session-orchestrator 5.4.0 → 5.5.0

package/scripts/lib/blocked-commands-policy.mjs

@@ -198,6 +198,46 @@ export function mergePolicies(floor, overlay) {
   return { rules: merged, warnings };
 }
 
+// ---------------------------------------------------------------------------
+// Wave-manifest projection
+// ---------------------------------------------------------------------------
+
+/**
+ * The patterns a wave manifest's `blockedCommands` may carry (#1509): the
+ * `pattern` of every `severity: 'block'` rule that has NO `type`.
+ *
+ * A TYPED rule's `pattern` is not a command pattern. `redirect-truncate` rules
+ * carry `pattern: ">"` and `path-delete` rules a free-text label; both are
+ * decided by their TARGET, type-aware, in hooks/pre-bash-destructive-guard.mjs.
+ * `hooks/enforce-commands.mjs` reads every `blockedCommands` entry as a command
+ * pattern, so the flattened `">"` denied interpreter payloads such as
+ * `bash -c "echo hi > /tmp/x"` (measured 2026-10-03 @ 8292050e). An untyped
+ * rule is the one class whose pattern means the same thing to both hooks.
+ *
+ * An UNKNOWN `type` is excluded as well: its pattern's meaning is unknown, and
+ * the destructive guard still evaluates the rule on every Bash call, so leaving
+ * it out of the manifest drops no protection — admitting it repeats #1509 for
+ * the next rule type.
+ *
+ * Total: a non-array `rules` (e.g. `loadEffectivePolicy()`'s `null`) yields `[]`.
+ *
+ * @param {unknown} rules - the `rules` of {@link loadEffectivePolicy}
+ * @returns {string[]}
+ */
+export function blockedCommandPatterns(rules) {
+  if (!Array.isArray(rules)) return [];
+  return rules
+    .filter(
+      (r) =>
+        r !== null &&
+        typeof r === 'object' &&
+        r.severity === 'block' &&
+        (r.type ?? null) === null &&
+        typeof r.pattern === 'string',
+    )
+    .map((r) => r.pattern);
+}
+
 // ---------------------------------------------------------------------------
 // Load (with per-path mtime cache)
 // ---------------------------------------------------------------------------

package/scripts/lib/common.mjs

@@ -54,6 +54,47 @@ export function expandTilde(p) {
   return p;
 }
 
+/**
+ * Replace the current user's home directory with `~` wherever it occurs in
+ * `text` — the inverse of {@link expandTilde}, for free text as well as a bare
+ * path: an `err.message` from `node:fs` (`ENOENT: …, open '/Users/bob/v/x.md'`),
+ * git stderr, a resolved vault dir. Every occurrence is replaced.
+ *
+ * Log lines of the vault writers and the session-end shell land in CI logs and
+ * session transcripts, where the home dir is an owner-privacy leak (#1490,
+ * `.claude/rules/security.md` § Owner-Privacy).
+ *
+ * Boundary-aware on both sides. On the right the home dir must end at a path
+ * separator, the end of the text, whitespace, a quote/bracket/list delimiter
+ * (`'"\`)]},;:`) or a sentence-final `.`, so `/Users/bob` never rewrites
+ * `/Users/bobby/x` or `/Users/bob.old`. On the left it must not continue a
+ * path segment, so `/data/Users/bob` stays. A home dir that is empty, the
+ * filesystem root or a bare drive root is a no-op — collapsing it would
+ * rewrite every absolute path. Non-strings pass through unchanged.
+ *
+ * @param {string} text
+ * @param {string} [home] — defaults to `os.homedir()`; an unresolvable home
+ *   leaves `text` unchanged (a log redactor must never turn an error path into
+ *   a crash)
+ * @returns {string}
+ */
+export function redactHomeDir(text, home) {
+  if (typeof text !== 'string' || text.length === 0) return text;
+  let h = home;
+  if (h === undefined) {
+    try {
+      h = os.homedir();
+    } catch {
+      return text;
+    }
+  }
+  h = String(h ?? '').replace(/[/\\]+$/, '');
+  if (h.length === 0 || /^[a-z]:$/i.test(h)) return text;
+  const escaped = h.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const re = new RegExp(`(?<![\\w.~-])${escaped}(?=$|[/\\\\\\s'"\`)\\]},;:]|\\.(?:$|\\s))`, 'g');
+  return text.replace(re, '~');
+}
+
 // ---------------------------------------------------------------------------
 // Timestamp helpers
 // ---------------------------------------------------------------------------

