session-orchestrator 5.3.0 → 5.5.0

package/hooks/post-bash-write-verify.mjs

@@ -109,6 +109,10 @@
  * observed actor could rewrite the gate unreported. Because the file is
  * typically gitignored, `git status` cannot see it anyway — change detection
  * for it is content-hash-based against the snapshot (`formatControlNotice`).
+ * Its sibling control state `<state-dir>/filescopes/**` (the per-agent scope
+ * declarations, #1020) is likewise not on the list: `computeReport` drops it
+ * from the violation set beside the manifest itself, keyed on the ACTIVE
+ * manifest's state dir (`isScopeDeclarationPath`, #1027 Pkt 5).
  *
  * The hook's OWN snapshot lives in `$TMPDIR`, never inside the repo, so it is
  * structurally incapable of reporting its own bookkeeping.
@@ -149,18 +153,24 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
-import { readFileSync, mkdirSync, writeFileSync, renameSync, realpathSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync, realpathSync, statSync } from 'node:fs';
 
 import { readStdin, writeStdoutLineSync } from '../scripts/lib/io.mjs';
-import { resolveProjectDir } from '../scripts/lib/platform.mjs';
-import { findScopeFile, pathMatchesPattern } from '../scripts/lib/hardening.mjs';
+import { resolveSessionRoot } from '../scripts/lib/platform.mjs';
+import { pathMatchesPattern } from '../scripts/lib/hardening.mjs';
 // #1057 — `sessionAgeMs` and its private `clockAgeMs` helper MOVED to the lib so
 // hooks/enforce-scope.mjs can read the same session clock without a hook->hook
 // import. Re-exported below, so this hook's public surface — and
 // tests/hooks/post-bash-write-verify.test.mjs, which imports the named export —
 // is unchanged. Two byte-identical copies of a clock is exactly the one-fact-two-
 // copies class this repo keeps paying for.
-import { sessionAgeMs, PEER_RECORD_PREFIX, isPeerRecordId } from '../scripts/lib/scope-gate.mjs';
+import {
+  sessionAgeMs,
+  PEER_RECORD_PREFIX,
+  isPeerRecordId,
+  isScopeDeclarationPath,
+  findOwnScopeFile,
+} from '../scripts/lib/scope-gate.mjs';
 // #1153 P1 — the same process-local ownership check hooks/enforce-scope.mjs
 // applies at Gate 3b. This hook reads the SAME working-copy `wave-scope.json`,
 // so without it a peer session's manifest drives this session's advisories.
@@ -313,6 +323,45 @@ export function parsePorcelainZ(raw) {
   return out;
 }
 
