fix(orders): call the order-verbs by absolute path, not bare PATH names
board.sh's --dispatch --order-id thin starter told a dispatched session to run `coord-order-claim <id>` / `coord-order-done <id> ...` literally. Neither is on PATH, so step one was command-not-found - easy to misread as "the order does not exist" (Verifiseringsloven ansikt 4). Measuring the denominator beyond the one line the order named found the same defect in two more emitters that hand a session its own next-step text: coord-order-inbox.sh's SessionStart injection (every pending/claimed order, not only dispatched ones) and coord-order-claim.sh's own WHEN DONE / IF YOU CANNOT lines. All three now call the verb via $SELFDIR (derived from $0's directory, correct at emission time), and board.sh's interpolation of it is shell-clean-guarded like the other two values sharing its double-quoted position - reachability proven with a copy of board.sh run from a space-containing path, not asserted. board-selftest 239->246, orders-selftest 99->104. CLAUDE.md counts and a new F-paragraph updated to match. ORDRE 20260817T213139Z-643032142-from-.claude Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019syEQHvw2jf1dTR4bUPKRG
This commit is contained in:
parent
2928c28044
commit
393499c3ee
6 changed files with 130 additions and 11 deletions
35
CLAUDE.md
35
CLAUDE.md
|
|
@ -82,7 +82,7 @@ marketplace plugin. Three components, one boundary:
|
|||
mailbox, `~/.claude/coord/<repo>/orders/`, with four one-verb scripts —
|
||||
`coord-order-send.sh` (write), `coord-order-inbox.sh` (read for injection),
|
||||
`coord-order-claim.sh` (claim), `coord-order-done.sh` (terminal state).
|
||||
Pinned by `orders-selftest.sh` (99 checks).
|
||||
Pinned by `orders-selftest.sh` (104 checks).
|
||||
|
||||
**It is a separate CHANNEL, not more mail, and the axis is authorization.**
|
||||
Inbox content is untrusted cross-repo data that may never instruct a session
|
||||
|
|
@ -128,6 +128,33 @@ marketplace plugin. Three components, one boundary:
|
|||
reason is "trust me" and would quietly become the cheapest way to close any
|
||||
order. The reason is written INTO the order, so the next session that picks
|
||||
it up sees why the last one put it down.
|
||||
|
||||
**ORDRE 65 (.claude, 2026-08-17): the verbs told a session to run themselves
|
||||
by a BARE name, and neither is on PATH.** `board.sh`'s dispatch starter
|
||||
(`--dispatch --order-id`) told a dispatched session to run `coord-order-claim
|
||||
<id>` and `coord-order-done <id> ...` literally — command-not-found on step
|
||||
one, misreadable as "the order does not exist" (Verifiseringsloven ansikt 4).
|
||||
Measuring the denominator (the order asked only about `board.sh`, but the
|
||||
defect is a class, not one line) found the SAME bare name in two more places
|
||||
that print text a session is meant to execute next: `coord-order-inbox.sh`'s
|
||||
SessionStart injection (the `-> claim:` / `-> in flight` hints shown for
|
||||
EVERY pending/claimed order, not only a dispatched one) and
|
||||
`coord-order-claim.sh`'s own `WHEN DONE` / `IF YOU CANNOT` lines, printed
|
||||
directly to the session that just claimed. All three now call the verb by
|
||||
the absolute path SIBLING TO THE PRINTING SCRIPT ITSELF (`$SELFDIR`, derived
|
||||
from `$0`'s directory — the same technique `route.sh`'s own path already
|
||||
uses in `board.sh`), not a literal version string: correct at the moment the
|
||||
text is generated, for whichever install location is live then. It does not
|
||||
survive a version bump landing between generation and paste — a plan-file
|
||||
form held across a release can still go stale, the same way any other path
|
||||
baked into a plan file would. `board.sh`'s `$SELFDIR` interpolation sits in
|
||||
the exact double-quoted position `--prompt-file`/`--order-id` are already
|
||||
shell-clean-checked in, so it got the identical guard — proven reachable
|
||||
(not speculative) by invoking a COPY of `board.sh` from a directory whose
|
||||
path contains a space, mirroring the fixture the `--prompt-file` tests
|
||||
already use for the same reason. `coord-inbox.sh`/`coord-send.sh`/
|
||||
`coord-done.sh` remain undisturbed: they have only ever been documented as
|
||||
bare names in prose a human reads, never in text a session is handed to run.
