session-orchestrator 4.1.0 → 5.0.0

package/hooks/_lib/vcs-create-matcher.mjs

@@ -53,8 +53,9 @@
  *             a spaced subshell is a statement like any other. "Resolved verb"
  *             means: after leading `VAR=value` assignments, after transparent
  *             process wrappers (`nohup`, `command`, `sudo`, `env`, `timeout`,
- *             `xargs`, `exec`), and basename-normalised, so an absolute path
- *             (`/opt/homebrew/bin/glab`) resolves to `glab` (#1145).
+ *             `exec`), and basename-normalised, so an absolute path
+ *             (`/opt/homebrew/bin/glab`) resolves to `glab` (#1145). `xargs` is
+ *             NOT one of those wrappers — see the named ceiling below.
  *   NO MATCH: the words inside a quoted string, a `#` comment, or a here-doc
  *             body (they are data, not a command); a single token that merely
  *             CONTAINS the three words (`"glab issue create"` runs a binary of
@@ -95,6 +96,28 @@
  *     triage of a per-session counter file
  *     (`.orchestrator/runtime/issue-budget/<hash>.json`, #1141) or in a
  *     transcript census of real create calls.
+ *   - An `xargs`-driven create is NOT matched, and `xargs` is deliberately not
+ *     a transparent wrapper: `command-blocker.mjs` classes it as an INTERPRETER
+ *     (`SHELL_EXEC_INTERPRETERS`), because unwrapping it there would LOOSEN the
+ *     destructive-command guard that shares this lexer. Measured 2026-09-09
+ *     against this file — all four shapes yield 0 statements, so neither the
+ *     cap nor the loop-deny sees them:
+ *
+ *         xargs glab issue create --title X                          → 0
+ *         echo X | xargs -I% glab issue create --title %             → 0
+ *         seq 1 50 | xargs -I% gh api -X POST …/issues -f title=%    → 0
+ *         xargs -n1 glab issue create                                → 0
+ *
+ *     Widening this one shape means changing what `resolveSegmentVerb` reports
+ *     for `xargs` — read by the four OTHER consumers of that resolver
+ *     (`grep -rln resolveSegmentVerb scripts/ hooks/`, 2026-09-09:
+ *     `scripts/lib/project-hygiene.mjs`, `scripts/lib/scope-gate.mjs`,
+ *     `hooks/pre-bash-sessions-ledger-guard.mjs`,
+ *     `hooks/pre-bash-destructive-guard.mjs`) — so it is a deliberate
+ *     cross-consumer change, never a local patch here.
+ *     Pinned by `tests/hooks/vcs-create-matcher.test.mjs`. Revisit when an
+ *     `xargs`-driven create shows up in a transcript census or in the overflow
+ *     triage of a per-session counter file.
  *   - A paren glued to the verb (`(glab issue create …)`) is not reached: it
  *     lexes as the single word `(glab`. This is `command-blocker.mjs`'s own
  *     named ceiling on `COMMAND_POSITION_KEYWORDS` (#1145), inherited here
@@ -205,9 +228,115 @@ function matchReading(verb, tokens, index) {
     host: m[1] === 'gh' ? 'github' : 'gitlab',
     kind: /** @type {'pr'|'mr'|'issue'} */ (m[2]),
     verb: /** @type {'create'|'new'} */ (m[3]),
+    via: /** @type {'cli'} */ ('cli'),
   };
 }
 
+/**
+ * A REST path whose LAST segment is `issues` — the issue COLLECTION endpoint,
+ * which is the only one a POST creates an issue on.
+ *
+ * Deliberately anchored at the end (`?` allowed for a query string): the
+ * sub-resources `.../issues/12/notes` and `.../issues/12` are a comment and an
+ * update, neither of which creates an issue. Matching them would charge the cap
+ * for a note.
+ */
+const ISSUE_COLLECTION_PATH = /(^|\/)issues(\?|$)/;
+
+/** `-f` / `-F` / `--field` / `--raw-field` — the payload flags both CLIs take. */
+const FIELD_FLAGS = new Set(['-f', '-F', '--field', '--raw-field']);
+
+/**
+ * Recognise the REST-API route to issue creation: `gh api` / `glab api`
+ * against an `/issues` collection path (#1163 BUG-2).
