session-orchestrator 5.11.0 → 5.13.0

package/hooks/post-edit-validate.mjs

@@ -14,22 +14,23 @@
  *   G3  file_path present
  *   G4  file extension filter — only .ts|.tsx|.js|.jsx|.mjs|.cjs
  *   G5  gate check — wave-scope.json.gates['post-edit-validate'] === false → exit 0
- *   G6  resolve typecheck command: Session Config → tsgo → tsc → npx tsc → skip
- *   G7  run typecheck with 2s AbortController timeout
+ *   G6  resolve typecheck command: Session Config → tsgo → tsc → local tsc → skip
+ *   G7  run typecheck with 2s process-group timeout
  *   G8  emit JSONL result to stderr
  *
- * Output (stderr): {"check":"typecheck","status":"pass|fail|skip","file":"<rel>","duration_ms":<int>}
+ * Output (stderr): {"check":"typecheck","status":"pass|fail|timeout|skip","file":"<rel>","duration_ms":<int>}
  * Exit codes: 0 — always (PostToolUse hooks are informational)
  *
  * SECURITY notes:
  *   REQ-01  top-level try/catch → silent exit 0 on unexpected error (never blocks)
- *   REQ-02  typecheck process uses AbortController (not shell `timeout` — cross-platform)
+ *   REQ-02  typecheck runs the intact shell command; timeout kills its process tree
  *   REQ-03  relative path computed via path.relative(projectRoot, absFilePath)
  */
 
 import path from 'node:path';
+import { existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
-import { performance } from 'node:perf_hooks';
+import { spawnInGroup } from '../scripts/lib/process-group.mjs';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
@@ -54,9 +55,9 @@ const TS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
 /**
  * Emit the JSONL result line to stderr.
  * @param {string} file            - relative file path
- * @param {'pass'|'fail'|'skip'} status
+ * @param {'pass'|'fail'|'timeout'|'skip'} status
  * @param {number} [duration_ms]   - omit for skip
- * @param {string} [reason]        - human-readable reason for skip or fail
+ * @param {string} [reason]        - human-readable reason for skip, timeout or fail
  * @param {string} [remediation]   - actionable fix hint for fail status only
  */
 function emitResult(file, status, duration_ms, reason, remediation) {
@@ -69,10 +70,10 @@ function emitResult(file, status, duration_ms, reason, remediation) {
 
 /**
  * Try to resolve the typecheck command.
- * Order: Session Config typecheck-command → tsgo → tsc → npx tsc → null
+ * Order: Session Config typecheck-command → tsgo → tsc → local tsc → null
  *
  * @param {string} projectRoot
- * @returns {Promise<{cmd: string, args: string[]}|null>}
+ * @returns {Promise<string|string[]|null>}
  */
 async function resolveTypecheckCommand(projectRoot) {
   // 1. Session Config typecheck-command
@@ -81,8 +82,8 @@ async function resolveTypecheckCommand(projectRoot) {
     const config = parseSessionConfig(md);
     const cmd = config['typecheck-command'];
     if (cmd && typeof cmd === 'string') {
-      const parts = cmd.trim().split(/\s+/);
-      return { cmd: parts[0], args: parts.slice(1) };
+      const command = cmd.trim();
+      return command === 'skip' ? null : command || null;
     }
   } catch {
     // config unavailable — fall through
@@ -90,15 +91,16 @@ async function resolveTypecheckCommand(projectRoot) {
 
   // 2. tsgo
   const tsgoParts = _tryWhich('tsgo');
-  if (tsgoParts) return { cmd: tsgoParts, args: ['--noEmit'] };
+  if (tsgoParts) return 'tsgo --noEmit';
 
   // 3. tsc
   const tscParts = _tryWhich('tsc');
-  if (tscParts) return { cmd: tscParts, args: ['--noEmit'] };
+  if (tscParts) return 'tsc --noEmit';
 
