session-orchestrator 5.4.0 → 5.5.0

package/hooks/on-stop.mjs

@@ -27,11 +27,12 @@
  *                  "duration_ms":<int>,"duration_source":"meta-birthtime","status":"done"}
  *                (#1190 — every key after `event` is OPTIONAL and OMITTED when the
  *                 measurement could not be made; `agent` too. See docs/events-schema.md.)
+ *   Both records also carry `"reaper_trigger":"<reason>"` whenever `reaper.enabled`
+ *   is true — the orphan-reaper trigger outcome of this fire (#1489, see
+ *   `reaperTriggerField`); omitted when the reaper is disabled.
  */
 
 import path from 'node:path';
-import { spawn } from 'node:child_process';
-import { performance } from 'node:perf_hooks';
 import {
   promises as fs,
   existsSync,
@@ -39,19 +40,23 @@ import {
   statSync,
   writeFileSync,
 } from 'node:fs';
-import { fileURLToPath } from 'node:url';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
 import { readTailWindow } from '../scripts/lib/tail-window.mjs';
 import { AGENT_ID_RE, resolveSubagentSidecar } from './_lib/subagent-paths.mjs';
 
 import { emitEvent } from '../scripts/lib/events.mjs';
-import { detectPlatform, getProjectDir } from '../scripts/lib/platform.mjs';
+import { detectPlatform, getProjectDir, resolveSessionRoot } from '../scripts/lib/platform.mjs';
+import { findOwnScopeFile } from '../scripts/lib/scope-gate.mjs';
+import {
+  classifyManifestSession,
+  readProcessLocalSessionIds,
+} from '../scripts/lib/session-identity/own-session.mjs';
 import { parseSessionId } from '../scripts/lib/session-id.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 import { heartbeat, logSweepEvent } from '../scripts/lib/session-registry.mjs';
 import { readLock, updateHeartbeat } from '../scripts/lib/session-lock.mjs';
-import { _parseReaper } from '../scripts/lib/config/reaper.mjs';
+import { maybeTriggerOrphanScan } from '../scripts/lib/orphan-reaper/trigger.mjs';
 
 // ---------------------------------------------------------------------------
 // stdin reading (inline — no io.mjs because Stop hooks exit 0 always, never deny)
@@ -211,25 +216,26 @@ async function gitInfo(projectRoot) {
 // ---------------------------------------------------------------------------
 
 /**
- * Try to read the wave number from .claude/wave-scope.json (or .codex / .cursor / .pi).
- * Returns 0 if no scope file is found or the file cannot be parsed.
- * @param {string} projectRoot
+ * Read the wave number from THIS session's wave-scope manifest at the session
+ * root — the same root and the same `.pi` > `.cursor` > `.codex` > `.claude`
+ * precedence the scope guards use (#1504 point 4). A peer's manifest in the
+ * same working copy is skipped; a peer-only result is "no own wave" → 0.
+ * Returns 0 too when the manifest is absent or cannot be parsed.
+ *
+ * @param {string} sessionRoot  `resolveSessionRoot(input.cwd)`
+ * @param {object|null} input   the hook payload (its `session_id` is ours)
  * @returns {Promise<number>}
  */
-async function readWaveNumber(projectRoot) {
-  const dirs = ['.pi', '.claude', '.codex', '.cursor'];
-  for (const dir of dirs) {
-    const scopePath = path.join(projectRoot, dir, 'wave-scope.json');
-    try {
-      const raw = await fs.readFile(scopePath, 'utf8');
-      const obj = JSON.parse(raw);
-      const wave = typeof obj.wave === 'number' ? obj.wave : 0;
-      return wave;
-    } catch {
-      // file missing or unparseable — try next
-    }
+async function readWaveNumber(sessionRoot, input) {
+  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+  const { path: scopePath } = findOwnScopeFile(sessionRoot, ownIds, classifyManifestSession);
+  if (scopePath === null) return 0;
+  try {
+    const obj = JSON.parse(await fs.readFile(scopePath, 'utf8'));
+    return typeof obj?.wave === 'number' ? obj.wave : 0;
+  } catch {
+    return 0; // unreadable or unparseable — no wave known
   }
-  return 0;
 }
 
