session-orchestrator 5.6.0 → 5.8.0

package/scripts/lib/ux-grill/run-record.mjs

@@ -32,6 +32,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
+import { atomicWriteWithBackup, envelopeToError } from '../io.mjs';
 import { findingsPath, runRecordPath } from './paths.mjs';
 import { makeRunRecord } from './schema.mjs';
 
@@ -290,9 +291,10 @@ export function updateRunRecordCompare(repoRoot, runId, compare) {
     out.push(raw);
   }
 
-  const tmp = `${ledger}.${process.pid}.tmp`;
-  fs.writeFileSync(tmp, out.length > 0 ? `${out.join('\n')}\n` : '', 'utf8');
-  fs.renameSync(tmp, ledger);
+  const res = atomicWriteWithBackup(ledger, out.length > 0 ? `${out.join('\n')}\n` : '', {
+    tmpPrefix: `.${path.basename(ledger)}.tmp`,
+  });
+  if (!res.ok) throw envelopeToError(res);
   return { updated, skippedLines };
 }
 

package/scripts/lib/validate/check-banner-parity.mjs

@@ -187,6 +187,7 @@ export function collectMarkdownFiles(pluginRoot) {
       const output = execFileSync('git', ['ls-files', '-z', '--', ...SCAN_DIRS], {
         cwd: pluginRoot,
         encoding: 'utf8',
+        maxBuffer: 64 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'ignore'],
         env,
       });

package/scripts/lib/validate/check-skills.mjs

@@ -93,7 +93,7 @@ function collectSkillFiles(skillsDir) {
  *
  * Rules: R1 frontmatter block present · R8 block parses as a YAML mapping ·
  * R2 `name` present · R3 `name` is kebab-case · R5 `name` === directory name ·
- * R6 `description` present and non-empty.
+ * R6 `description` present and non-empty · R9 `user-invocable` stated explicitly.
  *
  * @param {{ dirName: string, relPath: string, absPath: string }} skill
  * @returns {boolean} true when every rule holds
@@ -148,6 +148,16 @@ function validateSkillFrontmatter(skill) {
     fail(`${skill.relPath}: missing or empty required frontmatter field: description`);
   }
 
+  // R9 — `user-invocable` written down. Claude Code lists a skill WITHOUT the
+  // key in the `/` picker (#1515: 37 entries against a documented 27, from 10
+  // keyless skills). The census and the adapter generators now follow that
+  // reading (`isUserInvocableSkill`), but a forgotten key is still an
+  // unreviewed picker entry — so the decision must be explicit: `true` for an
+  // operator command, `false` for a helper the model dispatches.
+  if (!Object.hasOwn(frontmatter, 'user-invocable')) {
+    fail(`${skill.relPath}: missing required frontmatter field: user-invocable (Claude Code treats an absent key as true and lists the skill in the / picker — write \`user-invocable: true\` for an operator command or \`user-invocable: false\` for a helper)`);
+  }
+
   return failed === before;
 }
 
@@ -180,7 +190,7 @@ if (!existsSync(skillsDir)) {
     }
 
     if (valid === skills.length) {
-      pass(`all ${skills.length} ${SKILL_FILE} frontmatter blocks parse as YAML and carry a kebab-case name matching their directory plus a non-empty description`);
+      pass(`all ${skills.length} ${SKILL_FILE} frontmatter blocks parse as YAML and carry a kebab-case name matching their directory, a non-empty description and an explicit user-invocable`);
     }
   }
 }

package/scripts/lib/validate/check-test-fixture-shapes.mjs

@@ -154,10 +154,10 @@ const MAGIC_COMMENT_SCAN_LINES = 5;
 function getTrackedTestFiles() {
   let output;
   try {
-    output = execFileSync('git', ['ls-files'], { cwd: pluginRoot, encoding: 'utf8' });
+    output = execFileSync('git', ['ls-files'], { cwd: pluginRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 64 * 1024 * 1024 });
   } catch {
-    // Not a git repo or git unavailable — return empty (caller treats as pass)
-    return [];
+    console.error('Error: unable to enumerate tracked test files with git ls-files');
+    process.exit(2);
   }
   return output
     .split('\n')

package/scripts/lib/validate/check-test-value-bans.mjs

@@ -406,6 +406,15 @@ const SEAM_CLOCK_ARG = new RegExp(`${CLOCK_NAME}:`);
  * `{ now }` or a positional `now` loses its seam proof and its bombs go unseen.
  * REVISIT on the first B5 finding whose subject is a helper, or the first CI
  * `test-value-bans` B5 finding the ±days clock-shift probe shows to be false.
+ *
+ * CEILING (#1507 item 3) — three known blind spots of the SCREAMING_CASE forms,
+ * left deliberately: (a) a bare `NOW)` / `NOW,` counts as a handover, whatever
+ * the constant holds; (b) arithmetic on a collected clock (`NOW - DAY`) is NOT
+ * seen as a handover, the terminator follows the operand, not the name; (c) an
+ * IMPORTED clock constant is not checked for provenance — `NOW` from a helper
+ * module that holds `Date.now()` reads as controlled. Measured impact
+ * 2026-10-03: 0 changed findings over 722 test files.
+ * REVISIT on the first B5 miss or false finding traced to (a), (b) or (c).
  */
 const CONTROL_CLOCK_ARG = new RegExp(String.raw`${CLOCK_NAME}(:|,|\}|\))`, 'g');
 
@@ -452,9 +461,10 @@ const LOCAL_IMPORT = new RegExp(
 function trackedTestFiles() {
   let out;
   try {
-    out = execFileSync('git', ['ls-files'], { cwd: repoRoot, encoding: 'utf8' });
+    out = execFileSync('git', ['ls-files'], { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 64 * 1024 * 1024 });
   } catch {
-    return []; // not a git repo — nothing to scan
+    console.error('Error: unable to enumerate tracked test files with git ls-files');
+    process.exit(2);
   }
   return out
     .split('\n')

package/scripts/lib/validate/check-unicode-safety.mjs

@@ -114,7 +114,7 @@ function walkDir(root, dir, acc = []) {
 export function getTrackedFiles(root) {
   let files;
   try {
-    const output = execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8' });
+    const output = execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
     files = output.split('\n').filter(Boolean).map((f) => join(root, f));
   } catch {
     files = walkDir(root, root);

package/scripts/lib/validate/check-unwired-features.mjs

@@ -451,7 +451,7 @@ const ALLOWLIST = Object.freeze({
   'auto-skill-dispatch':
     'prose-only consumer — skills/using-orchestrator/SKILL.md + skills/_shared/bootstrap-gate.md read this key as an LLM instruction; there is no .mjs gate by design',
   'auto-commit-per-wave':
-    'prose-only consumer — skills/wave-executor/wave-loop.md gates the per-wave commit step on this key; the commit itself is a coordinator action, not a script',
+    'planned no-op (#1219) — only skills/wave-executor/references/wave-loop-review.md names this key, as contract prose; no per-wave commit step runs on it yet (scripts/lib/auto-commit.mjs does not exist)',
   'instruction-budget':
     'dedicated reader outside the parser layer — scripts/lib/instruction-budget-guard.mjs parses this block itself (S2 exemption only; S1 evidence is real)',
 });

package/scripts/lib/vault-archive.mjs

@@ -16,10 +16,8 @@
  *
  * ── Frontmatter schema (mirror, not import) ─────────────────────────────────
  * The canonical vault frontmatter schema is the GENERATED Zod block in
- * skills/vault-sync/validator.mjs (Z.104-134). That schema is NOT exported, and
- * `zod` is not a dependency of scripts/ (it lives only as a skill-local shim in
- * skills/vault-sync/node_modules/). So the field constraints below are a
- * hand-rolled MIRROR of that schema. If the canonical schema changes, update the
+ * skills/vault-sync/validator.mjs (Z.104-134). That schema is NOT exported, so
+ * the field constraints below are a hand-rolled MIRROR of that schema. If the canonical schema changes, update the
  * constants here to match. The mirror is proven equivalent by an integration
  * test that runs the REAL validator subprocess over generated output
  * (tests/lib/vault-archive.test.mjs § "REAL validator").