-  // 4. npx tsc
-  const npxParts = _tryWhich('npx');
-  if (npxParts) return { cmd: npxParts, args: ['tsc', '--noEmit'] };
+  // 4. Only an installed project compiler; npx may install the unrelated
+  // npm package `tsc` in projects without TypeScript (#1612).
+  const localTsc = path.join(projectRoot, 'node_modules', 'typescript', 'bin', 'tsc');
+  if (existsSync(localTsc)) return [process.execPath, localTsc, '--noEmit'];
 
   return null;
 }
@@ -111,9 +113,11 @@ async function resolveTypecheckCommand(projectRoot) {
  * @returns {string|null}
  */
 function _tryWhich(name) {
-  const whichCmd = process.platform === 'win32' ? 'where' : 'which';
+  const whichCmd = process.platform === 'win32' ? 'where.exe' : 'which';
+  // Two lookups get at most 1s total; revisit together with the outer
+  // 5s hook budget if a host needs slower executable discovery.
   try {
-    const result = spawnSync(whichCmd, [name], { encoding: 'utf8', timeout: 2000 });
+    const result = spawnSync(whichCmd, [name], { encoding: 'utf8', timeout: 500 });
     if (result.status === 0 && result.stdout.trim()) return name;
   } catch {
     // ignore
@@ -122,43 +126,32 @@ function _tryWhich(name) {
 }
 
 /**
- * Run the typecheck command with a 2s AbortController timeout.
- *
- * @param {string} cmd
- * @param {string[]} args
- * @returns {{status: 'pass'|'fail', duration_ms: number, reason?: string}}
+ * Configured commands retain shell semantics; the local compiler uses Node argv.
+ * Keep cleanup short for hooks.json's 5s budget; Windows skips CIM verification.
+ * @param {string|string[]} cmd
+ * @param {string} projectRoot
+ * @returns {Promise<{status: 'pass'|'fail'|'timeout', duration_ms: number, reason?: string}>}
  */
-function runTypecheck(cmd, args) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 2000);
-
-  const start = performance.now();
-  let spawnResult;
-  try {
-    spawnResult = spawnSync(cmd, args, {
-      signal: controller.signal,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-      timeout: 2000,
-    });
-  } finally {
-    clearTimeout(timer);
-  }
-
-  const duration_ms = Math.max(0, Math.round(performance.now() - start));
-
-  // AbortError or SIGTERM from timeout
-  if (spawnResult.error?.name === 'AbortError' || spawnResult.signal === 'SIGTERM') {
-    return { status: 'fail', duration_ms, reason: 'typecheck timed out after 2s' };
+async function runTypecheck(cmd, projectRoot) {
+  const result = await spawnInGroup(cmd, {
+    cwd: projectRoot,
+    timeoutMs: 2000,
+    // Hook-specific ceiling: escalate quickly so an uncooperative compiler
+    // cannot consume the outer 5s hook budget. Revisit if compiler cleanup
+    // needs more than 100ms; the hook's outer budget must change with it.
+    killGraceMs: 100,
+    verifyWaitMs: 100,
+    // Two PowerShell startups would exceed the remaining hook budget (R1-04).
+    verifyTree: false,
+  });
+  const duration_ms = Math.max(0, Math.round(result.durationMs));
+  if (result.timedOut) {
+    return { status: 'timeout', duration_ms, reason: 'typecheck timed out after 2s' };
   }
-
-  if (spawnResult.status !== 0) {
-    // Capture the first non-empty line of stderr/stdout as a compact reason.
-    const combined = ((spawnResult.stderr ?? '') + (spawnResult.stdout ?? '')).trim();
-    const firstLine = combined.split('\n').find((l) => l.trim()) ?? 'typecheck exited non-zero';
+  if (result.exitCode !== 0) {
+    const firstLine = result.fullOutput.split('\n').find((line) => line.trim()) ?? 'typecheck exited non-zero';
     return { status: 'fail', duration_ms, reason: firstLine.slice(0, 256) };
   }
-
   return { status: 'pass', duration_ms };
 }
 