 // ---------------------------------------------------------------------------
@@ -363,14 +369,40 @@ function resolveStopDuration(input, projectRoot) {
   }
 }
 
+/**
+ * The orphan-reaper trigger outcome as an optional record key (#1489).
+ *
+ * `reaper_trigger` carries the reason `maybeTriggerOrphanScan()` returned for
+ * THIS hook fire — `throttled` | `spawned` | `spawned-unthrottled` | `error` —
+ * on the record this hook emits anyway, so no new record type and no per-fire
+ * event exist (HR-101). `spawned-unthrottled` is the case it is here for: a
+ * throttle marker the trigger cannot stamp (a planted link or directory, a
+ * read-only tmp dir) makes every fire spawn a scan, and until now that outcome
+ * was discarded in `main()` — a defeated throttle nothing recorded (HR-105).
+ * Recording the healthy reasons too gives that count its denominator: the
+ * share of armed fires that ran unthrottled, from events.jsonl alone (HR-106).
+ *
+ * OMITTED when the reaper is disabled (the default): that is configuration,
+ * not a measurement, and stamping it would touch every record on every host.
+ *
+ * @param {{reason?: unknown}|null|undefined} trigger
+ * @returns {{reaper_trigger?: string}}
+ */
+function reaperTriggerField(trigger) {
+  const reason = trigger?.reason;
+  if (typeof reason !== 'string' || reason === 'disabled') return {};
+  return { reaper_trigger: reason };
+}
+
 /**
  * Handle a Stop event. Reads wave from scope file + git info, appends JSONL.
  * @param {object|null} input
+ * @param {{reason?: string}|null} [reaperTrigger]  `maybeTriggerOrphanScan()` result.
  */
-async function handleStop(input) {
+async function handleStop(input, reaperTrigger = null) {
   const projectRoot = getProjectDir();
 
-  const wave = await readWaveNumber(projectRoot);
+  const wave = await readWaveNumber(resolveSessionRoot(input?.cwd), input);
   const { commit, branch } = await gitInfo(projectRoot);
 
   const { sessionId, semanticSessionId } = await resolveSessionId(input, projectRoot);
@@ -483,6 +515,7 @@ async function handleStop(input) {
     ...(branch !== null ? { branch } : {}),
     ...(commit !== null ? { commit } : {}),
     ...duration,
+    ...reaperTriggerField(reaperTrigger),
   };
 
   try {
@@ -500,9 +533,10 @@ async function handleStop(input) {
  * coordinator turn. Currently always returns null (no inline warning from this
  * handler) — the slot is reserved for future SubagentStop feedback.
  * @param {object|null} input
+ * @param {{reason?: string}|null} [reaperTrigger]  `maybeTriggerOrphanScan()` result.
  * @returns {Promise<string|null>} additionalContext or null
  */
-async function handleSubagentStop(input) {
+async function handleSubagentStop(input, reaperTrigger = null) {
   /** @type {Record<string, unknown>} */
   const payload = {};
 
@@ -633,8 +667,12 @@ async function handleSubagentStop(input) {
   // #1183 — a malformed record throws EventValidationError BEFORE any side
   // effect (scripts/lib/events.mjs); this hook must never abort on that, so
   // the emit is wrapped rather than left to propagate.
+  // A fresh object via spread (like the Stop record above), never
+  // Object.assign onto a parsed payload: spread defines keys, so no `__proto__`
+  // key can reach the prototype setter (CWE-1321, semgrep
+  // prototype-pollution-object-assign).
   try {
-    await emitEvent('orchestrator.agent.stopped', payload);
+    await emitEvent('orchestrator.agent.stopped', { ...payload, ...reaperTriggerField(reaperTrigger) });
   } catch { /* telemetry never blocks the hook (#1183) */ }
   return null;
 }
@@ -775,147 +813,6 @@ function readStatusFromTranscriptTail(transcriptPath) {
 // main
 // ---------------------------------------------------------------------------
 
