                           (#1026.4): it reads only the sidecar, so schema
+ *                           errors and collisions are reported together (exit 1).
  *   --union <path>          #1020. QUERY MODE. Read the same sidecar, compute
  *                           `expandTestSiblings(unionFileScopes(scopes), {role})`
  *                           using the MANIFEST'S OWN `role`, and print the
@@ -638,11 +641,24 @@ function knownRepoFiles() {
  * @param {string} sidecarPath
  */
 function assertDisjointOrDie(sidecarPath) {
+  if (!reportScopeCollisions(sidecarPath)) process.exit(1);
+}
+
+/**
+ * Run the #1020 collision check and write one stderr line per finding.
+ * Reads ONLY the sidecar, never the manifest — which is why {@link validate}
+ * can still run it when the manifest fails schema validation (#1026.4).
+ * Sidecar I/O and shape defects exit via {@link readAgentScopesOrDie}.
+ *
+ * @param {string} sidecarPath
+ * @returns {boolean} true when the wave is disjoint
+ */
+function reportScopeCollisions(sidecarPath) {
   const agentScopes = readAgentScopesOrDie(sidecarPath, '--assert-disjoint');
   const { ok, collisions, duplicateIds } = findScopeCollisions(agentScopes, {
     knownFiles: knownRepoFiles(),
   });
-  if (ok) return;
+  if (ok) return true;
 
   // Duplicate ids FIRST: they are a malformed plan, and a reader who fixes them
   // may well change which collisions remain.
@@ -659,7 +675,7 @@ function assertDisjointOrDie(sidecarPath) {
   process.stderr.write(
     `ERROR: ${collisions.length} scope collision(s), ${duplicateIds.length} duplicate id(s) — every file must belong to exactly ONE agent per wave (#1020; .claude/rules/parallel-sessions.md § Decision Tree)\n`,
   );
-  process.exit(1);
+  return false;
 }
 
 /**
@@ -709,6 +725,9 @@ function validate(
     for (const e of errors) {
       process.stderr.write(`ERROR: ${e}\n`);
     }
+    // #1026.4 — the collision check reads only the sidecar, so a schema error
+    // must not hide its findings: report both, exit 1 either way.
+    if (assertDisjointPath) reportScopeCollisions(assertDisjointPath);
     process.exit(1);
   }
 

package/scripts/vault-backfill.mjs

@@ -38,6 +38,10 @@ import {
 } from './lib/vault-backfill/template.mjs';
 
 import { validateManifest, SLUG_RE } from './lib/vault-backfill/manifest.mjs';
+import { _parseVaultIntegration } from './lib/config/vault-integration.mjs';
+import { loadHostPaths, resolveVaultIntegrationHost } from './lib/config/host-paths.mjs';
+import { resolveVaultDir } from './lib/config.mjs';
+import { expandTilde } from './lib/common.mjs';
 
 // ── CLI argument parsing ──────────────────────────────────────────────────────
 
@@ -85,9 +89,29 @@ let hadWriteError = false;
 
 if (flagVerbose) setGlabVerbose(true);
 
-// ── Session Config reader (inline) ───────────────────────────────────────────
+// ── Session Config reader ─────────────────────────────────────────────────────
 
-/** Read vault-integration.{gitlab-groups,vault-dir} from CLAUDE.md / AGENTS.md in CWD. */
+/**
+ * Read vault-integration.{gitlab-groups,vault-dir} from CLAUDE.md / AGENTS.md in
+ * CWD through the canonical Session Config parser (#1094), so every form it
+ * accepts (block, inline object, dash/bold bullet) reaches this CLI too.
+ *
+ * `vault-dir` resolves HOST-LOCALLY like every other vault writer:
+ * SO_VAULT_DIR > owner.yaml `vault-dirs:` cwd match > owner.yaml
+ * `paths.vault-dir` > the committed value (`resolveVaultDir`). The committed
+ * value alone would put `--apply` stubs into whatever vault the committed file
+ * names, even on a host whose owner.yaml points elsewhere. Not
+ * `parseSessionConfig`: it throws on an invalid value in any unrelated block.
+ *
+ * `enabled` is the switch the other vault writers obey (board-writer,
+ * narrative-mirror: `enabled !== true` → skip), after the same host-local
+ * lowering `parseSessionConfig` applies — env `SO_VAULT_INTEGRATION` >
+ * owner.yaml `vault-integration:` > committed (#1496: stubs were created with
+ * the integration off, from an owner.yaml `paths.vault-dir` alone).
+ *
+ * @returns {{'gitlab-groups': string[]|null, 'vault-dir': string|null, enabled: boolean,
+ *   'host-override': string|null}}
+ */
 function readVaultIntegrationConfig() {
   const candidates = [join(process.cwd(), 'CLAUDE.md'), join(process.cwd(), 'AGENTS.md')];
 