+/**
+ * Rebase toplevel-relative porcelain paths onto the SESSION ROOT.
+ *
+ * `git status --porcelain` names paths relative to the git TOPLEVEL, while
+ * `allowedPaths`, the ignore list and the manifest path are relative to the
+ * session root — since #1492 the LAUNCH DIR, which in a session started from a
+ * repo subdirectory (`<mono>/packages/foo`) sits below the toplevel. Judged
+ * unrebased, an in-scope write to `packages/foo/src/new.mjs` failed `src/**`
+ * (false positive) and a write to `<mono>/src/evil.mjs` matched it (false
+ * negative). A path under the prefix loses it; every other path is outside the
+ * project root and is spelled `../…` from the session root — the same category
+ * enforce-scope Gate 6 denies, and a spelling no allowedPaths entry can grant
+ * (see {@link isOutsideSessionRoot}).
+ *
+ * @param {string[]} paths toplevel-relative, forward slashes
+ * @param {string} prefix session root relative to the toplevel ('' = same dir)
+ * @returns {string[]}
+ */
+export function rebaseToSessionRoot(paths, prefix) {
+  const clean = typeof prefix === 'string' ? prefix.replace(/\/+$/, '') : '';
+  // '' = the session root IS the toplevel; '..'/absolute cannot come from
+  // `--show-prefix` and would make the arithmetic meaningless — leave as is.
+  if (clean === '' || clean.startsWith('..') || clean.startsWith('/')) return paths;
+  const head = `${clean}/`;
+  const ups = clean.split('/').map(() => '..').join('/');
+  return paths.map((p) => (p.startsWith(head) ? p.slice(head.length) : `${ups}/${p}`));
+}
+
+/**
+ * Is this (session-root-relative) path outside the project root — a `../…`
+ * spelling produced by {@link rebaseToSessionRoot}? Never in scope.
+ *
+ * @param {string} relPath
+ * @returns {boolean}
+ */
+export function isOutsideSessionRoot(relPath) {
+  return relPath === '..' || relPath.startsWith('../');
+}
+
 /**
  * Is a repo-relative path covered by the wave's `allowedPaths`?
  *
@@ -384,14 +433,17 @@ export function readPeerScopeRecords(stateDir, wave) {
  * Which peer record — if any — declared this path?
  *
  * Same matcher as `isInScope`, so a peer's declaration is read exactly the way
- * the wave's own `allowedPaths` are.
+ * the wave's own `allowedPaths` are — and the same outside-root guard as
+ * `computeReport`: a `../…` path is outside the project root, which no peer
+ * record can grant any more than `allowedPaths` can (a peer glob over every
+ * `.md` file would otherwise file `<mono>/NOTES.md` as an agreed peer write).
  *
  * @param {string} relPath
  * @param {Array<{ id: string, files: string[] }>} peerRecords
  * @returns {string|null} the peer record id, or null
  */
 export function peerRecordFor(relPath, peerRecords) {
-  if (!Array.isArray(peerRecords)) return null;
+  if (!Array.isArray(peerRecords) || isOutsideSessionRoot(relPath)) return null;
   for (const record of peerRecords) {
     if (record.files.some((p) => pathMatchesPattern(relPath, p))) return record.id;
   }
@@ -466,14 +518,22 @@ export function snapshotPathFor(repoRoot) {
 export function computeReport({ dirtyPaths, allowedPaths, snapshot, signature, scopeMtimeMs = null, mtimeMs = null, scopeRelPath = null }) {
   const outOfScope = dirtyPaths
     .filter((p) => !isIgnoredPath(p))
-    .filter((p) => !isInScope(p, allowedPaths))
+    // A `../…` path (outside the project root, see rebaseToSessionRoot) is never
+    // in scope — not even under a broad glob that would happen to match it.
+    .filter((p) => isOutsideSessionRoot(p) || !isInScope(p, allowedPaths))
     // The wave-scope.json control file is out-of-scope by construction (it is
     // never under allowedPaths) but its CHANGES are reported via the content-hash
     // control-notice path, not here. Excluding it keeps the mtime re-baseline
     // filter from reporting the scope file against ITSELF — its mtime always
     // equals scopeMtimeMs, so the MED-3 `>=` boundary would otherwise flag it on
     // every first run (#938 MED-3 follow-through).
-    .filter((p) => p !== scopeRelPath);
+    .filter((p) => p !== scopeRelPath)
+    // Its sibling control state, `<state-dir>/filescopes/` (the per-agent scope
+    // declarations `materialize-wave-scope.mjs` writes once per wave), is no
+    // wave territory either — excluded the same way, not via
+    // IGNORED_PATH_PATTERNS, so the exemption follows THIS manifest's state dir
+    // instead of granting all four harness dirs (#1027 Pkt 5).
+    .filter((p) => !isScopeDeclarationPath(p, scopeRelPath));
 
   const rebaselined = !snapshot || snapshot.signature !== signature;
   const seen = rebaselined || !Array.isArray(snapshot?.paths) ? new Set() : new Set(snapshot.paths);
@@ -515,7 +575,9 @@ export function computeReport({ dirtyPaths, allowedPaths, snapshot, signature, s
  * @returns {string}
  */
 export function formatMessage(report, allowedCount) {
-  const shown = report.slice(0, MAX_REPORTED_PATHS);
+  const shown = report
+    .slice(0, MAX_REPORTED_PATHS)
+    .map((p) => (isOutsideSessionRoot(p) ? `${p} (outside project root)` : p));
   const more = report.length - shown.length;
   const tail = more > 0 ? ` (+${more} more)` : '';
   const msg =
@@ -608,12 +670,13 @@ export function formatSnapshotMissingNotice({ sessionAge = null, scopeAge = null
 // ---------------------------------------------------------------------------
 