-// ---------------------------------------------------------------------------
-// orphan-reaper trigger (#1432 B4)
-// ---------------------------------------------------------------------------
-//
-// DUPLICATED VERBATIM between the two trigger hooks —
-// hooks/post-tool-batch-wave-signal.mjs <-> hooks/on-stop.mjs. Deliberate, with
-// a named revisit trigger (BV-004): they are the only two trigger points the
-// PRD declares, and a shared `hooks/_lib/reaper-trigger.mjs` would be a third
-// file in the hook import graph. SIZE, measured 2026-09-22 by diffing the two
-// blocks: 138 identical lines — this note said "~40 lines of glue" until then,
-// which is what made the duplicate look cheaper than it is. Extract it the
-// moment a THIRD hook needs the trigger, or the moment the copies must differ.
-
-/**
- * Filesystem path of the scan CLI, spawned as a PLAIN argv call.
- *
- * It used to be a `file://` URL handed to `node --input-type=module -e
- * <program>`, because `scripts/lib/orphan-reaper.mjs` had no entry guard. It
- * has one now (`parseReaperCliArgs` + the `isMainModule` tail), so the child's
- * contract lives in that module instead of as source text duplicated here —
- * and nothing this hook builds is a program any more: every variable part is
- * an argv value, which cannot become code whatever the checkout path contains.
- *
- * `fileURLToPath`, not `new URL(...).pathname`: the latter leaves a
- * percent-encoded path for any checkout directory containing a space.
- */
-const ORPHAN_REAPER_SCRIPT = fileURLToPath(
-  new URL('../scripts/lib/orphan-reaper.mjs', import.meta.url),
-);
-
-/**
- * Read the `reaper:` block from the project's Session Config host file.
- * Sync + inline, mirroring `hooks/loop-guard.mjs` `loadConfig()` — a hot hook
- * path must not import the full config orchestrator. A missing or unreadable
- * file yields the parser defaults, i.e. DISABLED.
- *
- * @param {string} projectDir
- * @returns {ReturnType<typeof _parseReaper>}
- */
-function loadReaperConfig(projectDir) {
-  for (const name of ['CLAUDE.md', 'AGENTS.md']) {
-    try {
-      return _parseReaper(readFileSync(path.join(projectDir, name), 'utf8'));
-    } catch {
-      // missing or unreadable — try the next candidate
-    }
-  }
-  return _parseReaper('');
-}
-
-/**
- * Trigger the orphan scan, throttled and NON-BLOCKING (PRD FA4).
- *
- * The hook itself does exactly two pieces of I/O — one config read and one
- * `stat` of the throttle marker — and then hands the work to a DETACHED,
- * unref'd child. The scan is never run inline: one `ps` round-trip out of Node
- * was measured at ~47 ms over 287 KB of output, which alone would blow the
- * 50 ms `reaper.max-hook-latency-ms` budget this hook has to stay inside.
- *
- * The marker is stamped BEFORE the spawn, so a spawn that fails still consumes
- * the throttle window — otherwise a broken spawn would be retried on every
- * single tool batch.
- *
- * `reaper.max-hook-latency-ms` is the ceiling on the work above — measured here
- * with `performance.now()` and reported as ONE stderr WARN line when exceeded.
- * A WARN and not an event: this fires from a `PostToolBatch`-class hook, and a
- * per-fire telemetry record is exactly the always-on signal
- * `.claude/rules/host-resources.md` HR-101 calls a broken instrument. The
- * measurement covers preparation only — the scan itself runs detached, which is
- * the whole reason the budget can be held.
- *
- * Never throws: any failure degrades silently (PRD FA4 "lautlos degradieren").
- *
- * @param {object} [opts]
- * @param {string} [opts.projectDir]  Repo root; defaults to `getProjectDir()`.