|
||||
- **Hook (`hooks/scripts/session-start.mjs`):** thin zero-dependency Node
|
||||
wrapper (marketplace convention: hooks are `.mjs`) that calls
|
||||
`coord-inbox.sh` AND `coord-order-inbox.sh` and emits the
|
||||
|
|
@ -289,7 +316,7 @@ marketplace plugin. Three components, one boundary:
|
|||
- **Board (`scripts/board.sh`):** cross-repo attention board. Reads STATE.md
|
||||
next-step blocks + board lines, `git status`, and mailbox pending counts, and
|
||||
prints one line per repo. Read-only by construction: it writes to no repo, no
|
||||
STATE.md and no mailbox. Pinned by `board-selftest.sh` (217 checks).
|
||||
STATE.md and no mailbox. Pinned by `board-selftest.sh` (246 checks).
|
||||
|
||||
**It lives here because the mailbox is one of its three inputs, and it carries
|
||||
the same axis distinction the mailbox does.** A pending count means *others
|
||||
|
|
@ -715,9 +742,9 @@ obligations in another repo.
|
|||
builtins only in hook and tests.
|
||||
- TDD: no behavior change without a failing selftest check first.
|
||||
`bash scripts/coord-selftest.sh` must exit 0 (220/220),
|
||||
`bash scripts/board-selftest.sh` must exit 0 (239/239),
|
||||
`bash scripts/board-selftest.sh` must exit 0 (246/246),
|
||||
`bash scripts/route-selftest.sh` must exit 0 (69/69),
|
||||
`bash scripts/orders-selftest.sh` must exit 0 (99/99) and
|
||||
`bash scripts/orders-selftest.sh` must exit 0 (104/104) and
|
||||
`bash scripts/state-line-guard-selftest.sh` must exit 0 (40/40).
|
||||
- English for all code, docs, and commit messages (public repo). Norwegian
|
||||
trigger aliases in the skill description are deliberate.
|
||||
|
|
|
|||
|
|
@ -1820,6 +1820,43 @@ printf '%s\n' "$d11" | grep -q "^paste=claude .*\"\$(cat $DSP)\""; check "dispat
|
|||
printf '%s\n' "$d11" | grep -qi 'exit'; check "dispatch: paste-only says the existing session must be exited first" $?
|
||||
printf '%s\n' "$d11" | grep -q 'plan_drop_open'; check "dispatch: paste-only names the filter that made this form necessary" $?
|
||||
|
||||
# --- The --order-id thin starter must call the verbs by an executable path ---
|
||||
# ORDRE 65 (.claude, 2026-08-17): the starter text told a dispatched session to
|
||||
# run `coord-order-claim <id>` and `coord-order-done <id> ...` as bare command
|
||||
# names. Neither is on PATH (only coord-send.sh/coord-inbox.sh/coord-done.sh
|
||||
# have ever been documented as bare names, and only in prose a human reads -
|
||||
# this string lands in argv and a SESSION executes it literally). The absolute
|
||||
# path is derived from where board.sh itself is running FROM ($0's directory,
|
||||
# the same $SELFDIR variable ROUTE already uses), not a literal "0.27.0" - so
|
||||
# it is correct at EMISSION time for whichever cache path is actually live
|
||||
# then. It does not survive a version bump landing between generation and
|
||||
# paste - a plan-file form held across a release can still go stale.
|
||||
mkdir -p "$CLAUDE_COORD_DIR/repo-a/orders"
|
||||
echo "order body" > "$CLAUDE_COORD_DIR/repo-a/orders/testorder1.md"
|
||||
d12="$("$BOARD" --roots "$ROOT" --dispatch --repo repo-a --order-id testorder1 --target-pane no $DSPTRAITS 2>/dev/null)"; rc=$?