@@ -98,45 +122,24 @@ function readVaultIntegrationConfig() {
     }
   }
 
-  if (!content) return { 'gitlab-groups': null, 'vault-dir': null };
-
-  let inBlock = false;
-  let gitlabGroups = null;
-  let vaultDir = null;
-
-  for (const rawLine of content.split(/\r?\n/)) {
-    const line = rawLine.replace(/\r$/, '');
-
-    if (!inBlock && /^vault-integration:\s*$/.test(line)) { inBlock = true; continue; }
-    if (inBlock) {
-      if (line.length > 0 && !/^\s/.test(line)) break;
-
-      const m = line.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
-      if (!m) continue;
-
-      const k = m[1].trim();
-      let v = m[2].trim().replace(/\s*#.*$/, '').trim();
-      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
-        v = v.slice(1, -1);
-      }
-
-      if (k === 'gitlab-groups' && v) {
-        gitlabGroups = v.replace(/^\[/, '').replace(/\]$/, '').trim() || null;
-      }
-      if (k === 'vault-dir' && v && v !== 'none' && v !== 'null') {
-        vaultDir = v;
-      }
-    }
-  }
-
-  return { 'gitlab-groups': gitlabGroups, 'vault-dir': vaultDir };
+  const hostCtx = loadHostPaths();
+  const vi = resolveVaultIntegrationHost(_parseVaultIntegration(content ?? ''), hostCtx);
+  const vaultDir = resolveVaultDir(vi['vault-dir'], hostCtx).value ?? null;
+  return {
+    'gitlab-groups': vi['gitlab-groups'],
+    'vault-dir': vaultDir,
+    enabled: vi.enabled === true,
+    'host-override': vi['host-override'],
+  };
 }
 
 // ── Vault-dir folder stub ─────────────────────────────────────────────────────
 
 function createVaultFolderStub(vaultDir, slug) {
   if (!vaultDir) return;
-  const stubDir = join(resolve(vaultDir), '01-projects', slug);
+  // `~/…` is the documented vault-dir shape; resolve() alone does not expand it
+  // and would put the stub under `<cwd>/~/…`.
+  const stubDir = join(resolve(expandTilde(vaultDir)), '01-projects', slug);
   try {
     if (!existsSync(stubDir)) {
       if (applyWrites) {
@@ -399,10 +402,20 @@ async function main() {
   if (flagGroups) {
     groups = flagGroups.split(',').map((g) => g.trim()).filter(Boolean);
   } else if (cfgConfig['gitlab-groups']) {
-    groups = cfgConfig['gitlab-groups'].split(',').map((g) => g.trim()).filter(Boolean);
+    groups = cfgConfig['gitlab-groups'];
   }
 
-  const vaultDir = flagVaultDir ?? cfgConfig['vault-dir'] ?? null;
+  // The configured vault-dir counts only while vault-integration is on; an
+  // explicit --vault-dir is this run's own request and still wins.
+  let vaultDir = flagVaultDir ?? null;
+  if (vaultDir === null && cfgConfig['vault-dir'] !== null) {
+    if (cfgConfig.enabled) {
+      vaultDir = cfgConfig['vault-dir'];
+    } else {
+      const why = cfgConfig['host-override'] ? `switched off by ${cfgConfig['host-override']}` : 'not enabled';
+      log(`vault-integration is ${why} — no vault folder stubs (pass --vault-dir to create them anyway)`);
+    }
+  }
 
   if (!flagYes && (!groups || groups.length === 0)) {
     die(1, 'no GitLab groups specified — pass --groups <CSV> or set vault-integration.gitlab-groups in CLAUDE.md');

package/scripts/vault-integration-watcher.mjs

@@ -35,6 +35,7 @@ import { getCrossRepoProjects, getConfinementRoot } from './lib/config/cross-rep
 import { validatePathInsideProject } from './lib/path-utils.mjs';
 import { resolveRepoSpec, redactUrlCredentials } from './lib/vcs-repo-spec.mjs';
 import { expandTilde } from './lib/common.mjs';
+import { shellQuote } from './lib/sh-quote.mjs';
 
 // ── Argument parsing ──────────────────────────────────────────────────────────
 
@@ -285,7 +286,7 @@ function buildTickBody(issueMap, depIds, verdict, streak, date) {
 function buildFlipBody(repos) {
   // Defense-in-depth: regex+confinement upstream already filter, but shell-quote here
   // makes the embedded bash safe under any future bypass.
-  const repoList = repos.map(r => `'${r.replace(/'/g, "'\\''")}'`).join(' ');
+  const repoList = repos.map(shellQuote).join(' ');
   // The sed/add/commit one-liner targets the project-instruction file. Most
   // ecosystem repos use CLAUDE.md, but Codex-CLI repos use AGENTS.md as a
   // transparent alias — see skills/_shared/instruction-file-resolution.md.