- * @param {number} [opts.now]         Injected clock (ms).
- * @param {Function} [opts.spawnFn]   Injected `spawn` (tests).
- * @param {Function} [opts.statFn]    Injected `statSync` (tests).
- * @param {Function} [opts.writeFn]   Injected marker writer (tests).
- * @param {() => number} [opts.clockFn]  Injected monotonic clock for the latency
- *   budget (tests); defaults to `performance.now`.
- * @returns {Promise<{spawned: boolean, reason: string}>}
- */
-export async function maybeTriggerOrphanScan({
-  projectDir,
-  now,
-  spawnFn = spawn,
-  statFn,
-  writeFn,
-  clockFn = () => performance.now(),
-} = {}) {
-  const startedAt = clockFn();
-  /** One WARN line when the preparation overran `reaper.max-hook-latency-ms`. */
-  const checkLatency = (budgetMs) => {
-    const elapsed = clockFn() - startedAt;
-    if (Number.isFinite(budgetMs) && budgetMs > 0 && elapsed > budgetMs) {
-      process.stderr.write(
-        `orphan-reaper trigger: hook latency ${elapsed.toFixed(1)} ms exceeded `
-        + `reaper.max-hook-latency-ms (${budgetMs} ms)\n`,
-      );
-    }
-  };
-  try {
-    const root = typeof projectDir === 'string' && projectDir ? projectDir : getProjectDir();
-    const cfg = loadReaperConfig(root);
-    // Cheapest gate first: disabled means no stat, no spawn, no module load.
-    if (cfg.enabled !== true) return { spawned: false, reason: 'disabled' };
-
-    // The throttle module only — the scan's ledger, `ps` and kill-ladder code
-    // load in the detached child, never on this hook path (#1437).
-    const reaper = await import('../scripts/lib/orphan-reaper/scan-throttle.mjs');
-    const markerPath = reaper.scanMarkerPath(root);
-    const nowMs = typeof now === 'number' ? now : Date.now();
-
-    if (!reaper.shouldScanNow(markerPath, nowMs, cfg['min-scan-interval-seconds'], { statFn })) {
-      checkLatency(cfg['max-hook-latency-ms']);
-      return { spawned: false, reason: 'throttled' };
-    }
-    reaper.touchScanMarker(markerPath, { writeFn });
-
-    const child = spawnFn(
-      process.execPath,
-      [
-        ORPHAN_REAPER_SCRIPT,
-        '--repo-root', root,
-        '--mode', cfg.mode,
-        '--min-age-seconds', String(cfg['min-age-seconds']),
-        '--kill-grace-ms', String(cfg['kill-grace-ms']),
-        '--verify-wait-ms', String(cfg['verify-wait-ms']),
-        '--false-alarm-window', String(cfg['false-alarm-window']),
-      ],
-      { detached: true, stdio: 'ignore' },
-    );
-    if (child && typeof child.unref === 'function') child.unref();
-    checkLatency(cfg['max-hook-latency-ms']);
-    return { spawned: true, reason: 'spawned' };
-  } catch {
-    return { spawned: false, reason: 'error' };
-  }
-}
-
 async function main() {
   const input = await readStdinJson();
   const eventType = discriminate(input);
@@ -926,11 +823,14 @@ async function main() {
   // hook, which triggers last) because both branches below may throw — a
   // `handleStop` failure must not silently disarm the watchdog. The cost is one
   // config read plus one stat, bounded by `reaper.max-hook-latency-ms` (50 ms),
-  // and the scan itself runs in a detached child.
-  await maybeTriggerOrphanScan();
+  // and the scan itself runs in a detached child. Its outcome rides on the
+  // record either branch emits anyway (`reaper_trigger`, see reaperTriggerField).
+  // Rooted at the SESSION root (#1492 point 2): the gate ledger the scan reads
+  // lives in the tree the gate ran in — an entered worktree, not the launch dir.
+  const reaperTrigger = await maybeTriggerOrphanScan({ projectDir: resolveSessionRoot(input?.cwd) });
 