package/scripts/lib/config/vault-integration.mjs

@@ -57,16 +57,31 @@ const MODE_ALLOWED = ['warn', 'strict', 'off'];
  * value portion (including any literal `**` inside it) is untouched.
  *
  * Defaults:
- *   enabled:    false
- *   vault-dir:  null
- *   mode:       "warn" (invalid values silently fall back to "warn")
- *   vault-name: null   (absent = downstream callers use deriveRepo() default)
+ *   enabled:       false
+ *   vault-dir:     null
+ *   mode:          "warn" (invalid values silently fall back to "warn")
+ *   vault-name:    null   (absent = downstream callers use deriveRepo() default)
+ *   gitlab-groups: null   (#1094 — non-empty string[] or null; see _groupsFromScalar)
+ *
+ * `gitlab-groups` accepts a comma string (`a, b`), a flow array (`[a, b]`) and,
+ * in block form only, a YAML block list (`gitlab-groups:` + indented `- a`
+ * lines — the shape docs/session-config-template.md documents). Inside the
+ * inline-object form more than one group needs the `[a, b]` array, because the
+ * literal is split on commas. YAML semantics throughout: `null` / `~` / empty
+ * mean unset (also as a list element), and each element loses one pair of
+ * matching quotes.
  *
  * @param {string} content — full file contents
- * @returns {{enabled: boolean, "vault-dir": string|null, mode: string, "vault-name": string|null}}
+ * @returns {{enabled: boolean, "vault-dir": string|null, mode: string, "vault-name": string|null, "gitlab-groups": string[]|null}}
  */
 export function _parseVaultIntegration(content) {
-  const defaults = { enabled: false, 'vault-dir': null, mode: 'warn', 'vault-name': null };
+  const defaults = {
+    enabled: false,
+    'vault-dir': null,
+    mode: 'warn',
+    'vault-name': null,
+    'gitlab-groups': null,
+  };
   if (typeof content !== 'string' || content === '') return defaults;
 
   // #1162: NOT a raw split. `preprocessBlockLines` drops HTML-commented lines
@@ -106,21 +121,36 @@ export function _parseVaultIntegration(content) {
   let vaultDir = null;
   let mode = 'warn';
   let vaultName = null;
+  let gitlabGroups = null;
+  // Items of a YAML block list under a value-less `gitlab-groups:` line; null
+  // while no such list is open.
+  let groupItems = null;
 
   for (const rawLine of blockLines) {
     const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
     if (!clean.trim()) continue;
 
-    // Only first-level sub-keys (single indent). Skip deeper nested keys like
-    // `gitlab-groups:` list items (handled as a no-op — they aren't in this
-    // parser's return shape).
+    if (groupItems !== null) {
+      const item = clean.match(/^\s+-(?:\s+(.*))?$/);
+      if (item) {
+        const value = _groupName((item[1] ?? '').trim());
+        if (value !== null) groupItems.push(value);
+        continue;
+      }
+    }
+
+    // Sub-keys at any indent. A list-item line (`- x`) never matches, so list
+    // items under a key this parser does not own are skipped here.
     const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)$/);
     if (!kvMatch) continue;
 