@@ -216,7 +209,7 @@ async function main() {
   }
 
   // G7: run typecheck with 2s timeout (REQ-02)
-  const { status, duration_ms, reason } = runTypecheck(tc.cmd, tc.args);
+  const { status, duration_ms, reason } = await runTypecheck(tc, projectRoot);
 
   // G8: emit JSONL result to stderr
   const remediation =

package/hooks/post-subagent-discovery-validator.mjs

@@ -226,7 +226,7 @@ const AGENT_DESCRIPTION_MAX = 120;
  * Resolve WHO made the claim, and say where the answer came from (#1218).
  *
  * Measured 2026-09-06 over the fleet's worst-affected repo
- * (`extern/aiat-barrierefrei-engine`, 3,360 `discovery_validator_violation`
+ * (a consumer repo, 3,360 `discovery_validator_violation`
  * records): `agent` was the literal string `"unknown"` on 3,026 of them
  * (90.1%), and NOT ONE record carried an `agent_id`. Both the sidecar-meta
  * fallback and the `agent_id` field landed in the same commit (936dae8a,
@@ -364,7 +364,7 @@ function dedupSentinelPath({ projectRoot, sessionId, agentId, claimText }) {
  *     same sentence re-asserted by a second agent of the same session is the
  *     same finding, and writing it twice is what produced a duplication factor
  *     of 16.4 (3,360 records over 205 distinct `claim_text` values, measured
- *     2026-09-06 in `extern/aiat-barrierefrei-engine`).
+ *     2026-09-06 in a consumer repo).
  *
  * Returns null without a session id — a claim that cannot be bound to a session
  * must not collide with an unrelated one under a global "unknown" key, so it is

package/hooks/post-tool-batch-wave-signal.mjs

@@ -74,6 +74,7 @@ import { shouldRunHook } from './_lib/profile-gate.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 
 import { getProjectDir, resolveSessionRoot } from '../scripts/lib/platform.mjs';
+import { resolveOwnLockRoot } from './_lib/hook-root.mjs';
 import { emitEvent } from '../scripts/lib/events.mjs';
 import { findOwnScopeFile } from '../scripts/lib/scope-gate.mjs';
 import {
@@ -356,13 +357,16 @@ async function main() {
   };
 
   // Two roots, by writer (#1511 point a). `current-session.json` and
-  // `session.lock` stay at the LAUNCH dir: on-session-start.mjs writes both at
-  // `resolveProjectDir()`, and a reader elsewhere finds no record. Everything
+  // `session.lock` are read where on-session-start.mjs wrote them: the launch
+  // dir, or the entered worktree after a /clear, compact or resume there
+  // (#1605), found by the lock carrying this session's raw id
+  // (`resolveOwnLockRoot`); a reader elsewhere finds no record. Everything
   // about the WAVE — its manifest, its start sha, the files it changed — is read
   // at the SESSION root: after EnterWorktree the launch dir is a different
   // checkout, whose HEAD and working tree say nothing about this wave.
   const sessionRoot = resolveSessionRoot(input?.cwd);
-  const sessionFile = path.join(getProjectDir(), '.orchestrator', 'current-session.json');
+  const lockRoot = resolveOwnLockRoot(input, getProjectDir());
+  const sessionFile = path.join(lockRoot, '.orchestrator', 'current-session.json');
 
   const lastBatchResult = await atomicMutateJson(sessionFile, {}, (current) => ({
     ...current,
@@ -391,7 +395,7 @@ async function main() {
     const sessionId = await resolveSessionIdForHeartbeat(input, sessionFile);
     if (typeof sessionId === 'string' && sessionId.length > 0) {
       const { updateHeartbeat } = await import('../scripts/lib/session-lock.mjs');
-      updateHeartbeat({ repoRoot: getProjectDir(), sessionId });
+      updateHeartbeat({ repoRoot: lockRoot, sessionId });
     }
   } catch { /* best effort — hook must remain non-blocking */ }
 

package/hooks/post-tool-failure-corrective-context.mjs

@@ -31,6 +31,7 @@ import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 
 import { getProjectDir } from '../scripts/lib/platform.mjs';
 import { atomicMutateJson } from './_lib/atomic-json.mjs';
+import { resolveOwnLockRoot } from './_lib/hook-root.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -178,7 +179,10 @@ async function main() {
     exit_code: exitCode,
   };
 