   if (eventType === 'subagent_stop') {
-    const additionalContext = await handleSubagentStop(input);
+    const additionalContext = await handleSubagentStop(input, reaperTrigger);
     // v2.1.163+: emit hookSpecificOutput for SubagentStop path.
     // If handleSubagentStop returns a non-empty context string, feed it back
     // to the coordinator turn. Currently returns null (no inline warning from
@@ -951,7 +851,7 @@ async function main() {
     // SubagentStop is intentionally outside this block — it must never emit
     // terminalSequence.
     try {
-      await handleStop(input);
+      await handleStop(input, reaperTrigger);
     } finally {
       // terminalSequence is only meaningful for Stop (session-level) events.
       process.stdout.write(buildTerminalSequenceJson(detectPlatform()));

package/hooks/post-bash-write-verify.mjs

@@ -109,6 +109,10 @@
  * observed actor could rewrite the gate unreported. Because the file is
  * typically gitignored, `git status` cannot see it anyway — change detection
  * for it is content-hash-based against the snapshot (`formatControlNotice`).
+ * Its sibling control state `<state-dir>/filescopes/**` (the per-agent scope
+ * declarations, #1020) is likewise not on the list: `computeReport` drops it
+ * from the violation set beside the manifest itself, keyed on the ACTIVE
+ * manifest's state dir (`isScopeDeclarationPath`, #1027 Pkt 5).
  *
  * The hook's OWN snapshot lives in `$TMPDIR`, never inside the repo, so it is
  * structurally incapable of reporting its own bookkeeping.
@@ -149,18 +153,24 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
-import { readFileSync, mkdirSync, writeFileSync, renameSync, realpathSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync, realpathSync, statSync } from 'node:fs';
 
 import { readStdin, writeStdoutLineSync } from '../scripts/lib/io.mjs';
-import { resolveProjectDir } from '../scripts/lib/platform.mjs';
-import { findScopeFile, pathMatchesPattern } from '../scripts/lib/hardening.mjs';
+import { resolveSessionRoot } from '../scripts/lib/platform.mjs';
+import { pathMatchesPattern } from '../scripts/lib/hardening.mjs';
 // #1057 — `sessionAgeMs` and its private `clockAgeMs` helper MOVED to the lib so
 // hooks/enforce-scope.mjs can read the same session clock without a hook->hook
 // import. Re-exported below, so this hook's public surface — and
 // tests/hooks/post-bash-write-verify.test.mjs, which imports the named export —
 // is unchanged. Two byte-identical copies of a clock is exactly the one-fact-two-
 // copies class this repo keeps paying for.
-import { sessionAgeMs, PEER_RECORD_PREFIX, isPeerRecordId } from '../scripts/lib/scope-gate.mjs';
+import {
+  sessionAgeMs,
+  PEER_RECORD_PREFIX,
+  isPeerRecordId,
+  isScopeDeclarationPath,
+  findOwnScopeFile,
+} from '../scripts/lib/scope-gate.mjs';
 // #1153 P1 — the same process-local ownership check hooks/enforce-scope.mjs
 // applies at Gate 3b. This hook reads the SAME working-copy `wave-scope.json`,
 // so without it a peer session's manifest drives this session's advisories.
@@ -313,6 +323,45 @@ export function parsePorcelainZ(raw) {
   return out;
 }
 