+ *
+ * ## Why this is not an optional extra
+ *
+ * Measured 2026-09-09 over a 13-shape census of the matcher: every `api` form
+ * was a MISS, i.e. a COMPLETE silent bypass of the issue-budget cap and of the
+ * templates-first gate —
+ *
+ *     glab api --method POST projects/1/issues -f title=X   → isIssueCreate false
+ *     gh api repos/o/r/issues -f title=X                     → isIssueCreate false
+ *     gh api -X POST repos/o/r/issues -f title=X             → isIssueCreate false
+ *
+ * All three file a real issue. The subcommand route (`glab issue create`) was
+ * gated from the start, so an agent that hit the cap could reach the same
+ * effect through `api` with no counter moving at all.
+ *
+ * ## The narrow shape (guard-design: widen the matcher, not the bypass)
+ *
+ * A LIST call must not match — `gh api repos/o/r/issues` is the single most
+ * common read in this repo's own tooling, and charging it would make the cap
+ * fire on reads. So the accepted shape is: verb `gh`/`glab`, next token `api`,
+ * an `/issues` COLLECTION path somewhere in the argument list, AND either
+ *   - an explicit POST method (`--method POST`, `--method=POST`, `-X POST`,
+ *     `-XPOST`), or
+ *   - a `title=` payload field (`-f title=…`), which only a create carries.
+ * An explicit NON-POST method (`--method GET`, `-X PATCH`) is a hard NO-MATCH
+ * even when a `title=` field is present: an update is not a creation.
+ *
+ * `--help` short-circuits here exactly as it does for the subcommand route.
+ *
+ * NAMED CEILING (BV-004): the payload flags are read as `-f title=…` token
+ * pairs and `--field=title=…` is NOT recognised (neither CLI accepts that
+ * spelling today). A create whose whole body arrives via `--input -` on stdin
+ * matches only through the explicit POST method, which is the shape both CLIs
+ * require for that form. Revisit if a census of real create calls shows an
+ * `api` shape reaching neither condition.
+ *
+ * @param {string} verb — basename-normalised verb from resolveSegmentVerb
+ * @param {Array<{ text: string, quoted: boolean }>} tokens — the whole statement
+ * @param {number} index — token index the verb resolved to
+ * @returns {{ host: 'github'|'gitlab', kind: 'issue', verb: 'create', via: 'api' } | null}
+ */
+function matchApiReading(verb, tokens, index) {
+  if (verb !== 'gh' && verb !== 'glab') return null;
+  const sub = tokens[index + 1];
+  if (!sub || sub.quoted || sub.text !== 'api') return null;
+
+  let method = null;
+  let hasTitleField = false;
+  let issuePath = false;
+
+  for (let i = index + 2; i < tokens.length; i++) {
+    const tok = tokens[i];
+    const text = tok.text;
+    if (!tok.quoted && text === '--help') return null;
+    if (!tok.quoted && (text === '--method' || text === '-X')) {
+      method = tokens[i + 1]?.text ?? '';
+      i += 1;
+      continue;
+    }
+    if (!tok.quoted && text.startsWith('--method=')) {
+      method = text.slice('--method='.length);
+      continue;
+    }
+    if (!tok.quoted && text.startsWith('-X') && text.length > 2) {
+      method = text.slice(2);
+      continue;
+    }
+    if (!tok.quoted && FIELD_FLAGS.has(text)) {
+      const value = tokens[i + 1]?.text ?? '';
+      if (value.startsWith('title=')) hasTitleField = true;
+      i += 1;
+      continue;
+    }
+    // A path is an operand, quoted or not — `gh api "repos/o/r/issues"` is the
+    // same call as the bare form, and quoting an operand is not concealment the
+    // way quoting a whole COMMAND is.
+    if (ISSUE_COLLECTION_PATH.test(text)) issuePath = true;
+  }
+
+  if (!issuePath) return null;
+  if (method !== null) {
+    if (!/^post$/i.test(method)) return null;
+  } else if (!hasTitleField) {
+    return null;
+  }
+  return { host: verb === 'gh' ? 'github' : 'gitlab', kind: 'issue', verb: 'create', via: 'api' };
+}
+
 /**
  * Test one statement's token array against {@link CREATE_REGEX}, reading the
  * head at the RESOLVED verb index rather than at token 0 (#1145).