|
||||
[ "$rc" -eq 0 ]; check "dispatch --order-id: exits 0 for a pending order" $?
|
||||
# Anchored to `bash /` (not just `/scripts/...`) so a RELATIVE path (which
|
||||
# would also contain the substring "/scripts/coord-order-claim.sh") cannot
|
||||
# pass this check - the property being tested is "absolute", not "has slashes".
|
||||
printf '%s\n' "$d12" | grep -Eq 'command=.*bash /.*/scripts/coord-order-claim\.sh testorder1'; check "dispatch --order-id: starter calls coord-order-claim.sh by an ABSOLUTE script path, not a bare PATH name" $?
|
||||
printf '%s\n' "$d12" | grep -Eq 'command=.*bash /.*/scripts/coord-order-done\.sh testorder1 --commit'; check "dispatch --order-id: starter calls coord-order-done.sh by an ABSOLUTE script path, not a bare PATH name" $?
|
||||
printf '%s\n' "$d12" | grep -Eq '(^|[^./])coord-order-claim testorder1'; [ $? -ne 0 ]; check "dispatch --order-id: no bare, un-pathed coord-order-claim invocation survives in the starter" $?
|
||||
printf '%s\n' "$d12" | grep -Eq '(^|[^./])coord-order-done testorder1'; [ $? -ne 0 ]; check "dispatch --order-id: no bare, un-pathed coord-order-done invocation survives in the starter" $?
|
||||
|
||||
# --- The $SELFDIR interpolation is shell-clean-guarded like $D_PROMPT/$D_ORDER ---
|
||||
# It is install-location-derived, not operator input, but it lands in the
|
||||
# EXACT SAME double-quoted position in $d_full as those two - so a mis-
|
||||
# installed path containing a space would silently break the pasted command
|
||||
# the same way an unchecked --prompt-file would. Verified REACHABLE (not
|
||||
# speculative): copy board.sh + route.sh into a directory whose path contains
|
||||
# a space and invoke the COPY, so $0's own directory is genuinely unclean.
|
||||
SPACEDIR="$ROOT/dir with space/scripts"
|
||||
mkdir -p "$SPACEDIR"
|
||||
cp "$BOARD" "$DIR/route.sh" "$SPACEDIR/" && chmod +x "$SPACEDIR/board.sh" "$SPACEDIR/route.sh"
|
||||
d12b="$("$SPACEDIR/board.sh" --roots "$ROOT" --dispatch --repo repo-a --order-id testorder1 --target-pane no $DSPTRAITS 2>&1)"; rc=$?
|
||||
[ "$rc" -eq 2 ]; check "dispatch --order-id: refuses when board.sh's OWN directory is not shell-clean (a mis-installed path with a space)" $?
|
||||
printf '%s' "$d12b" | grep -q 'command='; [ $? -ne 0 ]; check "dispatch --order-id: emits no command when its own directory is not shell-clean" $?