 /**
- * Collect the working-tree dirty set. Returns null when git is unavailable, the
+ * Collect the working-tree dirty set, rebased onto the session root
+ * ({@link rebaseToSessionRoot}). Returns null when git is unavailable, the
  * directory is not a repo, or the call times out — all of which mean "no signal
  * to report", never a warning.
  *
- * @param {string} repoRoot
- * @returns {string[]|null}
+ * @param {string} repoRoot the session root
+ * @returns {string[]|null} session-root-relative paths (`../…` = outside it)
  */
 function readDirtyPaths(repoRoot) {
   try {
@@ -630,7 +693,16 @@ function readDirtyPaths(repoRoot) {
       ['--no-optional-locks', 'status', '--porcelain', '-z', '--no-renames', '--untracked-files=all'],
       { cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER, stdio: ['ignore', 'pipe', 'ignore'] },
     );
-    return parsePorcelainZ(raw);
+    // Porcelain paths are toplevel-relative; everything they are judged against
+    // is session-root-relative. A `.git` AT the session root makes it the
+    // toplevel (prefix ''), so the extra spawn is paid only by a session
+    // launched from a repo subdirectory.
+    const prefix = existsSync(path.join(repoRoot, '.git'))
+      ? ''
+      : execFileSync('git', ['rev-parse', '--show-prefix'], {
+        cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
+    return rebaseToSessionRoot(parsePorcelainZ(raw), prefix);
   } catch {
     return null;
   }
@@ -807,7 +879,10 @@ async function main() {
   // G2 — only Bash calls carry the bypass risk this hook watches.
   if (input.tool_name !== 'Bash') return;
 
-  const repoRootRaw = resolveProjectDir();
+  // #1492 — the SESSION's working copy, not the launch dir `$CLAUDE_PROJECT_DIR`
+  // keeps after `EnterWorktree` (the manifest lives in the worktree). See
+  // `resolveSessionRoot` in scripts/lib/platform.mjs.
+  const repoRootRaw = resolveSessionRoot(input.cwd);
   let repoRoot;
   try {
     repoRoot = realpathSync(repoRootRaw);
@@ -833,7 +908,14 @@ async function main() {
   // G3 — no wave scope → nothing defines "outside". #938: if a previous call
   // RECORDED a scope state, the control file's disappearance is itself a
   // control-file change and gets one visible (non-alarming) notice.
-  const scopePath = findScopeFile(repoRoot);
+  //
+  // #1504 point 6 — the first manifest that is not provably a peer's, so a
+  // peer's higher-precedence manifest no longer hides this session's own one;
+  // only when every candidate is foreign does the first come back, and G3b
+  // below keeps its stand-down and its rebind notice unchanged.
+  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+  const located = findOwnScopeFile(repoRoot, ownIds, classifyManifestSession);
+  const scopePath = located.path ?? located.foreignPath;
   if (!scopePath) {
     if (prevScopeState && prevScopeState.hash !== 'absent') {
       writeSnapshot(snapFile, {
@@ -857,7 +939,7 @@ async function main() {
   } catch {
     /* raw stays null (unreadable) or scope stays null (unparseable) */
   }
-  if (raw === null) return; // file vanished between findScopeFile and read
+  if (raw === null) return; // file vanished between findOwnScopeFile and read
 
   // The control-file identity of THIS call, computed BEFORE the G3b
   // stand-down (W4/F7). Ordering is the whole fix: G3b used to `return` above
@@ -898,7 +980,6 @@ async function main() {
   // CLI, Cursor today) the own-id set is empty, so this gate is permanently
   // `'unknown'` = full pre-#1153 behaviour there.
   {
-    const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
     const { verdict, manifestIds } = classifyManifestSession(scope ?? {}, ownIds);
     if (verdict === 'foreign') {
       // Observability only — one event per stand-down decision, awaited so the

package/hooks/post-edit-validate.mjs

@@ -35,8 +35,13 @@ import { shouldRunHook } from './_lib/profile-gate.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 
 import { readStdin } from '../scripts/lib/io.mjs';
-import { resolveProjectDir } from '../scripts/lib/platform.mjs';
-import { findScopeFile, gateEnabled } from '../scripts/lib/hardening.mjs';
+import { resolveSessionRoot } from '../scripts/lib/platform.mjs';
+import { gateEnabled } from '../scripts/lib/hardening.mjs';
+import { findOwnScopeFile } from '../scripts/lib/scope-gate.mjs';
+import {
+  classifyManifestSession,
+  readProcessLocalSessionIds,
+} from '../scripts/lib/session-identity/own-session.mjs';
 import { readConfigFile, parseSessionConfig } from '../scripts/lib/config.mjs';
 
 // ---------------------------------------------------------------------------
@@ -184,7 +189,9 @@ async function main() {
   const ext = path.extname(filePath).toLowerCase();
   if (!TS_EXTS.has(ext)) process.exit(0);
 
-  const projectRoot = resolveProjectDir();
+  // The SESSION root the scope guards use (#1492, #1504 point 4) — not the
+  // launch dir, which stays put while a session works in an entered worktree.
+  const projectRoot = resolveSessionRoot(input?.cwd);
 
   // Compute relative path (REQ-03)
   const absFilePath = path.isAbsolute(filePath)
@@ -192,8 +199,11 @@ async function main() {
     : path.resolve(projectRoot, filePath);
   const relPath = path.relative(projectRoot, absFilePath);
 
-  // G5: per-gate toggle — skip if post-edit-validate gate is disabled
-  const scopeFile = findScopeFile(projectRoot);
+  // G5: per-gate toggle — skip if post-edit-validate gate is disabled. Only
+  // THIS session's manifest may switch it off: a peer's manifest in the same
+  // working copy is skipped, and a peer-only result means no toggle (#1504).
+  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+  const { path: scopeFile } = findOwnScopeFile(projectRoot, ownIds, classifyManifestSession);
   if (scopeFile && !gateEnabled(scopeFile, 'post-edit-validate')) {
     process.exit(0);
   }

package/hooks/post-tool-batch-wave-signal.mjs

@@ -66,21 +66,22 @@
  * hooks.json wiring is managed separately (W3-C4 scope).
  */
 
-import { execFileSync, spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { performance } from 'node:perf_hooks';
-import { fileURLToPath } from 'node:url';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 
-import { getProjectDir } from '../scripts/lib/platform.mjs';
+import { getProjectDir, resolveSessionRoot } from '../scripts/lib/platform.mjs';
 import { emitEvent } from '../scripts/lib/events.mjs';
-import { findScopeFile } from '../scripts/lib/scope-gate.mjs';
+import { findOwnScopeFile } from '../scripts/lib/scope-gate.mjs';
+import {
+  classifyManifestSession,
+  readProcessLocalSessionIds,
+} from '../scripts/lib/session-identity/own-session.mjs';
 import { atomicMutateJson } from './_lib/atomic-json.mjs';
-import { _parseReaper } from '../scripts/lib/config/reaper.mjs';
+import { maybeTriggerOrphanScan } from '../scripts/lib/orphan-reaper/trigger.mjs';
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -203,18 +204,23 @@ async function ownsSessionFile(input, sessionFile) {
  * wave-scope.json absent"). The file is deleted mid-session at Quality phase
  * transitions and final cleanup, so absence is an expected, non-error state.
  *
- * The manifest is located via `findScopeFile()` (#1082), the same precedence
+ * The manifest is located via `findOwnScopeFile()` (#1504), the same precedence
  * every other consumer uses — `.pi` > `.cursor` > `.codex` > `.claude`. The
  * previous hard-coded `.claude/` path made this hook's whole wave-lifecycle
  * fallback structurally dead on Codex CLI, Cursor and pi: the manifest exists,
  * it just is not under `.claude/`, so every batch read 0 and no
  * wave-lifecycle event was ever emitted there.
  *
- * @param {string} projectDir
+ * Only THIS session's manifest counts (#1504): `findOwnScopeFile` skips a
+ * peer's manifest in the same working copy, and a peer-only result is "no own
+ * wave" → 0, never the peer's number recorded as ours.
+ *
+ * @param {string} projectDir  the session root (`resolveSessionRoot`)
+ * @param {Set<string>} ownIds  this process's own session ids
  * @returns {Promise<number>}
  */
-async function resolveWaveNumber(projectDir) {
-  const waveFile = findScopeFile(projectDir);
+async function resolveWaveNumber(projectDir, ownIds) {
+  const { path: waveFile } = findOwnScopeFile(projectDir, ownIds, classifyManifestSession);
   if (waveFile === null) return 0;
   try {
     const raw = await readFile(waveFile, 'utf8');
@@ -308,145 +314,6 @@ function countFilesChangedSince(projectDir, sha) {
   }
 }
 
-// ---------------------------------------------------------------------------
-// orphan-reaper trigger (#1432 B4)
-// ---------------------------------------------------------------------------
-//
-// DUPLICATED VERBATIM between the two trigger hooks —
-// hooks/post-tool-batch-wave-signal.mjs <-> hooks/on-stop.mjs. Deliberate, with
-// a named revisit trigger (BV-004): they are the only two trigger points the
-// PRD declares, and a shared `hooks/_lib/reaper-trigger.mjs` would be a third
-// file in the hook import graph. SIZE, measured 2026-09-22 by diffing the two
-// blocks: 138 identical lines — this note said "~40 lines of glue" until then,
-// which is what made the duplicate look cheaper than it is. Extract it the
-// moment a THIRD hook needs the trigger, or the moment the copies must differ.
-
-/**
- * Filesystem path of the scan CLI, spawned as a PLAIN argv call.
- *
- * It used to be a `file://` URL handed to `node --input-type=module -e
- * <program>`, because `scripts/lib/orphan-reaper.mjs` had no entry guard. It
- * has one now (`parseReaperCliArgs` + the `isMainModule` tail), so the child's
- * contract lives in that module instead of as source text duplicated here —
- * and nothing this hook builds is a program any more: every variable part is
- * an argv value, which cannot become code whatever the checkout path contains.
- *
- * `fileURLToPath`, not `new URL(...).pathname`: the latter leaves a
- * percent-encoded path for any checkout directory containing a space.
- */
-const ORPHAN_REAPER_SCRIPT = fileURLToPath(
-  new URL('../scripts/lib/orphan-reaper.mjs', import.meta.url),
-);
-
-/**
- * Read the `reaper:` block from the project's Session Config host file.
- * Sync + inline, mirroring `hooks/loop-guard.mjs` `loadConfig()` — a hot hook
- * path must not import the full config orchestrator. A missing or unreadable
- * file yields the parser defaults, i.e. DISABLED.
- *
- * @param {string} projectDir
- * @returns {ReturnType<typeof _parseReaper>}
- */
-function loadReaperConfig(projectDir) {
-  for (const name of ['CLAUDE.md', 'AGENTS.md']) {
-    try {
-      return _parseReaper(readFileSync(path.join(projectDir, name), 'utf8'));
-    } catch {
-      // missing or unreadable — try the next candidate
-    }
-  }
-  return _parseReaper('');
-}
-
-/**
- * Trigger the orphan scan, throttled and NON-BLOCKING (PRD FA4).
- *
- * The hook itself does exactly two pieces of I/O — one config read and one
- * `stat` of the throttle marker — and then hands the work to a DETACHED,
- * unref'd child. The scan is never run inline: one `ps` round-trip out of Node
- * was measured at ~47 ms over 287 KB of output, which alone would blow the
- * 50 ms `reaper.max-hook-latency-ms` budget this hook has to stay inside.
- *
- * The marker is stamped BEFORE the spawn, so a spawn that fails still consumes
- * the throttle window — otherwise a broken spawn would be retried on every
- * single tool batch.
- *
- * `reaper.max-hook-latency-ms` is the ceiling on the work above — measured here
- * with `performance.now()` and reported as ONE stderr WARN line when exceeded.
- * A WARN and not an event: this fires from a `PostToolBatch`-class hook, and a
- * per-fire telemetry record is exactly the always-on signal
- * `.claude/rules/host-resources.md` HR-101 calls a broken instrument. The
- * measurement covers preparation only — the scan itself runs detached, which is
- * the whole reason the budget can be held.
- *
- * Never throws: any failure degrades silently (PRD FA4 "lautlos degradieren").
- *
- * @param {object} [opts]
- * @param {string} [opts.projectDir]  Repo root; defaults to `getProjectDir()`.
- * @param {number} [opts.now]         Injected clock (ms).
- * @param {Function} [opts.spawnFn]   Injected `spawn` (tests).
- * @param {Function} [opts.statFn]    Injected `statSync` (tests).
- * @param {Function} [opts.writeFn]   Injected marker writer (tests).
- * @param {() => number} [opts.clockFn]  Injected monotonic clock for the latency
- *   budget (tests); defaults to `performance.now`.
- * @returns {Promise<{spawned: boolean, reason: string}>}
- */
-export async function maybeTriggerOrphanScan({
-  projectDir,
-  now,
-  spawnFn = spawn,
-  statFn,
-  writeFn,
-  clockFn = () => performance.now(),
-} = {}) {
-  const startedAt = clockFn();
-  /** One WARN line when the preparation overran `reaper.max-hook-latency-ms`. */
-  const checkLatency = (budgetMs) => {
-    const elapsed = clockFn() - startedAt;
-    if (Number.isFinite(budgetMs) && budgetMs > 0 && elapsed > budgetMs) {
-      process.stderr.write(
-        `orphan-reaper trigger: hook latency ${elapsed.toFixed(1)} ms exceeded `
-        + `reaper.max-hook-latency-ms (${budgetMs} ms)\n`,
-      );
-    }
-  };
-  try {
-    const root = typeof projectDir === 'string' && projectDir ? projectDir : getProjectDir();
-    const cfg = loadReaperConfig(root);
-    // Cheapest gate first: disabled means no stat, no spawn, no module load.
-    if (cfg.enabled !== true) return { spawned: false, reason: 'disabled' };
-
-    const reaper = await import('../scripts/lib/orphan-reaper.mjs');
-    const markerPath = reaper.scanMarkerPath(root);
-    const nowMs = typeof now === 'number' ? now : Date.now();
-
-    if (!reaper.shouldScanNow(markerPath, nowMs, cfg['min-scan-interval-seconds'], { statFn })) {
-      checkLatency(cfg['max-hook-latency-ms']);
-      return { spawned: false, reason: 'throttled' };
-    }
-    reaper.touchScanMarker(markerPath, { writeFn });
-
-    const child = spawnFn(
-      process.execPath,
-      [
-        ORPHAN_REAPER_SCRIPT,
-        '--repo-root', root,
-        '--mode', cfg.mode,
-        '--min-age-seconds', String(cfg['min-age-seconds']),
-        '--kill-grace-ms', String(cfg['kill-grace-ms']),
-        '--verify-wait-ms', String(cfg['verify-wait-ms']),
-        '--false-alarm-window', String(cfg['false-alarm-window']),
-      ],
-      { detached: true, stdio: 'ignore' },
-    );
-    if (child && typeof child.unref === 'function') child.unref();
-    checkLatency(cfg['max-hook-latency-ms']);
-    return { spawned: true, reason: 'spawned' };
-  } catch {
-    return { spawned: false, reason: 'error' };
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
@@ -594,7 +461,10 @@ async function main() {
     // when an N+1 transition already closed wave N, SessionEnd sees
     // last_wave_completed === last_wave and stays silent.
     try {
-      const wave = await resolveWaveNumber(getProjectDir());
+      const wave = await resolveWaveNumber(
+        resolveSessionRoot(input?.cwd),
+        new Set(readProcessLocalSessionIds({ hookInput: input })),
+      );
       if (wave > 0) {
         // Read last_wave from the just-written session file (after the
         // last_batch RMW above, so we observe the latest persisted value).
@@ -713,7 +583,17 @@ async function main() {
   // `process.exit(0)` in a `finally`: an un-awaited spawn would race the exit.
   // The await is bounded by design — one config read, one stat, one detached
   // spawn, all measured under `reaper.max-hook-latency-ms` (50 ms).
-  await maybeTriggerOrphanScan();
+  //
+  // The returned reason is deliberately NOT recorded here (#1489): this hook
+  // emits no record per batch, and adding one is the per-fire telemetry HR-101
+  // rejects. The throttle marker is one file per repo, so a defeated marker
+  // (`spawned-unthrottled`) shows on the next Stop/SubagentStop record, whose
+  // `reaper_trigger` key hooks/on-stop.mjs fills from the same trigger.
+  //
+  // Rooted at the SESSION root (#1492 point 2, #1504 point 4): the quality gate
+  // registers its children in the ledger of the tree it runs in, which for an
+  // entered worktree is the worktree — the launch dir holds none of them.
+  await maybeTriggerOrphanScan({ projectDir: resolveSessionRoot(input?.cwd) });
 }
 
 // Entry guard (#1393): run only as the node script the harness execs — a bare

package/hooks/pre-bash-memory-propose-audit.mjs

@@ -24,11 +24,17 @@
 
 import { readStdin, emitAllow } from '../scripts/lib/io.mjs';
 import crypto from 'node:crypto';
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
+import os from 'node:os';
 import path from 'node:path';
 import { emitEvent } from '../scripts/lib/events.mjs';
-import { findScopeFile } from '../scripts/lib/hardening.mjs';
+import { resolveSessionRoot } from '../scripts/lib/platform.mjs';
+import { findOwnScopeFile } from '../scripts/lib/scope-gate.mjs';
+import {
+  classifyManifestSession,
+  readProcessLocalSessionIds,
+} from '../scripts/lib/session-identity/own-session.mjs';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
@@ -86,7 +92,8 @@ const KNOWN_FLAGS = Object.freeze([
  *
  * WHY THE HASH IS HERE (#1415, 2026-09-21): until today this hook wrote a
  * merely flag-redacted `argv_truncated` (512 chars of command text) into
- * `orchestrator.memory.propose_invoked` — a TRACKED `events.jsonl` line and,
+ * `orchestrator.memory.propose_invoked` — an `events.jsonl` line (gitignored
+ * here via `.gitignore:57`; consumer repos may track it) and,
  * with the webhook configured, a network payload. Redaction covered only the
  * five `--insight/--subject/--evidence/--content/--reason` values and said so
  * in its own caveat: `$VAR`, `$(cat secret)` and any value written elsewhere
@@ -123,6 +130,53 @@ function flagsPresent(command) {
   );
 }
 
+/**
+ * The working directory as a value that carries no absolute host path (#1439).
+ *
+ * Relative to `projectDir` (`.` when equal); a directory OUTSIDE the project is
+ * written as `sha256:<12 hex>` of its resolved path instead — still groupable,
+ * never the path itself. Until 2026-09-25 this was `process.cwd()` verbatim,
+ * i.e. `/Users/<name>/…` in an events.jsonl line (gitignored here via
+ * `.gitignore:57`; consumer repos may track it) and, with the webhook
+ * configured, in a network payload. No production reader consumes `cwd`.
+ *
+ * Both sides are realpath-resolved before comparing: on macOS the tmp dir is
+ * `/var/…` while `process.cwd()` reports `/private/var/…`, and a naive
+ * `path.relative` then calls the project dir itself `../../../private/var/…`.
+ * A path that cannot be resolved falls back to `path.resolve` — never throws.
+ *
+ * A project dir that is no project boundary — the filesystem root, the home
+ * dir, or an ancestor of it (`/Users`) — also gets the hash form: relative to
+ * `/` the cwd reads `Users/<name>/…`, i.e. the username in a webhook-bound
+ * event, the very leak the relative form exists to prevent. The ancestor test
+ * is path-segment-wise (`path.relative`), so `/Users/al` is NOT an ancestor of
+ * `/Users/alice` the way a string prefix would claim.
+ *
+ * @param {string} cwd
+ * @param {string} projectDir
+ * @returns {string}
+ */
+function relativeCwd(cwd, projectDir) {
+  const real = (p) => {
+    try { return realpathSync(p); } catch { return path.resolve(p); }
+  };
+  // `..`-prefixed (above the base) or absolute (another Windows drive).
+  const escapes = (rel) =>
+    rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
+  const realCwd = real(cwd);
+  const realProject = real(projectDir);
+  const rel = path.relative(realProject, realCwd);
+  if (rel === '') return '.';
+  // Same sha256 recipe as `command_hash`, cut to 12 hex.
+  const hashed = `sha256:${hashCommand(realCwd).slice(0, 12)}`;
+  if (escapes(rel)) return hashed;
+  if (path.dirname(realProject) === realProject) return hashed; // filesystem root
+  let home = null;
+  try { home = real(os.homedir()); } catch { /* no home dir: root check above still holds */ }
+  if (home !== null && !escapes(path.relative(realProject, home))) return hashed;
+  return rel;
+}
+
 /**
  * Resolve the session_id from the hook stdin payload, with fallback to the
  * persisted file written by on-session-start.mjs. Returns null when neither
@@ -152,14 +206,16 @@ async function resolveSessionId(input, projectDir) {
 }
 
 /**
- * Resolve the current wave number from the active wave-scope.json.
- * Returns 0 when the file is absent or unparseable.
+ * Resolve the current wave number from THIS session's wave-scope.json.
+ * Returns 0 when the file is absent or unparseable — and when the only
+ * manifest is a peer's (#1504): its number is not this session's wave.
  *
- * @param {string} projectDir
+ * @param {string} projectDir  the session root (`resolveSessionRoot`)
+ * @param {Set<string>} ownIds  this process's own session ids
  * @returns {Promise<number>}
  */
-async function resolveWave(projectDir) {
-  const waveFile = findScopeFile(projectDir);
+async function resolveWave(projectDir, ownIds) {
+  const { path: waveFile } = findOwnScopeFile(projectDir, ownIds, classifyManifestSession);
   if (!waveFile || !existsSync(waveFile)) return 0;
   try {
     const raw = await readFile(waveFile, 'utf8');
@@ -198,7 +254,12 @@ async function main() {
   const sessionId = await resolveSessionId(input, projectDir);
 
   // G5 — resolve wave
-  const wave = await resolveWave(projectDir);
+  // Read at the SESSION root the scope guards use (#1504 point 4), not at the
+  // launch dir above, which stays put while the session works in a worktree.
+  const wave = await resolveWave(
+    resolveSessionRoot(input.cwd),
+    new Set(readProcessLocalSessionIds({ hookInput: input })),
+  );
 
   // G6 — derive the non-reversible argv summary (#1415). Nothing downstream
   // ever sees the command text: hash for grouping, known flag NAMES for
@@ -219,7 +280,7 @@ async function main() {
       command_hash: commandHash,
       flags_present: flags,
       argv_length: command.length,
-      cwd: process.cwd(),
+      cwd: relativeCwd(process.cwd(), projectDir),
       exit_code: null,
     });
   } catch { /* telemetry never blocks the hook (#1183) */ }