@@ -233,7 +362,9 @@ function matchStatement(tokens) {
   }
   for (const reading of [resolved, resolved.alt]) {
     if (!reading || typeof reading.verb !== 'string' || reading.index < 0) continue;
-    const shape = matchReading(reading.verb, tokens, reading.index);
+    const shape =
+      matchReading(reading.verb, tokens, reading.index) ??
+      matchApiReading(reading.verb, tokens, reading.index);
     if (shape) return shape;
   }
   return null;
@@ -267,9 +398,274 @@ function findCreateStatement(command) {
  *   `null` when no statement in the command is a `gh`/`glab` create/new call.
  */
 export function matchVcsCreate(command) {
-  return findCreateStatement(command)?.shape ?? null;
+  const shape = findCreateStatement(command)?.shape;
+  if (!shape) return null;
+  // The `via` marker is deliberately NOT part of THIS return shape: the sibling
+  // suite `tests/unit/hook-issue-budget.test.mjs` pins it by `toEqual` on the
+  // exact three keys, and a fourth key would fail those assertions without any
+  // behaviour changing. Consumers that need the route ask
+  // {@link findIssueCreateStatements}, which carries it.
+  return { host: shape.host, kind: shape.kind, verb: shape.verb };
+}
+
+/**
+ * Read the `--title` (subcommand route) or `-f title=…` (api route) value off
+ * ONE statement's tokens.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} tokens
+ * @returns {string|null}
+ */
+function titleFromTokens(tokens) {
+  for (let i = 0; i < tokens.length; i++) {
+    const text = tokens[i].text;
+    if (text === '--title') {
+      const value = tokens[i + 1]?.text;
+      return typeof value === 'string' ? value.trim() || null : null;
+    }
+    if (text.startsWith('--title=')) {
+      return text.slice('--title='.length).trim() || null;
+    }
+    if (FIELD_FLAGS.has(text)) {
+      const value = tokens[i + 1]?.text ?? '';
+      if (value.startsWith('title=')) return value.slice('title='.length).trim() || null;
+      i += 1;
+    }
+  }
+  return null;
+}
+
+/**
+ * Per-host CLI flag names for the non-title fields of an issue-create
+ * statement (#1314). Verified against the CLIs' own `--help` (2026-09-12):
+ *   glab issue create: `-t --title`, `-d --description`, `--description-file`, `-R --repo`
+ *   gh issue create:   `-t, --title`, `-b, --body`, `-F, --body-file`, `-R, --repo`
+ * Read only on the subcommand route — on the api route `-F` is a field flag.
+ */
+const CLI_FLAGS = {
+  gitlab: { description: ['-d', '--description'], descriptionFile: ['--description-file'], repo: ['-R', '--repo'] },
+  github: { description: ['-b', '--body'], descriptionFile: ['-F', '--body-file'], repo: ['-R', '--repo'] },
+};
+
+/** `$(cat <path>)` as ONE value — the only command substitution resolved. */
+const CAT_SUBST_RE = /^\$\(cat\s+(\S+)\)$/;
+
+/**
+ * Read the value of a flag in `names` (`--x v`, `--x=v`, `-x v`). When the flag
+ * repeats, the LAST value wins — the pflag semantics `gh`/`glab` apply.
+ * An UNQUOTED `$(cat p)` is split by the lexer into `$(cat` + `p)`; that pair is
+ * rejoined so the substitution survives, in both the `--x $(cat p)` and the
+ * `--x=$(cat p)` spelling.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} tokens
+ * @param {string[]} names
+ * @returns {string|null}
+ */
+function flagValue(tokens, names) {
+  let found = null;
+  for (let i = 0; i < tokens.length; i++) {
+    const text = tokens[i].text;
+    for (const name of names) {
+      let value;
+      if (text === name) {
+        value = tokens[i + 1]?.text;
+        if (typeof value !== 'string') return found;
+        i += 1;
+      } else if (name.startsWith('--') && text.startsWith(`${name}=`)) {
+        value = text.slice(name.length + 1);
+      } else {
+        continue;
+      }
+      if (value === '$(cat' && typeof tokens[i + 1]?.text === 'string') {
+        value = `$(cat ${tokens[i + 1].text}`;
+        i += 1;
+      }
+      found = value;
+      break;
+    }
+  }
+  return found;
 }
 
+/**
+ * The paths of every `$(cat <path>)` that sits inside SINGLE quotes in the RAW
+ * command. The lexer marks single- and double-quoted tokens alike, but only
+ * the double-quoted (or bare) form is expanded by the shell — inside single
+ * quotes `gh`/`glab` receive the literal text, so reading that file would park
+ * content the CLI never saw (`-d '$(cat .env)'`).
+ *
+ * @param {string} command — the raw command, quotes intact
+ * @returns {Set<string>}
+ */
+function singleQuotedCatPaths(command) {
+  const out = new Set();
+  let quote = null;
+  let span = '';
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (quote === "'") {
+      if (c === "'") {
+        for (const m of span.matchAll(/\$\(cat\s+(\S+)\)/g)) out.add(m[1]);
+        quote = null;
+        span = '';
+      } else {
+        span += c;
+      }
+    } else if (c === '\\') {
+      i += 1; // an escaped char opens no quote
+    } else if (quote === '"') {
+      if (c === '"') quote = null;
+    } else if (c === "'" || c === '"') {
+      quote = c;
+    }
+  }
+  return out;
+}
+
+/**
+ * Title, description, description file and target repo of ONE create
+ * statement (#1314) — what a parked overflow record needs to be re-filed.
+ * Additive to {@link titleFromTokens}: its `--title` / `-f title=` reading is
+ * kept verbatim; `-t` is added on the subcommand route only.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} tokens
+ * @param {{ host: string, via: string }} shape
+ * @param {Set<string>} literalCatPaths — from {@link singleQuotedCatPaths}
+ * @returns {{ title: string|null, description: string|null,
+ *             descriptionFile: string|null, repo: string|null }}
+ */
+function fieldsFromTokens(tokens, shape, literalCatPaths) {
+  let title = titleFromTokens(tokens);
+  const flags = shape.via === 'cli' ? CLI_FLAGS[shape.host] : undefined;
+  if (!flags) return { title, description: null, descriptionFile: null, repo: null };
+  if (title === null) title = flagValue(tokens, ['-t'])?.trim() || null;
+  let description = flagValue(tokens, flags.description);
+  let descriptionFile = flagValue(tokens, flags.descriptionFile);
+  // `-` means stdin (or an editor for glab -d) — nothing a later read can reach.
+  if (descriptionFile === '-') descriptionFile = null;
+  if (description === '-') description = null;
+  // A single-quoted `$(cat p)` stays the literal text the CLI files.
+  const subst = typeof description === 'string' ? CAT_SUBST_RE.exec(description) : null;
+  if (subst && !literalCatPaths.has(subst[1])) {
+    description = null;
+    descriptionFile ??= subst[1];
+  }
+  const fileSubst = typeof descriptionFile === 'string' ? CAT_SUBST_RE.exec(descriptionFile) : null;
+  if (fileSubst) descriptionFile = literalCatPaths.has(fileSubst[1]) ? null : fileSubst[1];
+  return { title, description, descriptionFile, repo: flagValue(tokens, flags.repo) };
+}
+
+/**
+ * EVERY issue-create statement in the command chain, in source order (#1163
+ * BUG-1).
+ *
+ * ## Why the callers cannot keep using {@link isIssueCreate} alone
+ *
+ * `isIssueCreate` answers "does this command create an issue?" — a BOOLEAN,
+ * which is exactly one issue short of what a QUANTITY gate needs. Measured
+ * 2026-09-09 against `hooks/pre-bash-issue-budget.mjs` before this change:
+ * `glab issue create --title A && glab issue create --title B` charged the cap
+ * ONCE for TWO issues, because the hook called `chargeIssueBudget` once per
+ * Bash tool call with the whole command string. The segmentation to answer it
+ * correctly was already here — nothing consumed it per statement.
+ *
+ * Each record carries the tokens the caller must judge (never the whole
+ * command): a chain may mix an exempt create with a chargeable one, and
+ * classifying the exemption on the joined command text would exempt BOTH —
+ * the same class of hole as the bypass-scoping regression documented on
+ * {@link matchesBypass}.
+ *
+ * `text` is the statement rebuilt from its tokens (quotes already resolved by
+ * the lexer, arguments joined by single spaces). It is a CLASSIFICATION INPUT
+ * for `classifyExemption`, never something to re-execute.
+ *
+ * `cwdChanged` is true when an EARLIER statement of the same chain is a
+ * `cd`/`pushd`/`popd`: a relative description-file path is then relative to a
+ * directory this hook cannot know, so `buildOverflowRecord` must not resolve it.
+ *
+ * @param {string} command
+ * @returns {Array<{ shape: { host: string, kind: string, verb: string, via: string },
+ *                   tokens: Array<{ text: string, quoted: boolean }>,
+ *                   text: string,
+ *                   title: string|null,
+ *                   description: string|null,
+ *                   descriptionFile: string|null,
+ *                   repo: string|null,
+ *                   cwdChanged: boolean }>}
+ */
+export function findIssueCreateStatements(command) {
+  const out = [];
+  let literalCatPaths = null;
+  let cwdChanged = false;
+  for (const tokens of statementsOf(command)) {
+    const shape = matchStatement(tokens);
+    if (!shape || shape.kind !== 'issue') {
+      if (!cwdChanged && tokens.length > 0) {
+        try {
+          cwdChanged = CWD_VERBS.has(resolveSegmentVerb(tokens).verb);
+        } catch {
+          cwdChanged = true; // unknown → do not trust a relative path
+        }
+      }
+      continue;
+    }
+    literalCatPaths ??= singleQuotedCatPaths(command);
+    out.push({
+      shape,
+      tokens,
+      text: tokens.map((t) => t.text).join(' '),
+      ...fieldsFromTokens(tokens, shape, literalCatPaths),
+      cwdChanged,
+    });
+  }
+  return out;
+}
+
+/**
+ * Do the issue-create statements account for the WHOLE command? (#1347)
+ *
+ * ## Why a refund needs this and a charge does not
+ *
+ * The charge is per statement and runs BEFORE the command, so it never has to
+ * ask what else is in the chain. The refund runs AFTER, and the harness reports
+ * ONE exit code for the whole Bash call — so a failure signal on
+ * `glab issue create --title X && false` says nothing about the create. Measured
+ * 2026-09-13 against the first cut of `hooks/post-bash-issue-budget-refund.mjs`:
+ * that exact command CREATES the issue, exits 1, and one slot was handed back.
+ * Refunding a create whose failure is not attributable to it is a cap drain, so
+ * the refund hook asks this question first and no-ops when the answer is false.
+ *
+ * True only when the command has at least one issue-create statement and EVERY
+ * statement of the chain is one. A chain that mixes a create with anything else
+ * — including a benign-looking `cd`, `echo`, or `true` — is not attributable
+ * here, which is the fail-CLOSED direction: the slot stays spent.
+ *
+ * NAMED CEILING (BV-004): the most common agent shape `cd <repo> && glab issue
+ * create …` is therefore NOT refundable, even though a failing `cd` provably
+ * means the create never ran. Admitting a prefix class would also admit a
+ * TRAILING one under the same argument, and a trailing statement's failure is
+ * exactly the drain above. Revisit if the refund rate measured over
+ * `.orchestrator/runtime/issue-budget/<hash>.json` charges shows the `cd` shape
+ * dominating; the safe widening is a LEADING-only allowance for `CWD_VERBS`,
+ * never a general one.
+ *
+ * @param {string} command
+ * @returns {boolean}
+ */
+export function statementsCoverWholeCommand(command) {
+  const all = statementsOf(command);
+  if (all.length === 0) return false;
+  let creates = 0;
+  for (const tokens of all) {
+    const shape = matchStatement(tokens);
+    if (!shape || shape.kind !== 'issue') return false;
+    creates += 1;
+  }
+  return creates > 0;
+}
+
+/** Builtins that move the shell's working directory for later statements. */
+const CWD_VERBS = new Set(['cd', 'pushd', 'popd']);
+
 /**
  * Determine which host the command targets. `gh` → "github", `glab` → "gitlab".
  * Thin wrapper kept for call-site readability in pre-bash-templates-first.mjs.
@@ -463,16 +859,5 @@ export function extractTitle(command) {
 
   const found = findCreateStatement(command);
   const tokens = found ? found.tokens : statementsOf(command).flat();
-
-  for (let i = 0; i < tokens.length; i++) {
-    const text = tokens[i].text;
-    if (text === '--title') {
-      const value = tokens[i + 1]?.text;
-      return typeof value === 'string' ? value.trim() || null : null;
-    }
-    if (text.startsWith('--title=')) {
-      return text.slice('--title='.length).trim() || null;
-    }
-  }
-  return null;
+  return titleFromTokens(tokens);
 }

package/hooks/enforce-scope.mjs

@@ -22,6 +22,11 @@
  *       Runs before G6 so a deliberate out-of-repo grant (e.g. a vault path)
  *       is reachable at all — G6 would otherwise deny every out-of-repo path
  *       without ever consulting allowedPaths. See matchesAbsoluteAllowlist.
+ *   G5c (#1295) out-of-root carveout for THIS repo's Claude Code auto-memory
+ *       directory (`~/.claude/projects/<encoded-repo-path>/memory/`). Harness-
+ *       owned, lives outside the working copy, cannot collide with any wave
+ *       scope. Evaluated inside G6's out-of-root branch only; a SIBLING repo's
+ *       memory dir and every other out-of-repo path stay denied.
  *   G6  resolved path inside project root
  *   G7  relative path matches an allowedPaths pattern
  *   G8  (all passed) → allow
@@ -432,6 +437,73 @@ async function main() {
 
   // Gate 6: path must be inside the project root
   if (!isPathInside(resolvedPath, projectRoot)) {
+    // Gate 5c (#1295) — THIS repo's harness auto-memory directory.
+    //
+    // Claude Code writes its own auto-memory (`MEMORY.md` + per-fact files)
+    // OUTSIDE the working copy, at
+    // `~/.claude/projects/<encoded-repo-path>/memory/`. Every wave manifest
+    // therefore blocked the coordinator's memory writes until the manifest was
+    // torn down — six sessions in a consumer repo re-documented the same
+    // workaround (bewerbungs-assistent#307, retro 2026-09-09). That directory
+    // is harness-owned and cannot collide with ANY wave file scope, so it is
+    // always-allowed territory; it is the single out-of-repo carveout here.
+    //
+    // NARROWNESS (security boundary — no wider allow than this one directory):
+    //   - Only the memory dir of THIS repo, as the harness names it. That name
+    //     is NOT unique: `encodeProjectDir()` maps both `/` and `.` to `-`, so
+    //     `/x/a.b` and `/x/a-b` share one memory dir — a harness-level collision
+    //     this gate inherits and cannot narrow. Every OTHER sibling repo's
+    //     memory dir stays denied.
+    //   - Containment is exact-prefix on the REALPATH-resolved candidate, so
+    //     `..` segments and symlink tricks cannot widen it.
+    //   - Evaluated only on the out-of-root branch: the in-repo gates (Gate 7,
+    //     Discovery's `allowedPaths: []` deny-all) are untouched.
+    //
+    // Encoder REUSED, never re-written (BV-001 rung 2): `encodeProjectDir()`
+    // from `scripts/lib/wave-transcript-tail.mjs` is the repo's one encoder for
+    // `<encoded-repo-path>`. Bound LAZILY here rather than in `bootstrap()` —
+    // same pattern as the G3b event import above — so the happy path pays no
+    // module load, and an import failure falls through to the deny below
+    // (fail-closed, byte-identical to the pre-#1295 behaviour).
+    //
+    // CEILING (BV-004): `CLAUDE_CONFIG_DIR` is NOT honoured, because nothing in
+    // this codebase honours it today (`rg -n "CLAUDE_CONFIG_DIR" scripts hooks`
+    // → 0 matches, 2026-09-13) and `wave-transcript-tail.mjs` resolves the same
+    // substrate from `homedir()`. Revisit together with that resolver if the
+    // harness config dir ever becomes relocatable here.
+    // CALLER DISCRIMINATION (#1352): the carve-out is the COORDINATOR's, never a
+    // dispatched wave agent's. See {@link classifyCaller} for the measurement.
+    // A subagent falls through to the gates below — under a manifest that does
+    // not grant the path (Discovery's `allowedPaths: []`) that is a DENY.
+    const memoryDirs = await ownMemoryDirs(projectRootRaw, projectRoot);
+    const caller = classifyCaller(input);
+    if (caller !== 'subagent' && memoryDirs.some((dir) => isInsideDir(resolvedPath, dir))) {
+      // One event per decision point, awaited before emitAllow() —
+      // emitAllow() calls process.exit(), which would discard a pending append.
+      try {
+        const { emitEvent } = await import('../scripts/lib/events.mjs');
+        await emitEvent(
+          'orchestrator.scope.memory_dir_allowed',
+          {
+            hook: HOOK_NAME,
+            manifest: scopePath,
+            wave: scope.wave,
+            file_path: resolvedPath,
+            // HR-105: the fail-OPEN case must be COUNTABLE, or the ambiguity is
+            // unfalsifiable — and it takes TWO values to be countable.
+            // `'absent'` = no `agent_id` key at all (the harness's own contract
+            // for a main-thread call); `'malformed'` = an `agent_id` key that is
+            // PRESENT but unusable (number/object/array/blank string), which
+            // would otherwise be indistinguishable from the legitimate case.
+            // `'coordinator'` = `agent_type` without `agent_id`.
+            discriminator: caller,
+          },
+          { repoRoot: projectRoot },
+        );
+      } catch { /* observability is best-effort — never blocks the decision */ }
+      return emitAllow();
+    }
+
     const reason = `Scope violation: path outside project root`;
     const suggestion = suggest(filePath);
     return enforcement === 'strict'
@@ -500,6 +572,135 @@ async function mtimeMsOf(file) {
   }
 }
 
+/**
+ * #1295 — the Claude Code auto-memory directories that belong to THIS repo.
+ *
+ * Returns at most two paths, both naming the SAME repo: the encoding of the
+ * project root as the harness saw it (`CLAUDE_PROJECT_DIR` / cwd) and — when it
+ * differs — the encoding of its realpath. Both are needed because Claude Code
+ * encodes the path it was LAUNCHED with, while this hook compares against the
+ * canonical root (on macOS `/tmp` → `/private/tmp`). Two encodings of one repo
+ * is not a wider grant: a sibling repo's root encodes to neither.
+ *
+ * Returns `[]` when the encoder cannot be loaded, so the caller falls through to
+ * its deny (fail-closed).
+ *
+ * @param {string} projectRootRaw — project root as resolved from env/cwd
+ * @param {string} projectRoot — its realpath
+ * @returns {Promise<string[]>}
+ */
+async function ownMemoryDirs(projectRootRaw, projectRoot) {
+  try {
+    const [{ encodeProjectDir }, { homedir }] = await Promise.all([
+      import('../scripts/lib/wave-transcript-tail.mjs'),
+      import('node:os'),
+    ]);
+    const home = homedir();
+    if (!home) return [];
+    // The candidate arrives REALPATH-resolved (SECURITY-REQ-03), so the home
+    // side must be too — otherwise the macOS `/tmp` → `/private/tmp` symlink
+    // alone makes every comparison miss.
+    let homeReal = home;
+    try {
+      homeReal = await fs.realpath(home);
+    } catch { /* non-existent home — the raw form is all there is */ }
+    const homes = new Set([home, homeReal]);
+    const roots = new Set(
+      [projectRootRaw, projectRoot].filter((p) => typeof p === 'string' && p.length > 0),
+    );
+    const dirs = [];
+    for (const h of homes) {
+      for (const root of roots) {
+        dirs.push(path.join(h, '.claude', 'projects', encodeProjectDir(root), 'memory'));
+      }
+    }
+    return dirs;
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Exact-prefix containment: is `candidate` `dir` itself or a descendant of it?
+ *
+ * Both sides are `path.resolve`d first, so `..` segments collapse before the
+ * comparison and cannot escape `dir`. The `path.sep` suffix is load-bearing —
+ * without it `<dir>-evil/x` would match the prefix of `<dir>`.
+ *
+ * @param {string} candidate
+ * @param {string} dir
+ * @returns {boolean}
+ */
+function isInsideDir(candidate, dir) {
+  const base = path.resolve(dir);
+  const target = path.resolve(candidate);
+  return target === base || target.startsWith(base + path.sep);
+}
+
+/**
+ * Classify a PreToolUse payload as coming from a dispatched SUBAGENT or from the
+ * main (coordinator) thread — the discriminator Gate 5c's memory carve-out needs
+ * (#1352).
+ *
+ * MEASURED, not assumed (2026-09-13, Claude Code 2.1.270, `strings` over
+ * `~/.local/share/claude/versions/2.1.270`):
+ *  - The base hook-input builder shared by EVERY event is
+ *    `{session_id: e.id, transcript_path: yf(e.id), cwd, …, agent_id: s?.agentId,
+ *    agent_type: d}` — PreToolUse spreads it verbatim
+ *    (`{...Na(s.session,Z(),d,s), hook_event_name:"PreToolUse", tool_name, …}`).
+ *  - The harness's own schema documents the field: *"Subagent identifier. Present
+ *    only when the hook fires from within a subagent (e.g., a tool called by an
+ *    AgentTool worker). Absent for the main thread, even in --agent sessions. Use
+ *    this field (not agent_type) to distinguish subagent calls from main-thread
+ *    calls."*
+ *  - Two candidates are REFUTED by the same source: `transcript_path` is
+ *    `yf(session.id)` — session-derived, hence IDENTICAL for coordinator and
+ *    subagent; and `CLAUDE_CODE_CHILD_SESSION=1` appears in a main-thread `env`
+ *    dump (`isSidechain:false`), so it marks the CLI process, not the caller.
+ *
+ * `agent_type` is deliberately a WEAKER witness, used only in the negative
+ * direction: per the same schema it is present on the main thread of an `--agent`
+ * session WITHOUT `agent_id`, so `agent_type`-without-`agent_id` positively names
+ * a coordinator, while `agent_type` alone can never name a subagent.
+ *
+ * FAIL-OPEN on ambiguity, deliberately (BV-004 ceiling): a payload this function
+ * cannot read as a subagent keeps the pre-#1352 ALLOW, because fail-closed here
+ * would deny the coordinator's own memory writes and break `/close`. The value is
+ * emitted on the event so the ambiguity is countable (HR-105) — but countability
+ * needs TWO fail-open values, not one:
+ *
+ *  - `'absent'`    — NO `agent_id` key in the payload at all. The harness's own
+ *                    documented shape for a main-thread call; the legitimate case.
+ *  - `'malformed'` — an `agent_id` key IS present and carries something this
+ *                    function cannot use as an identity (number, object, array,
+ *                    empty/whitespace string). Folding this into `'absent'` made a
+ *                    PRESENT-but-unusable marker byte-identical to a genuine
+ *                    main-thread call, so a future harness or bridge sending a
+ *                    numeric or object agent id would hand EVERY subagent the
+ *                    carve-out with nothing in the ledger to show it. Empty and
+ *                    whitespace-only strings belong here, not in `'absent'`: the
+ *                    key is present, so the sender believed it was identifying a
+ *                    subagent, and that is exactly the case this value separates.
+ *
+ * Only `agent_id` can produce `'malformed'`. `agent_type` is used solely in the
+ * positive coordinator direction and can never hide a subagent, so an unusable
+ * `agent_type` without an `agent_id` stays `'absent'`.
+ *
+ * Revisit if `discriminator: 'malformed'` appears at all, or if `'absent'`
+ * dominates the records on a harness that DOES dispatch subagents.
+ *
+ * @param {Record<string, unknown>} input Parsed PreToolUse stdin payload.
+ * @returns {'subagent'|'coordinator'|'malformed'|'absent'}
+ */
+function classifyCaller(input) {
+  const agentId = input?.agent_id;
+  if (typeof agentId === 'string' && agentId.trim() !== '') return 'subagent';
+  if (agentId !== undefined && agentId !== null) return 'malformed';
+  const agentType = input?.agent_type;
+  if (typeof agentType === 'string' && agentType.trim() !== '') return 'coordinator';
+  return 'absent';
+}
+
 const COORDINATOR_CARVEOUT_PATHS = Object.freeze([
   '.claude/STATE.md',
   '.codex/STATE.md',