|
||||
|
||||
/bin/rm -rf "$ROOT/dir with space" 2>/dev/null
|
||||
|
||||
# --- 19. The dispatch skill's own engine line ------------------------------
|
||||
|
|
|
|||
|
|
@ -863,7 +863,30 @@ dispatch() {
|
|||
# double quotes of the pasted command, so a quote, a $ or a backtick here
|
||||
# would be evaluated by the operator's shell. The order BODY has no such
|
||||
# restriction - it never passes through a shell at all.
|
||||
d_full="$d_cmd \"ORDRE $D_ORDER ligger i dette repoets ordrekoe. Gjor dette i rekkefolge: (1) claim den - coord-order-claim $D_ORDER - claim skriver ut hele ordreteksten, som bare bor der. (2) Sammenlign ordren mot STATE.md sin NESTE-blokk og uttal avviket i ditt FORSTE svar. (3) Utfor ordren. (4) Lukk den - coord-order-done $D_ORDER --commit HASH - eller gi den tilbake med --return --reason hvis den ikke kan utfores.\""
|
||||
#
|
||||
# ORDRE 65 (.claude, 2026-08-17): `coord-order-claim`/`coord-order-done`
|
||||
# are not on PATH - only coord-send.sh/coord-inbox.sh/coord-done.sh have
|
||||
# ever been documented as bare names, and only in prose a human reads. This
|
||||
# string lands in argv and a SESSION executes it literally, so the bare
|
||||
# name was command-not-found on step 1, misreadable as "the order does not
|
||||
# exist" (Verifiseringsloven ansikt 4). The fix calls both verbs by the
|
||||
# absolute path SIBLING TO THIS SCRIPT ($SELFDIR, derived from `$0` at
|
||||
# line ~197 - the SAME variable ROUTE already uses), not a literal version
|
||||
# string - so it is correct at EMISSION time for whichever cache path is
|
||||
# actually live then. It does not survive a version bump that lands
|
||||
# between generation and paste: a plan-file form held across a release
|
||||
# can still go stale, exactly like any other path baked into a plan file.
|
||||
#
|
||||
# $SELFDIR lands in the exact same double-quoted position as $D_PROMPT and
|
||||
# $D_ORDER above, both of which are shell-clean-checked before use - an
|
||||
# untrusted value there would let a quote/$/backtick escape the operator's
|
||||
# paste. $SELFDIR is not operator input, but the same guard is cheap
|
||||
# insurance against a mis-installed path with a space in it, so it gets
|
||||
# the identical check rather than a documented exemption.
|
||||
case "$SELFDIR" in
|
||||
*[!A-Za-z0-9/._-]*) echo "board: this script's own directory is not shell-clean, refusing to emit an order-id starter that would break the pasted command: $SELFDIR" >&2; exit 2 ;;
|
||||
esac
|
||||
d_full="$d_cmd \"ORDRE $D_ORDER ligger i dette repoets ordrekoe. Gjor dette i rekkefolge: (1) claim den - kjor bash $SELFDIR/coord-order-claim.sh $D_ORDER - claim skriver ut hele ordreteksten, som bare bor der. FULL STI ER MED VILJE: det bare navnet coord-order-claim er ikke i PATH. (2) Sammenlign ordren mot STATE.md sin NESTE-blokk og uttal avviket i ditt FORSTE svar. (3) Utfor ordren. (4) Lukk den med bash $SELFDIR/coord-order-done.sh $D_ORDER --commit HASH - eller gi den tilbake med --return --reason hvis den ikke kan utfores.\""
|
||||
fi
|
||||
|
||||
if [ "$D_PANE" = "no" ]; then
|
||||
|
|
|
|||
|
|
@ -22,6 +22,14 @@
|
|||
set -u
|
||||
export LC_ALL=C
|
||||
|
||||
# ORDRE 65 follow-on (.claude, 2026-08-17): the WHEN DONE / IF YOU CANNOT
|
||||
# lines below are handed directly to the CLAIMING session as its own
|
||||
# next-step instruction - the same bare-verb-name defect the order named in
|
||||
# board.sh's dispatch starter. SELFDIR mirrors that fix: derived from where
|
||||
# THIS script is running FROM ($0's directory), correct at the moment it
|
||||
# prints, for whichever install location is live then.
|
||||
SELFDIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
|
||||
COORD="${CLAUDE_COORD_DIR:-$HOME/.claude/coord}"
|
||||
|
||||
REPO=""; NEXT=0; ORDER_ID=""
|
||||
|
|
@ -98,8 +106,8 @@ echo "coord-order-claim: CLAIMED $ORDER_ID for $REPO. This order is yours until
|
|||
echo "BEFORE YOU START: read this repo's STATE.md NESTE block and compare it with the order below."