+    if (groupItems !== null) {
+      if (groupItems.length > 0) gitlabGroups = groupItems;
+      groupItems = null;
+    }
+
     const k = kvMatch[1];
-    let v = kvMatch[2].trim();
-    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
-    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+    const v = _stripQuotes(kvMatch[2].trim());
 
     switch (k) {
       case 'enabled':
@@ -140,21 +170,118 @@ export function _parseVaultIntegration(content) {
         if (v === '' || v === 'none' || v === 'null') vaultName = null;
         else vaultName = v;
         break;
+      case 'gitlab-groups': {
+        // A value replaces any earlier one; an empty value opens a block list,
+        // which replaces it only once it has collected an item. The value goes
+        // to `_groupsFromScalar` WITH its quotes, as the inline form's does —
+        // stripping them here first read `"null"` as unset in this form only (#1496).
+        const raw = kvMatch[2].trim();
+        if (raw === '') groupItems = [];
+        else gitlabGroups = _groupsFromScalar(raw);
+        break;
+      }
     }
   }
+  if (groupItems !== null && groupItems.length > 0) gitlabGroups = groupItems;
+
+  return {
+    enabled,
+    'vault-dir': vaultDir,
+    mode,
+    'vault-name': vaultName,
+    'gitlab-groups': gitlabGroups,
+  };
+}
 
-  return { enabled, 'vault-dir': vaultDir, mode, 'vault-name': vaultName };
+/**
+ * Strip ONE pair of matching surrounding quotes (`"x"` / `'x'`). A lone quote
+ * character is returned unchanged.
+ *
+ * @param {string} v — an already-trimmed value
+ * @returns {string}
+ */
+function _stripQuotes(v) {
+  if (v.length >= 2 && ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))) {
+    return v.slice(1, -1);
+  }
+  return v;
 }
 
+/**
+ * The YAML 1.2 core-schema null scalars, plus the empty value. `none` is NOT
+ * one: YAML reads it as a string, so it stays a literal group name.
+ */
+const YAML_NULL_RE = /^(?:|null|Null|NULL|~)$/;
+
+/**
+ * One `gitlab-groups` element as YAML reads it: an unquoted null scalar (or an
+ * empty element) is no group at all → `null`; otherwise ONE pair of matching
+ * quotes is stripped, so `"null"` stays the string `null` exactly as in YAML.
+ *
+ * @param {string} raw — an already-trimmed element
+ * @returns {string|null}
+ */
+function _groupName(raw) {
+  if (YAML_NULL_RE.test(raw)) return null;
+  const name = _stripQuotes(raw).trim();
+  return name === '' ? null : name;
+}
+
+/**
+ * Normalise a scalar `gitlab-groups` value to a group list with YAML semantics:
+ * a null scalar (`null`, `~`, empty) is unset → `null`; otherwise drop one
+ * leading `[` and one trailing `]`, split on commas, trim, and read each element
+ * through `_groupName` (null elements dropped, one quote pair stripped). An
+ * empty result is `null`, the documented default. Before this, `null` scanned a
+ * GitLab group named "null" and `["a"]` one named `"a"` with the quotes.
+ *
+ * The ONE normalisation for both forms, so both pass the value with its quotes
+ * (#1496). A wholly quoted value is a YAML string, never a null: it loses that
+ * quote pair, is split on commas, and its elements are taken literally —
+ * `"null"` is the group "null", `"a, b"` the groups a and b.
+ *
+ * @param {string} v
+ * @returns {string[]|null}
+ */
+function _groupsFromScalar(v) {
+  const trimmed = v.trim();
+  if (YAML_NULL_RE.test(trimmed)) return null;
+  const unquoted = _stripQuotes(trimmed);
+  const readElement = unquoted === trimmed ? _groupName : (g) => (g === '' ? null : g);
+  const groups = unquoted
+    .replace(/^\[/, '')
+    .replace(/\]$/, '')
+    .split(',')
+    .map((g) => readElement(g.trim()))
+    .filter((g) => g !== null);
+  return groups.length > 0 ? groups : null;
+}
+
+/**
+ * `gitlab-groups: [ ... ]` inside an inline object literal (braces already
+ * removed). Taken out BEFORE the comma split, which would otherwise cut the
+ * array apart; every other pair is split exactly as before.
+ */
+const INLINE_GROUPS_ARRAY_RE = /(^|,)\s*gitlab-groups\s*:\s*(\[[^\]]*\])\s*(?=,|$)/;
+
 /**
  * Parse an inline YAML object literal `{ key: val, key: val }` into the
  * vault-integration return shape. Supports unquoted values including `~/` paths.
  *
  * @param {string} raw — full literal including braces
- * @returns {{enabled: boolean, "vault-dir": string|null, mode: string}}
+ * @returns {{enabled: boolean, "vault-dir": string|null, mode: string, "vault-name": string|null, "gitlab-groups": string[]|null}}
  */
 function _parseInlineObject(raw) {
-  const stripped = raw.replace(/^\s*\{/, '').replace(/\}\s*$/, '').trim();
+  let stripped = raw.replace(/^\s*\{/, '').replace(/\}\s*$/, '').trim();
+  let groupsArray = null;
+  const arrayMatch = stripped.match(INLINE_GROUPS_ARRAY_RE);
+  if (arrayMatch) {
+    groupsArray = arrayMatch[2];
+    stripped =
+      stripped.slice(0, arrayMatch.index) +
+      arrayMatch[1] +
+      stripped.slice(arrayMatch.index + arrayMatch[0].length);
+  }
   const kv = new Map();
   if (stripped !== '') {
     for (const pair of stripped.split(',')) {
@@ -180,7 +307,15 @@ function _parseInlineObject(raw) {
     vaultNameRaw === undefined || vaultNameRaw === '' || vaultNameRaw === 'none' || vaultNameRaw === 'null'
       ? null
       : vaultNameRaw;
-  return { enabled, 'vault-dir': vaultDir, mode, 'vault-name': vaultName };
+  const groupsRaw = groupsArray ?? kv.get('gitlab-groups');
+  const gitlabGroups = groupsRaw === undefined ? null : _groupsFromScalar(groupsRaw);
+  return {
+    enabled,
+    'vault-dir': vaultDir,
+    mode,
+    'vault-name': vaultName,
+    'gitlab-groups': gitlabGroups,
+  };
 }
 