-  const sessionFile = path.join(getProjectDir(), '.orchestrator', 'current-session.json');
+  // #1605 B5 — annotate THIS session's current-session.json where
+  // on-session-start.mjs put it (the entered worktree after a /clear there),
+  // found by the lock carrying the raw payload id; launch dir otherwise.
+  const sessionFile = path.join(resolveOwnLockRoot(input, getProjectDir()), '.orchestrator', 'current-session.json');
 
   const result = await atomicMutateJson(sessionFile, {}, (current) => {
     const existing = Array.isArray(current.corrective_context)

package/hooks/pre-bash-destructive-guard.mjs

@@ -35,6 +35,10 @@
  *          redirect class answers "what does this command WRITE"; nothing
  *          answered "what does it REMOVE", so `rm -f <ledger>` was allowed
  *          while `> <ledger>` was denied — 53,896 lines of telemetry lost.
+ *        rule.type === 'hooks-path-missing' (#1732): decided by the directory
+ *          of each `git commit`/`git push` (findHookedGitCalls) and the repo's
+ *          relative core.hooksPath (missingWorktreeHooks) — a linked worktree
+ *          without the generated hooks dir runs no hook at all, silently.
  *   G6 no match → exit 0
  *
  * Telemetry (Epic #803 process-safety dimension): best-effort
@@ -45,6 +49,7 @@
  * finalized; a telemetry failure never changes the guard's decision.
  */
 
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -326,7 +331,7 @@ async function blockCommand(pattern, ruleId, rationale, command, sessionId) {
  */
 async function isGitStashNonEmpty(projectDir) {
   try {
-    const { $: zx$ } = await import('zx');
+    const { $: zx$ } = await import('../scripts/lib/zx.mjs');
     zx$.verbose = false;
     zx$.quiet = true;
     const cwd = projectDir || process.cwd();
@@ -479,6 +484,181 @@ function commandHasRecursiveForceRm(command) {
   return false;
 }
 