|
||||
echo "If they are different tasks, say so in your FIRST reply, in one line:"
|
||||
echo " \"order $ORDER_ID displaces NESTE <what NESTE says>; <that> stands as next after\"."
|
||||
echo "WHEN DONE: coord-order-done $ORDER_ID --commit <hash> (or --no-commit --reason \"<why>\")"
|
||||
echo "IF YOU CANNOT: coord-order-done $ORDER_ID --return --reason \"<why>\" - it goes back to the queue."
|
||||
echo "WHEN DONE: bash $SELFDIR/coord-order-done.sh $ORDER_ID --commit <hash> (or --no-commit --reason \"<why>\")"
|
||||
echo "IF YOU CANNOT: bash $SELFDIR/coord-order-done.sh $ORDER_ID --return --reason \"<why>\" - it goes back to the queue."
|
||||
echo "--- order $ORDER_ID ---"
|
||||
cat "$CLAIMED/$ORDER_ID.md"
|
||||
echo "--- end of order $ORDER_ID ---"
|
||||
|
|
|
|||
|
|
@ -22,6 +22,17 @@
|
|||
set -u
|
||||
export LC_ALL=C
|
||||
|
||||
# ORDRE 65 (.claude, 2026-08-17): `coord-order-claim`/`coord-order-done` are
|
||||
# not on PATH. This block is injected verbatim at SessionStart as
|
||||
# additionalContext - a session reading it may run the shown command via its
|
||||
# own Bash tool, so a bare verb name is command-not-found on the very first
|
||||
# try, misreadable as "the order does not exist" (Verifiseringsloven ansikt
|
||||
# 4). SELFDIR is derived from where THIS script is actually running FROM
|
||||
# ($0's directory), the same technique board.sh uses for its dispatch
|
||||
# starter - correct at the moment this text is generated, for whichever
|
||||
# install location is live then.
|
||||
SELFDIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
|
||||
COORD="${CLAUDE_COORD_DIR:-$HOME/.claude/coord}"
|
||||
|
||||
REPO=""
|
||||
|
|
@ -86,7 +97,7 @@ subject: ${subj}"
|
|||
[ -n "$ret" ] && OUT="${OUT}
|
||||
returned earlier: ${ret}"
|
||||
OUT="${OUT}
|
||||
-> claim: coord-order-claim ${id} | leave it: say to the operator why
|
||||
-> claim: bash $SELFDIR/coord-order-claim.sh ${id} | leave it: say to the operator why
|
||||
"
|
||||
PENDING=$((PENDING + 1))
|
||||
done
|
||||
|
|
@ -105,7 +116,7 @@ if [ -d "$CLAIMED" ]; then
|
|||
OUT="${OUT}
|
||||
--- order: ${id} (from ${from}, CLAIMED ${cage}d ago) ---
|
||||
subject: ${subj}
|
||||
-> in flight. If no session is working it, put it back: coord-order-done ${id} --return --reason \"<why>\"
|
||||
-> in flight. If no session is working it, put it back: bash $SELFDIR/coord-order-done.sh ${id} --return --reason \"<why>\"
|
||||
"
|
||||
CLAIMED_N=$((CLAIMED_N + 1))
|
||||
done
|
||||
|
|
|
|||
|
|
@ -66,7 +66,13 @@ r2="$("$READ" --repo fake-repo)"; rc=$?
|
|||
printf '%s' "$r2" | grep -q "2 pending"; check "read reports the pending count" $?
|
||||
printf '%s' "$r2" | grep -q "order one"; check "read shows the subject" $?
|
||||
printf '%s' "$r2" | grep -q "dispatcher"; check "read shows the sender" $?
|
||||
printf '%s' "$r2" | grep -q "coord-order-claim $oid1"; check "read gives a per-order claim hint" $?
