session-orchestrator 5.12.0 → 5.13.0

package/scripts/lib/state-md/frontmatter-mutators.mjs

@@ -15,6 +15,9 @@ import { dirname, resolve as resolvePath } from 'node:path';
 import { parseStateMd, serializeStateMd } from './yaml-parser.mjs';
 import { withStateMdLock } from '../session-lock.mjs';
 import { resolveStateDir } from '../platform.mjs';
+// Hook-closure note: own-session.mjs imports only node:* and the import-free
+// session-lock-shape.mjs, both already in the hook import set.
+import { readProcessLocalSessionIds } from '../session-identity/own-session.mjs';
 
 /**
  * Sets frontmatter.updated to the given ISO 8601 timestamp and returns the
@@ -85,20 +88,84 @@ const STATE_DIR_CANDIDATES = ['.claude', '.codex', '.cursor', '.pi'];
  * @returns {string} Absolute artifact path.
  */
 export function resolveStateArtifactPath(repoRoot, filename) {
+  const { candidates } = stateArtifactCandidates(repoRoot, filename);
+  return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
+}
+
+/**
+ * Shared candidate list: SO_STATE_DIR override (if set), the active harness's
+ * state dir, then the legacy harness dirs. `preferredCount` is how many of the
+ * leading entries are override/active (as opposed to legacy).
+ *
+ * @param {string|undefined} repoRoot
+ * @param {string} filename
+ * @returns {{ candidates: string[], preferredCount: number }}
+ */
+function stateArtifactCandidates(repoRoot, filename) {
   const root = repoRoot ?? process.cwd();
   const override = (process.env.SO_STATE_DIR ?? '').trim();
   const active = resolveStateDir();
-  const directories = [...new Set([override || active, active, ...STATE_DIR_CANDIDATES])];
-  const candidates = directories.map((directory) => resolvePath(root, directory, filename));
-  return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
+  const preferred = [...new Set([override || active, active])];
+  const directories = [...new Set([...preferred, ...STATE_DIR_CANDIDATES])];
+  return {
+    candidates: directories.map((directory) => resolvePath(root, directory, filename)),
+    preferredCount: preferred.length,
+  };
+}
+
+/**
+ * May THIS process write into the existing STATE.md at `candidate`?
+ * Always yes for a placeholder (no frontmatter or no `session-id`), a
+ * `status: idle` record, or a `session-id` naming this process
+ * (`readProcessLocalSessionIds()`). An unreadable file is never a target.
+ *
+ * Otherwise the answer depends on where the candidate sits:
+ *   - Legacy (other-platform) dir: no — #1618, unchanged.
+ *   - SO_STATE_DIR / active dir (`preferred`): refused ONLY when it is
+ *     `status: completed` AND this process has a measurable own id (#1640 —
+ *     the measured damage: session-end Phase 3.7a wrote into a FINISHED
+ *     foreign session's record). A non-completed record keeps the pre-#1640
+ *     behaviour: one checkout has one session.lock owner, and after `/clear`
+ *     the process carries a NEW raw id while its own active STATE.md still
+ *     names the old one — refusing that file made `/close` unable to finish.
+ *     `completedHandoff` (Idle Reset) may take a completed record too: that
+ *     rewrite IS the hand-over to the next session.
+ *
+ * CEILING (BV-004): a `/clear`ed session's active file is still identified by
+ * its OLD id until close, where {@link markStateMdCompletedOnDisk} re-stamps
+ * it; a live parallel session in the same checkout is PSA territory, not
+ * this guard's. Revisit when the raw id survives `/clear` (resume linkage).
+ *
+ * @param {string} candidate
+ * @param {string[]} ownIds
+ * @param {{ preferred: boolean, completedHandoff?: boolean }} opts
+ * @returns {boolean}
+ */
+function isWritableStateMd(candidate, ownIds, { preferred, completedHandoff = false }) {
+  let frontmatter;
+  try {
+    frontmatter = parseStateMd(readFileSync(candidate, 'utf8'))?.frontmatter ?? null;
+  } catch {
+    return false;
+  }
+  const raw = frontmatter?.['session-id'];
+  const sessionId = typeof raw === 'string' ? raw.trim() : '';
+  if (!sessionId) return true;
+  const status = frontmatter.status;
+  if (status === 'idle') return true;
+  if (ownIds.includes(sessionId)) return true;
+  if (!preferred) return false;
+  return status !== 'completed' || completedHandoff || ownIds.length === 0;
 }
 
 /**
- * Resolve the active STATE.md path under a given repo root.
+ * Resolve the active STATE.md path under a given repo root — READ side.
  *
  * Returns the first existing candidate, checking the active platform first.
  * Falls back to the active platform's state dir when none exist (matches the
- * create-on-first-write semantics expected by callers).
+ * create-on-first-write semantics expected by callers). The legacy fallback to
+ * another platform's STATE.md is kept for readers (#890); writers must use
+ * {@link resolveStateMdWritePath}.
  *
  * @param {string|undefined} repoRoot
  * @returns {string}  Absolute path to STATE.md.
@@ -107,6 +174,83 @@ export function resolveStateMdPath(repoRoot) {
   return resolveStateArtifactPath(repoRoot, 'STATE.md');
 }
 
+/**
+ * Resolve the STATE.md path a WRITE may target (#1618, #1640).
+ *
+ * Every existing candidate — SO_STATE_DIR, the active platform's dir, the
+ * legacy dirs — must pass the ownership rule ({@link isWritableStateMd}); the
+ * first one that does wins. Before #1640 the override/active candidates were
+ * taken unchecked, so session-end Phase 3.7a wrote its recommendation fields
+ * into a FOREIGN completed `.claude/STATE.md` while this session's own record
+ * lived elsewhere. Without a qualifying candidate the preferred path is
+ * returned for create-on-first-write — unless that path itself holds a foreign
+ * file, in which case `blocked` is true and writers refuse.
+ *
+ * @param {string|undefined} repoRoot
+ * @returns {string}  Absolute path to STATE.md.
+ */
+export function resolveStateMdWritePath(repoRoot) {
+  return resolveStateMdWriteTarget(repoRoot).path;
+}
+
+/**
+ * Like {@link resolveStateMdWritePath}, but also names the first STATE.md
+ * that was REJECTED on the way (#1618 review): `rejected` is the absolute path
+ * of an existing STATE.md not proven to be this process's, set only when the
+ * returned `path` is NOT a qualifying existing file (absent → create, or
+ * `blocked`). Callers use it to say why nothing was written instead of
+ * returning a silent no-op. `blocked` means `path` exists and is foreign:
+ * nothing may be written there (#1640).
+ *
+ * `opts.statePath` (#1640) pins the target explicitly — session-end passes the
+ * same path to Phase 3.7a and Phase 3.4 so both land in one file — and is
+ * subject to the same ownership rule (treated as a preferred candidate).
+ * `opts.completedHandoff` lets the Idle Reset take a preferred
+ * `status: completed` record (see {@link isWritableStateMd}).
+ *
+ * @param {string|undefined} repoRoot
+ * @param {{ statePath?: string, completedHandoff?: boolean }} [opts]
+ * @returns {{ path: string, rejected: string|null, blocked: boolean }}
+ */
+export function resolveStateMdWriteTarget(repoRoot, opts = {}) {
+  const { statePath, completedHandoff = false } = opts;
+  const ownIds = readProcessLocalSessionIds();
+  const explicit = typeof statePath === 'string' && statePath.trim() !== '';
+  const { candidates, preferredCount } = explicit
+    ? { candidates: [resolvePath(repoRoot ?? process.cwd(), statePath)], preferredCount: 1 }
+    : stateArtifactCandidates(repoRoot, 'STATE.md');
+  let rejected = null;
+  for (const [index, candidate] of candidates.entries()) {
+    if (!existsSync(candidate)) continue;
+    if (isWritableStateMd(candidate, ownIds, { preferred: index < preferredCount, completedHandoff })) {
+      return { path: candidate, rejected: null, blocked: false };
+    }
+    rejected ??= candidate;
+  }
+  const path = candidates[0];
+  return { path, rejected, blocked: existsSync(path) };
+}
+
+/**
+ * One stderr line naming a rejected foreign STATE.md, so a fail-closed
+ * write target never degrades into a silent no-op (#1618 review). When the
+ * rejected file IS the target (#1640 `blocked`), the line says nothing is
+ * written instead of naming a different target.
+ *
+ * @param {string} caller
+ * @param {string} rejected
+ * @param {string} target
+ */
+export function warnForeignStateMd(caller, rejected, target) {
+  const outcome = rejected === target
+    ? 'nothing written — it is no session-own write target'
+    : `write target is ${target}`;
+  process.stderr.write(
+    `⚠ ${caller}: ignoring ${rejected} — its session-id is not this process's ` +
+      `(no matching process-local session id); ${outcome} (#1618/#1640)\n`
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Size-ceiling guard (issue #739)
 // ---------------------------------------------------------------------------
@@ -351,27 +495,40 @@ function writeFileAtomic(filePath, contents) {
  *   frontmatter-unsafe breach throws an `Error`
  *   (`.code === 'STATE_MD_FRONTMATTER_UNSAFE'`) instead of returning a no-op
  *   result. Default `false`.
+ * @param {string} [opts.statePath]  — explicit STATE.md target (#1640), absolute
+ *   or repo-relative; still ownership-checked. A foreign existing target is
+ *   refused with `reason: 'foreign-state-md'`, never overwritten.
+ * @param {boolean} [opts.completedHandoff]  — Idle Reset only: a preferred
+ *   `status: completed` record qualifies as write target (#1640).
  * @returns {Promise<{ written: boolean, path: string, contents: string|null, reason?: string }>}
  */
 export async function writeStateMd(repoRoot, transformer, opts = {}) {
   if (typeof transformer !== 'function') {
     throw new TypeError('writeStateMd: transformer must be a function');
   }
-  const statePath = resolveStateMdPath(repoRoot);
+  const { path: statePath, rejected, blocked } = resolveStateMdWriteTarget(repoRoot, {
+    statePath: opts.statePath,
+    completedHandoff: opts.completedHandoff,
+  });
+  if (rejected) warnForeignStateMd('writeStateMd', rejected, statePath);
+  const foreign = rejected ? { reason: 'foreign-state-md' } : {};
+  // #1640: the only existing file at the target belongs to another session —
+  // never overwrite it, never call the transformer on its contents.
+  if (blocked) return { written: false, path: statePath, contents: null, ...foreign };
   return withStateMdLock(
     repoRoot,
     async () => {
       const before = existsSync(statePath) ? readFileSync(statePath, 'utf8') : '';
       const after = await transformer(before);
       if (after === null || after === undefined) {
-        return { written: false, path: statePath, contents: null };
+        return { written: false, path: statePath, contents: null, ...foreign };
       }
       if (typeof after !== 'string') {
         throw new TypeError('writeStateMd: transformer must return a string or null');
       }
       if (after === before) {
         // No textual change — skip the write to keep mtime stable.
-        return { written: false, path: statePath, contents: before };
+        return { written: false, path: statePath, contents: before, ...foreign };
       }
 
       const ceilingBytes = typeof opts._ceilingBytes === 'number' && opts._ceilingBytes > 0
@@ -456,6 +613,107 @@ export async function updateFrontmatterFieldsOnDisk(repoRoot, fields, opts = {})
   return writeStateMd(repoRoot, (contents) => updateFrontmatterFields(contents, fields), opts);
 }
 
+/**
+ * Why the STATE.md `session-id` `sessionId` may NOT be taken over by this
+ * process (#1640 review MED-1), or `null` when it may. A non-completed record
+ * passes the write rule even with a foreign id (a `/clear`ed session's own
+ * file still names its pre-`/clear` id), so before re-stamping the id and
+ * completing the file we ask the host session registry whether that id is
+ * still REGISTERED at all (`readRegistry()`; the caller already excludes our
+ * own id). A registered session owns the file: completing it would lock that
+ * session out of its own record. No freshness window: the heartbeat is only
+ * written at turn end (hooks/on-stop.mjs), and 92 of 954 consecutive
+ * `orchestrator.turn.stopped` gaps (48 of 64 sessions) exceeded 15 min —
+ * an idle-but-live peer would look dead. Measured 2026-10-15: 13 of 13
+ * sessions that ended with SessionEnd `reason: clear` were already
+ * deregistered (on-session-end.mjs deregisters on every reason), so a
+ * `/clear` predecessor does not block its successor's close.
+ *
+ * Fail-closed: a registry directory that exists but cannot be read refuses.
+ * An absent registry (ENOENT) means no live peers.
+ *
+ * CEILING (BV-004): the registry is host-wide, not per checkout, and the
+ * check runs inside the STATE.md lock but not under the registry's. A session
+ * that crashed without SessionEnd (or whose deregistration failed) stays
+ * registered until `sweepZombies()` removes it after 60 min of inactivity at
+ * the next SessionStart of ANY session — until then no other session can
+ * complete its STATE.md (fail-closed direction, refused loudly). Revisit if
+ * that refusal shows up in close transcripts.
+ *
+ * Lazy import: this module is in the hook import closure; the registry is
+ * only needed on this async session-end path.
+ *
+ * @param {string} sessionId
+ * @param {string|undefined} ownId
+ * @returns {Promise<string|null>}
+ */
+async function liveForeignOwner(sessionId) {
+  try {
+    const { activeDir, readRegistry } = await import('../session-registry.mjs');
+    const { readdir } = await import('node:fs/promises');
+    try {
+      await readdir(activeDir());
+    } catch (err) {
+      if (err?.code === 'ENOENT') return null;
+      return `session registry unreadable (${err?.code ?? 'error'})`;
+    }
+    const entries = await readRegistry();
+    return entries.some((entry) => entry.session_id === sessionId)
+      ? 'its session-id belongs to a session still registered on this host'
+      : null;
+  } catch (err) {
+    return `session registry unreadable (${err?.code ?? err?.message ?? 'error'})`;
+  }
+}
+
+/**
+ * session-end Phase 3.4 (#1640): finalize THIS session's STATE.md in one
+ * locked write — `status: completed`, `updated`, optionally `current-wave`,
+ * and `session-id` re-stamped to the closing process's own raw id when one is
+ * measurable. The re-stamp keeps a `/clear`ed session's record its own after
+ * 3.4: the writers that run LATER in the close — Phase 5's
+ * `markOpenQuestionAnsweredOnDisk` — would otherwise find a completed record
+ * naming the pre-`/clear` id and be refused as foreign. Without a measurable
+ * id the existing `session-id` is left as is.
+ *
+ * Refused (`reason: 'foreign-state-md'`, one stderr line, file byte-identical)
+ * when the record's `session-id` is neither this process's nor free to take
+ * over — see {@link liveForeignOwner}. Placeholder (no `session-id`), idle and
+ * own records are never checked against the registry.
+ *
+ * @param {string} repoRoot  — absolute path to the repository root (required)
+ * @param {object} [opts]  — `writeStateMd` options; pass the SAME `statePath` as Phase 3.7a.
+ * @param {number} [opts.currentWave]  — final wave count, written as `current-wave`.
+ * @returns {Promise<{ written: boolean, path: string, contents: string|null, reason?: string }>}
+ * @throws {Error} when repoRoot is undefined, null, or empty
+ */
+export async function markStateMdCompletedOnDisk(repoRoot, opts = {}) {
+  requireRepoRoot(repoRoot, 'markStateMdCompletedOnDisk');
+  const { currentWave, ...writeOpts } = opts;
+  const fields = { status: 'completed', updated: new Date().toISOString() };
+  if (Number.isInteger(currentWave)) fields['current-wave'] = currentWave;
+  const [ownId] = readProcessLocalSessionIds();
+  if (ownId) fields['session-id'] = ownId;
+  let refusal = null;
+  const result = await writeStateMd(
+    repoRoot,
+    async (contents) => {
+      const frontmatter = parseStateMd(contents)?.frontmatter;
+      const raw = frontmatter?.['session-id'];
+      const sessionId = typeof raw === 'string' ? raw.trim() : '';
+      if (sessionId && sessionId !== ownId && frontmatter.status !== 'idle') {
+        refusal = await liveForeignOwner(sessionId);
+        if (refusal) return null;
+      }
+      return updateFrontmatterFields(contents, fields);
+    },
+    writeOpts,
+  );
+  if (!refusal) return result;
+  process.stderr.write(`⚠ markStateMdCompletedOnDisk: refusing ${result.path} — ${refusal}; nothing written (#1640)\n`);
+  return { ...result, written: false, reason: 'foreign-state-md' };
+}
+
 /**
  * Convenience wrapper: apply `touchUpdatedField` under the state-lock.
  *

package/scripts/lib/state-md/idle-reset.mjs

@@ -18,7 +18,7 @@
 
 import { parseStateMd, serializeStateMd } from './yaml-parser.mjs';
 import { existsSync } from 'node:fs';
-import { resolveStateMdPath, updateFrontmatterFields, writeStateMd } from './frontmatter-mutators.mjs';
+import { resolveStateMdWriteTarget, updateFrontmatterFields, warnForeignStateMd, writeStateMd } from './frontmatter-mutators.mjs';
 import { parseRecommendations } from './recommendations.mjs';
 
 /** Rule 7: the drift-baseline keys that must not survive into session N+1. */
@@ -201,7 +201,9 @@ export function resetStateMdToIdle(contents) {
 
 /**
  * Applies `resetStateMdToIdle` to the repo's STATE.md under the STATE.md lock
- * (`writeStateMd`). A missing or empty STATE.md is a no-op with reason `missing`.
+ * (`writeStateMd`). A missing or empty STATE.md is a no-op with reason `missing`;
+ * when the only STATE.md belongs to another platform's foreign session it is
+ * `foreign-state-md` (#1618), with one stderr WARN naming that file.
  * A write the size-ceiling / frontmatter-safe guards refuse comes back as
  * `changed: false` with that guard's reason.
  *
@@ -216,8 +218,15 @@ export async function resetStateMdToIdleOnDisk(repoRoot, opts = {}) {
   }
   // No STATE.md: answer before the lock, which would otherwise create
   // <repoRoot>/.orchestrator/ in whatever directory a mistyped root names.
-  const statePath = resolveStateMdPath(repoRoot);
-  if (!existsSync(statePath)) return { changed: false, reason: 'missing', path: statePath };
+  // Probe the same path writeStateMd will target (#1618), never a foreign one.
+  // The reset is the hand-over that turns the PREVIOUS session's completed
+  // record into idle, so a preferred `status: completed` file qualifies (#1640).
+  const writeOpts = { ...opts, completedHandoff: true };
+  const { path: statePath, rejected } = resolveStateMdWriteTarget(repoRoot, writeOpts);
+  if (!existsSync(statePath)) {
+    if (rejected) warnForeignStateMd('resetStateMdToIdleOnDisk', rejected, statePath);
+    return { changed: false, reason: rejected ? 'foreign-state-md' : 'missing', path: statePath };
+  }
   let reason;
   const result = await writeStateMd(
     repoRoot,
@@ -230,7 +239,7 @@ export async function resetStateMdToIdleOnDisk(repoRoot, opts = {}) {
       reason = reset.reason;
       return reset.changed ? reset.contents : null;
     },
-    opts,
+    writeOpts,
   );
   const out = { changed: result.written, path: result.path };
   const why = result.reason ?? reason;

package/scripts/lib/state-md/mission-status.mjs

@@ -23,7 +23,7 @@
  */
 
 import { parseStateMd, serializeStateMd } from './yaml-parser.mjs';
-import { updateFrontmatterFields, writeStateMd } from './frontmatter-mutators.mjs';
+import { resolveStateMdWriteTarget, updateFrontmatterFields, writeStateMd } from './frontmatter-mutators.mjs';
 
 const MISSION_STATUS_HEADING_RE = /^##\s+Mission Status\s*$/;
 const WRITER_TIMESTAMP_SOURCE = '\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z';
@@ -677,9 +677,13 @@ const REFUSAL_REASONS = Object.freeze({
  */
 export async function setMissionStatusOnDisk(repoRoot, taskId, status, opts = {}) {
   let refused;
+  // A fail-closed write target (#1618) hands an empty buffer; writeStateMd
+  // already names the rejected foreign STATE.md, so do not blame its content.
+  const foreign = resolveStateMdWriteTarget(repoRoot, opts).rejected !== null;
   const result = await writeStateMd(
     repoRoot,
     (contents) => {
+      if (foreign && contents === '') return contents;
       const outcome = setMissionStatusDetailed(contents, taskId, status);
       refused = outcome.refused;
       if (outcome.refused) {

package/scripts/lib/state-md-peer-guard.mjs

@@ -55,6 +55,8 @@ function orderedStateMdCandidates() {
  * @returns {string}  Absolute path (may not exist on disk).
  */
 function _resolveStateMdPath(repoRoot) {
+  // #1636 decision: no ownership filter here — this guard exists to SEE another
+  // session's STATE.md, so a foreign file is its input, not noise to drop.
   const candidates = orderedStateMdCandidates();
   for (const candidate of candidates) {
     const abs = join(repoRoot, candidate);

package/scripts/lib/state-md.mjs

@@ -19,6 +19,7 @@
 import { parseStateMd as _parseStateMd } from './state-md/yaml-parser.mjs';
 import { updateFrontmatterFields as _updateFrontmatterFields } from './state-md/frontmatter-mutators.mjs';
 import { readLock as _readLock } from './session-lock.mjs';
+import { readProcessLocalSessionIds as _readProcessLocalSessionIds } from './session-identity/own-session.mjs';
 
 export { parseStateMd, serializeStateMd } from './state-md/yaml-parser.mjs';
 
@@ -195,27 +196,49 @@ export function resolveSessionStartedAt({ repoRoot } = {}) {
 /**
  * The session ids a STATE.md writer may stamp into frontmatter: `session-id`
  * (the RAW/native harness id) and `session` (the semantic attribution label),
- * both read from the live lock.
+ * both read from the live lock — and `session-id` only when the lock is
+ * provably THIS process's own (#1663).
  *
- * Both fields are `null` when no usable lock exists — ABSENCE IS NEVER
- * COERCED, and a writer must then OMIT the key rather than write a
- * placeholder. Neither id grants ownership of anything (see
+ * The lock is repo-global: a session that lost the acquire race, or a
+ * pre-#1641 lock without `claude_pid` that survives until its TTL, names a
+ * PEER. Since #1661 `/close` decides ownership by comparing STATE.md
+ * `session-id` against `readProcessLocalSessionIds()`, so stamping the peer's
+ * id would make this session's own STATE.md read `foreign` and stop its own
+ * close. Hence:
+ *   - `session_id` is the lock's raw id only when it is contained in
+ *     `readProcessLocalSessionIds({ env })`; otherwise `null`. A process that
+ *     cannot name its own id (Cursor, Pi, Codex without a thread id) gets
+ *     `null` too — unprovable is not own.
+ *   - `semantic_session_id` is `null` when the lock is PROVABLY foreign (this
+ *     process has an id and the lock names another). Ceiling (BV-004): when
+ *     the process has no id at all, the label is still taken from the lock,
+ *     as before #1663, so the #429 label join keeps working on those
+ *     harnesses — it may then name a peer. Revisit when every harness
+ *     exposes a native id.
+ *
+ * ABSENCE IS NEVER COERCED: a writer must OMIT a `null` key rather than write
+ * a placeholder. Neither id grants ownership of anything (see
  * `skills/_shared/state-ownership.md`); `session-id` exists so `/close`'s #429
  * pre-check can join STATE.md to sessions.jsonl on a native identity instead
  * of falling through to the label + timestamp path.
  *
  * Never throws.
  *
- * @param {{ repoRoot?: string }} [opts]
+ * @param {{ repoRoot?: string, env?: object }} [opts]  `env` defaults to
+ *   `process.env`; injectable for tests.
  * @returns {{ session_id: string|null, semantic_session_id: string|null }}
  */
-export function resolveSessionIds({ repoRoot } = {}) {
+export function resolveSessionIds({ repoRoot, env = process.env } = {}) {
   const pick = (value) => (typeof value === 'string' && value.trim().length > 0 ? value.trim() : null);
   try {
     const lock = _readLock({ repoRoot });
+    const lockId = pick(lock?.session_id);
+    const ownIds = _readProcessLocalSessionIds({ env });
+    const own = lockId !== null && ownIds.includes(lockId);
+    const provablyForeign = lockId !== null && ownIds.length > 0 && !own;
     return {
-      session_id: pick(lock?.session_id),
-      semantic_session_id: pick(lock?.semantic_session_id),
+      session_id: own ? lockId : null,
+      semantic_session_id: provablyForeign ? null : pick(lock?.semantic_session_id),
     };
   } catch {
     return { session_id: null, semantic_session_id: null };

package/scripts/lib/sunset/walker.mjs

@@ -42,6 +42,7 @@ import path from 'node:path';
 import { normalizeSkillInvocation } from '../skill-invocations-schema.mjs';
 import { normalizeSkillJudgment } from '../skill-judgments-schema.mjs';
 import { isMainModule } from '../is-main-module.mjs';
+import { resolveLedgerPath } from '../ledger-path.mjs';
 import { userInvocableSkills } from '../user-invocable-skills.mjs';
 
 // ---------------------------------------------------------------------------
@@ -948,15 +949,15 @@ export function runSunsetWalk(repoRoot, opts = {}) {
 
   const subagentsPath =
     opts.subagentsPath ??
-    path.join(repoRoot, '.orchestrator', 'metrics', 'subagents.jsonl');
+    resolveLedgerPath('.orchestrator/metrics/subagents.jsonl', repoRoot);
 
   const invocationsPath =
     opts.invocationsPath ??
-    path.join(repoRoot, '.orchestrator', 'metrics', 'skill-invocations.jsonl');
+    resolveLedgerPath('.orchestrator/metrics/skill-invocations.jsonl', repoRoot);
 
   const judgmentsPath =
     opts.judgmentsPath ??
-    path.join(repoRoot, '.orchestrator', 'metrics', 'skill-judgments.jsonl');
+    resolveLedgerPath('.orchestrator/metrics/skill-judgments.jsonl', repoRoot);
 
   const surface = enumerateSurface(repoRoot);
   const dispatch = readDispatchCounts(subagentsPath, { windowDays, now: nowMs });

package/scripts/lib/telemetry/consent.mjs

@@ -159,11 +159,13 @@ export function readTelemetryState({ path } = {}) {
 export function writeTelemetryState(record, { path } = {}) {
   const target = path || TELEMETRY_JSON_PATH;
   try {
-    mkdirSync(dirname(target), { recursive: true });
+    // 0o700: the default target is the private config dir, which must not come
+    // out 0777 under umask 000 (#1629).
+    mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
   } catch (err) {
     return { ok: false, error: err?.message ?? String(err) };
   }
-  const res = writeJsonAtomicSync(target, record);
+  const res = writeJsonAtomicSync(target, record, { mode: 0o600 }); // consent + anon_id are host-private (#1632)
   return res.ok ? { ok: true } : { ok: false, error: res.error };
 }
 

package/scripts/lib/telemetry/queue.mjs

@@ -91,7 +91,7 @@ function _serializedByteLength(entries) {
  * via tmp-file + `renameSync` in the SAME directory (same-filesystem rename
  * is atomic on POSIX — mirrors `writeJsonAtomicSync` in `scripts/lib/io.mjs`,
  * which has no NDJSON-array variant). Creates the parent directory with
- * `mkdirSync(dir, { recursive: true })` first.
+ * `mkdirSync(dir, { recursive: true, mode: 0o700 })` first.
  *
  * @param {string} filePath
  * @param {Array<object>} entries
@@ -101,10 +101,10 @@ function _serializedByteLength(entries) {
  */
 function _writeEntriesAtomicSync(filePath, entries) {
   const dir = dirname(filePath);
-  mkdirSync(dir, { recursive: true });
+  mkdirSync(dir, { recursive: true, mode: 0o700 }); // private config dir; 0777 under umask 000 otherwise (#1629)
   const tmpSuffix = randomBytes(6).toString('hex');
   const tmpFile = join(dir, `.tmp.${tmpSuffix}`);
-  writeFileSync(tmpFile, _toNdjson(entries), 'utf8');
+  writeFileSync(tmpFile, _toNdjson(entries), { encoding: 'utf8', mode: 0o600 }); // rename keeps this mode (#1632)
   renameSync(tmpFile, filePath);
 }