+/** #1732 — git subcommands that run the repo's own hooks: pre-commit/commit-msg and pre-push. */
+const HOOKED_GIT_SUBCOMMANDS = new Set(['commit', 'push']);
+/** git global options that take their value as the NEXT token (`git -c k=v push`). */
+const GIT_OPTIONS_WITH_VALUE = new Set(['-c', '--namespace', '--config-env', '--attr-source']);
+/** Options and env prefixes after which the guard cannot tell which repo or hooks git uses. */
+const GIT_UNKNOWABLE_OPTION = /^--(git-dir|work-tree)(=|$)/;
+const GIT_UNKNOWABLE_ENV = /^GIT_(DIR|WORK_TREE|COMMON_DIR|CONFIG\w*)=/;
+
+/**
+ * Resolve a literal path operand against `base`, or null when the shell would
+ * expand it into something the guard cannot read (`$X`, a substitution, `cd -`).
+ *
+ * @param {string|null} base
+ * @param {{ text: string } | undefined} tok
+ * @returns {string|null}
+ */
+function literalDir(base, tok) {
+  if (base === null || tok === undefined) return null;
+  const text = tok.text;
+  if (text === '-' || /[$`*?[]/.test(text)) return null;
+  if (text === '~' || text.startsWith('~/')) return path.join(os.homedir(), text.slice(1));
+  if (text.startsWith('~')) return null;
+  return path.resolve(base, text);
+}
+
+/**
+ * Every `git commit` / `git push` in the command with the directory it runs in
+ * (#1732). The directory starts at `cwd` and follows literal `cd <dir>` segments
+ * and `git -C <dir>`. A `cd` the guard cannot read (variable, `cd -`,
+ * `pushd`/`popd`) turns the directory unknown (`dir: null`) for everything after
+ * it. The tokenizer appends command-substitution bodies after a `substitution`
+ * marker and frames `( … )` with `subshell` markers, so only the tokens before
+ * the first substitution marker are the main shell's, and a `cd` after the
+ * first subshell marker turns the directory unknown (`(cd /wt && make) && git
+ * push` pushes from the start directory). A `)` inside a quoted commit message
+ * changes nothing. The caller never judges an unknown directory — unknown is
+ * "not judged", never a hit. An explicit skip (`--no-verify`, `commit -n` also
+ * inside a short-flag group, `HUSKY=0`) is not judged either: the skip this rule
+ * catches is the silent one.
+ *
+ * @param {string} command
+ * @param {string} cwd
+ * @returns {Array<{ subcommand: string, dir: string|null }>}
+ */
+function findHookedGitCalls(command, cwd) {
+  const calls = [];
+  const tokens = blocker.tokenizeCommand(command);
+  const substitutionAt = tokens.findIndex((t) => t.operator === 'substitution');
+  const mainShell = substitutionAt === -1 ? tokens : tokens.slice(0, substitutionAt);
+  const subshellAt = mainShell.findIndex((t) => t.operator === 'subshell');
+  const parts = subshellAt === -1
+    ? [{ tokens: mainShell, cdKnown: true }]
+    : [{ tokens: mainShell.slice(0, subshellAt), cdKnown: true }, { tokens: mainShell.slice(subshellAt), cdKnown: false }];
+  let dir = cwd;
+  for (const part of parts) {
+    for (const segment of blocker.splitChainSegments(part.tokens)) {
+      const { verb, index } = blocker.resolveSegmentVerb(segment);
+      if (verb === 'pushd' || verb === 'popd') { dir = null; continue; }
+      if (verb === 'cd') {
+        const operands = segment.slice(index + 1).filter((t) => t.quoted || !/^-[LPe@]+$/.test(t.text));
+        if (!part.cdKnown) dir = null;
+        else if (operands.length === 0) dir = os.homedir();
+        else dir = operands.length === 1 ? literalDir(dir, operands[0]) : null;
+        continue;
+      }
+      if (verb !== 'git' || segment[index].quoted) continue;
+      const call = hookedGitCall(segment, index, dir);
+      if (call !== null) calls.push(call);
+    }
+  }
+  return calls;
+}
+
+/** Short `git commit` options that take a value: in `-mn` the `n` is the message. */
+const COMMIT_SHORT_WITH_VALUE = 'mFCctSu';
+
+/**
+ * Whether a short-flag group of `git commit` carries `-n` (`-nm x` does, `-mn` does not).
+ *
+ * @param {string} group
+ * @returns {boolean}
+ */
+function commitGroupHasNoVerify(group) {
+  for (const ch of group.slice(1)) {
+    if (ch === 'n') return true;
+    if (COMMIT_SHORT_WITH_VALUE.includes(ch)) return false;
+  }
+  return false;
+}
+
+/**
+ * Read one `git` segment: its subcommand and the directory it runs in, or null
+ * when it is no hooked call or skips hooks explicitly.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} segment
+ * @param {number} index - the `git` token
+ * @param {string|null} dir - the directory before git's own `-C`
+ * @returns {{ subcommand: string, dir: string|null } | null}
+ */
+function hookedGitCall(segment, index, dir) {
+  const env = segment.slice(0, index);
+  if (env.some((t) => t.text === 'HUSKY=0')) return null;
+  let gitDir = env.some((t) => GIT_UNKNOWABLE_ENV.test(t.text)) ? null : dir;
+  let i = index + 1;
+  for (; i < segment.length; i++) {
+    const t = segment[i];
+    if (t.quoted || !t.text.startsWith('-')) break;
+    if (t.text === '-C') { gitDir = literalDir(gitDir, segment[++i]); continue; }
+    if (GIT_UNKNOWABLE_OPTION.test(t.text)) {
+      gitDir = null;
+      if (!t.text.includes('=')) i++;
+      continue;
+    }
+    if (GIT_OPTIONS_WITH_VALUE.has(t.text)) {
+      const value = segment[++i]?.text ?? '';
+      if (t.text === '-c' && /^core\.hookspath=/i.test(value)) gitDir = null;
+    }
+  }
+  const sub = segment[i];
+  if (sub === undefined || sub.quoted || !HOOKED_GIT_SUBCOMMANDS.has(sub.text)) return null;
+  const flags = segment.slice(i + 1).filter((t) => !t.quoted).map((t) => t.text);
+  if (flags.includes('--no-verify')) return null;
+  if (sub.text === 'commit' && flags.some((f) => /^-[a-zA-Z]+$/.test(f) && commitGroupHasNoVerify(f))) return null;
+  return { subcommand: sub.text, dir: gitDir };
+}
+
+/**
+ * Run git read-only in `dir`; trimmed stdout, or null on any failure.
+ *
+ * @param {string} dir
+ * @param {string[]} args
+ * @returns {string|null}
+ */
+function gitRead(dir, args) {
+  try {
+    const out = execFileSync('git', ['-C', dir, ...args], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 3000,
+    }).trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The silent hookless case of #1732: a LINKED worktree whose relative
+ * `core.hooksPath` (husky: `.husky/_`) does not exist in it, while the main
+ * checkout has it. `.husky/_` is generated by `husky` (npm `prepare`), and
+ * `ignore-scripts=true` keeps `npm ci` from creating it in a fresh worktree, so
+ * every commit and push there runs no hook and says nothing (measured
+ * 2026-10-22: a push went out without its pre-push full gate).
+ *
+ * Narrow on purpose — each condition that does not hold is an allow: no
+ * hooksPath, an absolute or `~` one (a global setting), the directory exists, the
+ * main checkout has none either (the repo installs no hooks), or this IS the main
+ * checkout. Any git failure is an allow.
+ *
+ * @param {string} dir
+ * @returns {{ hooksPath: string, worktree: string } | null}
+ */
+function missingWorktreeHooks(dir) {
+  const hooksPath = gitRead(dir, ['config', '--get', 'core.hooksPath']);
+  if (hooksPath === null || path.isAbsolute(hooksPath) || hooksPath.startsWith('~')) return null;
+  const worktree = gitRead(dir, ['rev-parse', '--show-toplevel']);
+  if (worktree === null || fs.existsSync(path.join(worktree, hooksPath))) return null;
+  const commonDir = gitRead(dir, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+  if (commonDir === null) return null;
+  const mainCheckout = path.dirname(commonDir);
+  if (path.resolve(mainCheckout) === path.resolve(worktree)) return null;
+  if (!fs.existsSync(path.join(mainCheckout, hooksPath))) return null;
+  return { hooksPath, worktree };
+}
+
 /** Probe operator per redirect mode — see findMatchedRedirectEntry. */
 const REDIRECT_PROBE_OPS = { truncate: '>', append: '>>', read: '<' };
 
@@ -939,6 +1119,31 @@ async function main() {
       continue; // unreachable (blockCommand never returns) — kept for clarity
     }
 
+    // #1732 — a `git commit`/`git push` that would run WITHOUT the repo's hooks,
+    // because a linked worktree lacks the generated hooks directory. Decided by
+    // the git call's directory and the repo's hooksPath, never by the generic
+    // pattern path below (its `pattern` is a label). An unknown directory is
+    // not judged.
+    if (rule.type === 'hooks-path-missing') {
+      const cwd = typeof input.cwd === 'string' && input.cwd.length > 0 ? input.cwd : process.cwd();
+      let hit = null;
+      for (const call of findHookedGitCalls(command, cwd)) {
+        if (call.dir === null) continue;
+        const missing = missingWorktreeHooks(call.dir);
+        if (missing) { hit = { ...missing, subcommand: call.subcommand }; break; }
+      }
+      if (!hit) continue;
+      const label = `git ${hit.subcommand} in ${hit.worktree} — core.hooksPath ${hit.hooksPath} is missing there`;
+      if (severity !== 'block') {
+        const msg = `pre-bash-destructive-guard: ${label} (rule: ${id}) — ${rationale}`;
+        process.stderr.write(`⚠ ${msg}\n`);
+        notices.push(msg);
+        continue;
+      }
+      await blockCommand(label, id, rationale, command, sessionId);
+      continue; // unreachable (blockCommand never returns) — kept for clarity
+    }
+
     // The rm-rf-destructive rule also fires for recursive+force rm flag variants
     // the literal "rm -rf" pattern misses (`rm -r -f`, `rm -fr`) — #641 gap closure.
     const matched = id === 'rm-rf-destructive'
@@ -1020,9 +1225,13 @@ async function main() {
 //      crash with 0 bytes of stdout — indistinguishable from an allow, and
 //      therefore invisible. Now it exits 0 (still fail-open, so a broken module
 //      cannot brick the session) but SAYS SO, loudly, once per session.
-//   2. RUNTIME failure inside `main()`: pre-existing behaviour, unchanged.
-//      The guard armed and then tripped over a specific command; that is a
-//      narrower blast radius and keeps its historical `internal error` line.
+//   2. RUNTIME failure inside `main()` (#1671 item 1): the guard armed and then
+//      tripped over a specific command. That command is DENIED (fail-closed),
+//      like enforce-commands / enforce-scope (SECURITY-REQ-01). It used to exit
+//      0 = ALLOW, so any future crash on an input shape (the measured trigger was
+//      a tokenizer RangeError on a long command) silently opened the guard for
+//      exactly the inputs it cannot parse. The blast radius is one command, and
+//      the reason tells the operator how out: split or simplify it.
 // ---------------------------------------------------------------------------
 try {
   await bootstrap();
@@ -1054,11 +1263,14 @@ if (isMainModule(import.meta.url)) {
   // #211: exit 0 immediately (silent allow) when this hook is disabled via profile/env
   if (!shouldRunHook('pre-bash-destructive-guard')) process.exit(0);
 
-  // Top-level error handler — never let exit 1 leak
+  // Top-level error handler — never let exit 1 leak, never fail open (#1671).
+  // emitDeny is bound here: bootstrap() succeeded, and it never throws.
   main().catch((e) => {
-    process.stderr.write(
-      `⚠ pre-bash-destructive-guard: internal error — ${e?.message || e}\n`
+    const detail = String(e?.message || e).split('\n')[0];
+    process.stderr.write(`⚠ pre-bash-destructive-guard: internal error — ${detail}\n`);
+    emitDeny(
+      `pre-bash-destructive-guard hit an internal error and blocked this command for safety (${detail}).`,
+      'Split the command into smaller, simpler Bash calls and retry. See issue #1671.'
     );
-    process.exit(0); // fail-open on internal errors to avoid blocking legitimate work
   });
 }

package/hooks/pre-bash-issue-budget.mjs

@@ -106,7 +106,12 @@ async function resolveSessionId(input, projectDir) {
 
   let currentSession = null;
   if (projectDir) {
-    const persisted = path.join(projectDir, '.orchestrator', 'current-session.json');
+    // #1605 — read THIS session's record where on-session-start.mjs wrote it
+    // (the entered worktree after a /clear there), found by the lock carrying
+    // the raw id. Lazy: only a matched issue command pays for the lookup.
+    const { resolveOwnLockRoot } = await import('./_lib/hook-root.mjs');
+    const ownRoot = resolveOwnLockRoot({ session_id: nativeRawId, cwd: input?.cwd }, projectDir);
+    const persisted = path.join(ownRoot, '.orchestrator', 'current-session.json');
     if (existsSync(persisted)) {
       try {
         currentSession = await readJson(persisted);