|
||||
# ORDRE 65 follow-on (2026-08-17): this is the SessionStart injection - the
|
||||
# same bare-name defect the order named in board.sh's dispatch starter also
|
||||
# lived here, and arguably worse: it fires on every session with a pending
|
||||
# order, not only a dispatched one (this is the literal text this session saw
|
||||
# at its own start). Pinned by absolute path, exactly like board.sh's fix.
|
||||
printf '%s' "$r2" | grep -qF "bash $DIR/coord-order-claim.sh $oid1"; check "read gives a per-order claim hint by an ABSOLUTE script path, not a bare PATH name" $?
|
||||
printf '%s' "$r2" | grep -Eq "(^|[^./])coord-order-claim $oid1"; [ $? -ne 0 ]; check "read: no bare, un-pathed coord-order-claim invocation survives the injection" $?
|
||||
# The order body is deliberately NOT injected: an order can be a full session
|
||||
# prompt, and the queue view has to stay readable at session start. The text
|
||||
# arrives at claim time, from the one place it lives.
|
||||
|
|
@ -94,6 +100,12 @@ c3="$("$CLAIM" --repo fake-repo "$oid1" 2>&1)"; rc=$?
|
|||
[ "$rc" -eq 0 ]; check "claim exits 0" $?
|
||||
printf '%s' "$c3" | grep -q "do the thing"; check "claim prints the full order body" $?
|
||||
printf '%s' "$c3" | grep -q "NESTE"; check "claim instructs the D-check against STATE's NESTE" $?
|
||||
# ORDRE 65 follow-on: the claim's own "WHEN DONE"/"IF YOU CANNOT" lines are the
|
||||
# THIRD live emitter of the same bare-name defect - the text handed directly
|
||||
# to the claiming session as its own next-step instruction.
|
||||
printf '%s' "$c3" | grep -qF "WHEN DONE: bash $DIR/coord-order-done.sh $oid1 --commit"; check "claim's WHEN DONE line calls coord-order-done.sh by an ABSOLUTE script path" $?
|
||||
printf '%s' "$c3" | grep -qF "IF YOU CANNOT: bash $DIR/coord-order-done.sh $oid1 --return"; check "claim's IF YOU CANNOT line calls coord-order-done.sh by an ABSOLUTE script path" $?
|
||||
printf '%s' "$c3" | grep -Eq "(^|[^./])coord-order-done $oid1"; [ $? -ne 0 ]; check "claim output: no bare, un-pathed coord-order-done invocation" $?
|
||||
[ ! -e "$of1" ]; check "claimed order leaves the pending queue" $?
|
||||
[ -f "$CLAUDE_COORD_DIR/fake-repo/orders/claimed/$oid1.md" ]; check "claimed order lands in orders/claimed" $?
|
||||
|
||||
|
|
@ -109,7 +121,8 @@ check "re-claiming an already claimed order exits 1" $?
|
|||
r3="$("$READ" --repo fake-repo)"
|
||||
printf '%s' "$r3" | grep -q "1 claimed"; check "read reports the claimed count" $?
|
||||
printf '%s' "$r3" | grep -q "CLAIMED"; check "read shows a claimed order as in flight" $?
|
||||
printf '%s' "$r3" | grep -q "coord-order-done $oid1 --return"; check "read gives the return hint for a claimed order" $?
|
||||
printf '%s' "$r3" | grep -qF "bash $DIR/coord-order-done.sh $oid1 --return"; check "read gives the return hint for a claimed order by an ABSOLUTE script path" $?
|
||||
printf '%s' "$r3" | grep -Eq "(^|[^./])coord-order-done $oid1 --return"; [ $? -ne 0 ]; check "read: no bare, un-pathed coord-order-done invocation survives the in-flight hint" $?
|
||||
|
||||
# --next takes the oldest pending order, so a session never has to parse the
|
||||
# queue to obey it.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue