Files
Bellman ac4f0ef1ed fix: OMC release-readiness repairs (dependency/credential/lock/lifecycle/security)
Resolves the release-blocking issues identified in this session's ultragoal
run, verified against 13907/14197 (97.96%) passing tests:

- Fix dependency vulnerabilities (npm audit: 0 vulnerabilities)
- Fix credential symlink-chain resolution failure in src/cli/launch.ts
- Fix doctor false-positive plugin-collision detection
- Rewrite Darwin state-mutation locking: replace external flock subprocess
  dependency with better-sqlite3 WAL + BEGIN IMMEDIATE (scripts/lib/state-lock.mjs,
  src/lib/mode-state-io.ts), with symlink/hardlink sidecar validation and
  release-transaction rollback on unlink failure
- Add installer-provisioned, package-root-pinned standalone state-lock bridge
  (src/installer/index.ts) so standalone (non-npm-package) hook installs get
  a validated, fail-closed native lock backend instead of a duplicated/stale copy
- Fix release-prep script to fail closed on lockfile/metadata sync errors
  instead of swallowing them
- Fix shipping-surface symlinked-trusted-root resolution
  (scripts/plugin-shipping-surface.mjs)
- Fix SessionEnd foreground-bootstrap: bootstrap no longer prematurely seals
  the core producer before foreground-cleanup runs, which previously stalled
  every SessionEnd job in recoverable-failure forever (new
  src/hooks/session-end/foreground-bootstrap.ts, wired through
  scripts/session-end.mjs to keep the 300ms foreground budget)
- Fix worker action-authority threading: captured runner authority is now
  passed through executeSessionEndAction and used for payload-mutation
  authorization instead of the mutable current manifest (prevents stale-owner
  mutation)
- Fix inventory-graph tracking: new dist/ build outputs and their TypeScript
  source were not git-tracked, causing package builds from isolated snapshots
  to silently omit the new module (npm-package-bin-surface.test.ts now 17/17)
- Fix and reconcile ~30 Darwin canonical-path (/private/var vs /var) test
  fixtures, hermetic state-isolation fixtures, and raw-template-import fixtures
  across installer, session-end, team, workflow, and tools test suites
- Regenerate inventory-graph provenance against verified upstream ancestor
  (023d56ca5), fixing both local and upstream CI inventory-provenance failures

Known limitation (not fixed, documented): macOS graph-runtime and named-workflow
tests (288 of 290 remaining failures) require /dev/fd/<fd> directory-anchored
FD containment, which has no safe JS-only Node.js primitive (confirmed: no
openat/mkdirat/*at() family exposed by Node's fs binding) and would require a
native addon, which is out of scope for this change. Linux CI remains
unaffected. The other 2 failures are confirmed parallel-load timing flakes
that pass cleanly in isolation.

Merges origin/dev (023d56ca5) via prior commit 64a1cde67.
2026-09-11 11:56:56 +09:00

24 lines
835 B
JavaScript
Executable File

#!/usr/bin/env node
import { readSessionEndFrame } from './lib/stdin.mjs';
import { isMainThread } from 'node:worker_threads';
import { fileURLToPath } from 'node:url';
import { resolve } from 'node:path';
const fallback = { continue: true, suppressOutput: true };
export async function runSessionEndHook() {
const frame = await readSessionEndFrame();
if (frame.status !== 'ok') {
console.log(JSON.stringify(fallback));
return;
}
try {
const { publishSessionEndBootstrap } = await import('../dist/hooks/session-end/foreground-bootstrap.js');
console.log(JSON.stringify(await publishSessionEndBootstrap(frame.value)));
} catch {
console.log(JSON.stringify(fallback));
}
}
if (!isMainThread || (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url))) void runSessionEndHook();