session-orchestrator 5.9.0 → 5.10.0

package/scripts/lib/quality-gate.mjs

@@ -851,7 +851,12 @@ export function gateKillFields(run) {
  * Count fallback is limited to pre-#954 sessions, gates outside the event
  * wrapper, or missing wave attribution; step 7 falls back to this wave's own
  * gate output (its header is not written yet), session end to the header. Auto-fix with a known wave
- * uses the event; missing counts alone do not permit header fallback.
+ * uses the event; missing counts alone do not permit count fallback.
+ * Diagnose own-session events without the counts filter to distinguish absent
+ * events, missing wave attribution, and fail-fast events without counts; never
+ * adopt counts from another session/wave or an unattributed row. A truncated
+ * append can be skipped by fromjson?, leaving an older matching run: that alone
+ * does not establish the current gate result.
  *
  * `suite_platform` comes from this wave's gate run (step 7) or the STATE.md
  * Wave History header `— suite <passed>/<failed> on <platform>` (session end);

package/scripts/lib/redact-spans.mjs

@@ -9,28 +9,19 @@
  *
  * Behaviour is unchanged from the original: this module is a move, not a rewrite.
  *
- * DELIBERATE SECOND COPY — `check-owner-leakage.mjs` still carries its OWN inline
- * `redactSpans()` and must keep it. That scanner is a documented standalone
- * single-file vendoring target (`.claude/rules/security.md` § "Owner-Privacy
- * Pre-Commit Hook"): consumer repos copy that ONE file, so a static import of this
- * module throws ERR_MODULE_NOT_FOUND in every vendored copy and blocks all commits
- * (proven by the three cases in `tests/husky/pre-commit-owner-leakage.test.mjs`).
- * Unlike CP11's confidential-names helpers, a redaction sink cannot degrade to
- * inert — an absent redaction prints confidential names into a PUBLIC CI log.
- * So: THIS module serves in-tree consumers, the inline copy serves the vendored
- * path, and `tests/lib/redact-spans.test.mjs` pins the two byte-for-byte against
- * each other. Edit one → that drift guard goes red until both agree again.
+ * The owner-leakage scanner remains a standalone vendoring target. Since #1530
+ * it omits offending line content entirely and redacts private filename segments,
+ * so it no longer carries a second copy of this primitive. In-tree consumers
+ * that retain surrounding text use this module; its overlap and ordering
+ * contracts are covered by tests/lib/redact-spans.test.mjs.
  */
 
 /**
  * Redact every confidential-name span from `line`, ORDER-INDEPENDENTLY (Fix 1 + Fix 2).
  *
- * This is the single redaction sink for the confidential-names privacy invariant.
- * In `check-owner-leakage.mjs` it is applied at the print choke-point over EVERY
- * violation's lineContent — not only CP11 hits — because that scanner runs in a
- * PUBLIC GitHub-Actions mirror: a confidential customer/repo name that co-occurs
- * with a CP1–CP10 hit on the same line (e.g. a name beside an RFC1918 IP that
- * fails CP8) would otherwise be echoed verbatim to the public CI log (Fix 1).
+ * Consumers must pass every relevant confidential pattern before emitting text.
+ * This helper matches the supplied text literally; callers handling reversible
+ * encodings must normalize first or omit the sensitive text entirely.
  *
  * ORDER-INDEPENDENCE (Fix 2): a naïve chain of `.replace()` calls is order-dependent
  * — when one configured name is a PREFIX of another (`['acme','acme-corp-secret']`),

package/scripts/lib/scope-gate.mjs

@@ -5,14 +5,15 @@
  * hot-paths — all sync. Re-exported by hardening.mjs as a barrel so existing
  * importers keep working unchanged.
  *
- * Layering: hook-safe — pure functions only; no I/O at import time;
- * ESM-pure for fast hook hot-paths. Hooks (under `hooks/`) import from
- * this lib; this lib MUST NOT reverse-import from `hooks/`. Cross-cutting
- * invariant for all exports below — see #554 A2.
+ * Layering: hook-safe synchronous helpers; no I/O at import time. Guard
+ * context lookups read bounded filesystem state when called. Hooks (under
+ * `hooks/`) import this ESM-only lib; it MUST NOT reverse-import from hooks.
+ * Cross-cutting invariant for all exports below — see #554 A2.
  */
 
-import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, lstatSync, openSync, fstatSync, readSync, closeSync, constants } from 'node:fs';
 import path from 'node:path';
+import { resolveSessionRoot, isolatedAgentCheckout, registeredWorktreeRoots } from './platform.mjs';
 
 import { tokenizeCommand, splitChainSegments, resolveSegmentVerb } from './command-blocker.mjs';
 
@@ -106,6 +107,68 @@ export function findOwnScopeFile(projectRoot, ownIds, classify) {
   return { path: null, foreignPath };
 }
 
+/**
+ * Guard context: control state belongs to the coordinator, relative grants to
+ * the actual isolated checkout. Remote adoption requires unique OWN identity;
+ * local unknown/corrupt/foreign/missing dispositions remain unchanged.
+ * Root-only discovery deliberately excludes arbitrary worktree subdirectories;
+ * revisit when the harness supplies a coordinator-root witness (#1504).
+ * @param {{cwd: string, ownIds: Set<string>, classify: Function}} options
+ * @returns {{manifestRoot: string, writeRoot: string, path: string|null,
+ *   foreignPath: string|null, isolated: boolean, error: string|null}}
+ */
+export function resolveScopeContext({ cwd, ownIds, classify }) {
+  let manifestRoot = resolveSessionRoot(cwd);
+  try { manifestRoot = realpathSync.native(manifestRoot); } catch { /* preserve non-existing-root fallback */ }
+  const local = findOwnScopeFile(manifestRoot, ownIds, classify);
+  const agent = isolatedAgentCheckout(cwd);
+  const context = { manifestRoot, writeRoot: agent?.writeRoot ?? manifestRoot,
+    ...local, isolated: agent !== null, error: null };
+  if (!agent || local.path || ownIds.size === 0) return context;
+  const candidates = registeredWorktreeRoots(agent.commonDir);
+  if (candidates.error) return { ...context, error: candidates.error };
+  const matches = new Map();
+  for (const root of candidates.roots) {
+    if (root === agent.writeRoot || root === manifestRoot || isolatedAgentCheckout(root)) continue;
+    // Inspect precedence candidates separately. An unsafe candidate has unknown
+    // ownership: it must never turn an isolated session into a no-scope ALLOW.
+    for (const dir of SCOPE_FILE_DIRS) {
+      const file = path.join(root, dir, 'wave-scope.json');
+      let fd;
+      let raw;
+      try {
+        const before = lstatSync(file);
+        if (!before.isFile() || before.size > 1024 * 1024) return { ...context, error: 'unsafe-coordinator-scope' };
+        fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const opened = fstatSync(fd);
+        if (!opened.isFile() || opened.ino !== before.ino || opened.dev !== before.dev || opened.size > 1024 * 1024) return { ...context, error: 'unsafe-coordinator-scope' };
+        const buffer = Buffer.alloc(1024 * 1024 + 1);
+        let length = 0;
+        while (length < buffer.length) {
+          const n = readSync(fd, buffer, length, buffer.length - length, null);
+          if (n === 0) break;
+          length += n;
+        }
+        if (length > 1024 * 1024) return { ...context, error: 'unsafe-coordinator-scope' };
+        raw = buffer.toString('utf8', 0, length);
+      } catch (err) {
+        if (err?.code === 'ENOENT') continue;
+        return { ...context, error: 'unsafe-coordinator-scope' };
+      } finally { if (fd !== undefined) closeSync(fd); }
+      try {
+        const scope = JSON.parse(raw);
+        if (classify(scope, ownIds).verdict === 'own') {
+          matches.set(realpathSync(file), { root, path: file, foreignPath: null });
+          break; // highest-precedence positively owned manifest in this root
+        }
+      } catch { /* unbound/corrupt remote state is never authority */ }
+    }
+  }
+  if (matches.size > 1) return { ...context, error: 'ambiguous-coordinator-scope' };
+  const match = matches.values().next().value;
+  return match ? { ...context, manifestRoot: match.root, path: match.path, foreignPath: null } : context;
+}
+
 /**
  * Read the enforcement level from a scope file.
  * Defaults to "strict" (fail-closed) on parse error or missing field.