 // ---------------------------------------------------------------------------

package/scripts/lib/config.mjs

@@ -103,11 +103,15 @@ import { expandTilde } from './common.mjs';
  *
  * `cwd` in the ctx is a test-only DI seam; production reads `process.cwd()`.
  *
+ * Exported for vault writers that read only the `vault-integration` block and
+ * cannot afford `parseSessionConfig`, which throws on an invalid value in any
+ * unrelated block (scripts/vault-backfill.mjs, #1094).
+ *
  * @param {string|null|undefined} committed — value the committed Session Config produced
  * @param {{ env?: Record<string, string|undefined>, ownerConfig?: object, cwd?: string }} [ctx] — from loadHostPaths()
  * @returns {{ value: string|null|undefined, source: 'env'|'match'|'owner'|'committed' }}
  */
-function resolveVaultDir(committed, { env = process.env, ownerConfig, cwd } = {}) {
+export function resolveVaultDir(committed, { env = process.env, ownerConfig, cwd } = {}) {
   const isNonBlank = (v) => typeof v === 'string' && v.trim() !== '';
 
   const envVal = env?.SO_VAULT_DIR;

package/scripts/lib/eval/engine.mjs

@@ -840,6 +840,19 @@ function resolveModel(model, env, resolveModelFromEnv) {
 // Public API
 // ---------------------------------------------------------------------------
 
+/**
+ * Events window this reader needs retained (#1401 part 3): NONE FIXED, hence
+ * `null` rather than a made-up number. `evaluateSession` reads the whole
+ * ledger through `readEventsWithRotations` to score ONE named past session,
+ * arbitrarily old (`computeWindow`, #1407) — the window it needs is that
+ * session's own age, which no finite retention can be sized for. A session
+ * older than the retained ledger surfaces through `ledgerGapNote` instead.
+ * Read by `scripts/lib/events-retention-banner.mjs`.
+ *
+ * @type {number|null}
+ */
+export const REQUIRED_EVENTS_WINDOW_DAYS = null;
+
 /**
  * Evaluate one completed session against the rubric-v2 dimensions.
  *