+/**
+ * Rebase toplevel-relative porcelain paths onto the SESSION ROOT.
+ *
+ * `git status --porcelain` names paths relative to the git TOPLEVEL, while
+ * `allowedPaths`, the ignore list and the manifest path are relative to the
+ * session root — since #1492 the LAUNCH DIR, which in a session started from a
+ * repo subdirectory (`<mono>/packages/foo`) sits below the toplevel. Judged
+ * unrebased, an in-scope write to `packages/foo/src/new.mjs` failed `src/**`
+ * (false positive) and a write to `<mono>/src/evil.mjs` matched it (false
+ * negative). A path under the prefix loses it; every other path is outside the
+ * project root and is spelled `../…` from the session root — the same category
+ * enforce-scope Gate 6 denies, and a spelling no allowedPaths entry can grant
+ * (see {@link isOutsideSessionRoot}).
+ *
+ * @param {string[]} paths toplevel-relative, forward slashes
+ * @param {string} prefix session root relative to the toplevel ('' = same dir)
+ * @returns {string[]}
+ */
+export function rebaseToSessionRoot(paths, prefix) {
+  const clean = typeof prefix === 'string' ? prefix.replace(/\/+$/, '') : '';
+  // '' = the session root IS the toplevel; '..'/absolute cannot come from
+  // `--show-prefix` and would make the arithmetic meaningless — leave as is.
+  if (clean === '' || clean.startsWith('..') || clean.startsWith('/')) return paths;
+  const head = `${clean}/`;
+  const ups = clean.split('/').map(() => '..').join('/');
+  return paths.map((p) => (p.startsWith(head) ? p.slice(head.length) : `${ups}/${p}`));
+}
+
+/**
+ * Is this (session-root-relative) path outside the project root — a `../…`
+ * spelling produced by {@link rebaseToSessionRoot}? Never in scope.
+ *
+ * @param {string} relPath
+ * @returns {boolean}
+ */
+export function isOutsideSessionRoot(relPath) {
+  return relPath === '..' || relPath.startsWith('../');
+}
+
 /**
  * Is a repo-relative path covered by the wave's `allowedPaths`?
  *
@@ -384,14 +433,17 @@ export function readPeerScopeRecords(stateDir, wave) {
  * Which peer record — if any — declared this path?
  *
  * Same matcher as `isInScope`, so a peer's declaration is read exactly the way
- * the wave's own `allowedPaths` are.
+ * the wave's own `allowedPaths` are — and the same outside-root guard as
+ * `computeReport`: a `../…` path is outside the project root, which no peer
+ * record can grant any more than `allowedPaths` can (a peer glob over every
+ * `.md` file would otherwise file `<mono>/NOTES.md` as an agreed peer write).
  *
  * @param {string} relPath
  * @param {Array<{ id: string, files: string[] }>} peerRecords
  * @returns {string|null} the peer record id, or null
  */
 export function peerRecordFor(relPath, peerRecords) {
-  if (!Array.isArray(peerRecords)) return null;
+  if (!Array.isArray(peerRecords) || isOutsideSessionRoot(relPath)) return null;
   for (const record of peerRecords) {
     if (record.files.some((p) => pathMatchesPattern(relPath, p))) return record.id;
   }
@@ -466,14 +518,22 @@ export function snapshotPathFor(repoRoot) {
 export function computeReport({ dirtyPaths, allowedPaths, snapshot, signature, scopeMtimeMs = null, mtimeMs = null, scopeRelPath = null }) {
   const outOfScope = dirtyPaths
     .filter((p) => !isIgnoredPath(p))
-    .filter((p) => !isInScope(p, allowedPaths))
+    // A `../…` path (outside the project root, see rebaseToSessionRoot) is never
+    // in scope — not even under a broad glob that would happen to match it.
+    .filter((p) => isOutsideSessionRoot(p) || !isInScope(p, allowedPaths))
     // The wave-scope.json control file is out-of-scope by construction (it is
     // never under allowedPaths) but its CHANGES are reported via the content-hash
     // control-notice path, not here. Excluding it keeps the mtime re-baseline
     // filter from reporting the scope file against ITSELF — its mtime always
     // equals scopeMtimeMs, so the MED-3 `>=` boundary would otherwise flag it on
     // every first run (#938 MED-3 follow-through).
-    .filter((p) => p !== scopeRelPath);
+    .filter((p) => p !== scopeRelPath)
+    // Its sibling control state, `<state-dir>/filescopes/` (the per-agent scope
+    // declarations `materialize-wave-scope.mjs` writes once per wave), is no
+    // wave territory either — excluded the same way, not via
+    // IGNORED_PATH_PATTERNS, so the exemption follows THIS manifest's state dir
+    // instead of granting all four harness dirs (#1027 Pkt 5).
+    .filter((p) => !isScopeDeclarationPath(p, scopeRelPath));
 
   const rebaselined = !snapshot || snapshot.signature !== signature;
   const seen = rebaselined || !Array.isArray(snapshot?.paths) ? new Set() : new Set(snapshot.paths);
@@ -515,7 +575,9 @@ export function computeReport({ dirtyPaths, allowedPaths, snapshot, signature, s
  * @returns {string}
  */
 export function formatMessage(report, allowedCount) {
-  const shown = report.slice(0, MAX_REPORTED_PATHS);
+  const shown = report
+    .slice(0, MAX_REPORTED_PATHS)
+    .map((p) => (isOutsideSessionRoot(p) ? `${p} (outside project root)` : p));
   const more = report.length - shown.length;
   const tail = more > 0 ? ` (+${more} more)` : '';
   const msg =
@@ -608,12 +670,13 @@ export function formatSnapshotMissingNotice({ sessionAge = null, scopeAge = null
 // ---------------------------------------------------------------------------
 
 /**
- * Collect the working-tree dirty set. Returns null when git is unavailable, the
+ * Collect the working-tree dirty set, rebased onto the session root
+ * ({@link rebaseToSessionRoot}). Returns null when git is unavailable, the
  * directory is not a repo, or the call times out — all of which mean "no signal
  * to report", never a warning.
  *
- * @param {string} repoRoot
- * @returns {string[]|null}
+ * @param {string} repoRoot the session root
+ * @returns {string[]|null} session-root-relative paths (`../…` = outside it)
  */
 function readDirtyPaths(repoRoot) {
   try {
@@ -630,7 +693,16 @@ function readDirtyPaths(repoRoot) {
       ['--no-optional-locks', 'status', '--porcelain', '-z', '--no-renames', '--untracked-files=all'],
       { cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER, stdio: ['ignore', 'pipe', 'ignore'] },
     );
-    return parsePorcelainZ(raw);
+    // Porcelain paths are toplevel-relative; everything they are judged against
+    // is session-root-relative. A `.git` AT the session root makes it the
+    // toplevel (prefix ''), so the extra spawn is paid only by a session
+    // launched from a repo subdirectory.
+    const prefix = existsSync(path.join(repoRoot, '.git'))
+      ? ''
+      : execFileSync('git', ['rev-parse', '--show-prefix'], {
+        cwd: repoRoot, encoding: 'utf8', timeout: GIT_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
+    return rebaseToSessionRoot(parsePorcelainZ(raw), prefix);
   } catch {
     return null;
   }
@@ -807,7 +879,10 @@ async function main() {
   // G2 — only Bash calls carry the bypass risk this hook watches.
   if (input.tool_name !== 'Bash') return;
 
-  const repoRootRaw = resolveProjectDir();
+  // #1492 — the SESSION's working copy, not the launch dir `$CLAUDE_PROJECT_DIR`
+  // keeps after `EnterWorktree` (the manifest lives in the worktree). See
+  // `resolveSessionRoot` in scripts/lib/platform.mjs.
+  const repoRootRaw = resolveSessionRoot(input.cwd);
   let repoRoot;
   try {
     repoRoot = realpathSync(repoRootRaw);
@@ -833,7 +908,14 @@ async function main() {
   // G3 — no wave scope → nothing defines "outside". #938: if a previous call
   // RECORDED a scope state, the control file's disappearance is itself a
   // control-file change and gets one visible (non-alarming) notice.
-  const scopePath = findScopeFile(repoRoot);
+  //
+  // #1504 point 6 — the first manifest that is not provably a peer's, so a
+  // peer's higher-precedence manifest no longer hides this session's own one;
+  // only when every candidate is foreign does the first come back, and G3b
+  // below keeps its stand-down and its rebind notice unchanged.
+  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+  const located = findOwnScopeFile(repoRoot, ownIds, classifyManifestSession);
+  const scopePath = located.path ?? located.foreignPath;
   if (!scopePath) {
     if (prevScopeState && prevScopeState.hash !== 'absent') {
       writeSnapshot(snapFile, {
@@ -857,7 +939,7 @@ async function main() {
   } catch {
     /* raw stays null (unreadable) or scope stays null (unparseable) */
   }
-  if (raw === null) return; // file vanished between findScopeFile and read
+  if (raw === null) return; // file vanished between findOwnScopeFile and read
 
   // The control-file identity of THIS call, computed BEFORE the G3b
   // stand-down (W4/F7). Ordering is the whole fix: G3b used to `return` above
@@ -898,7 +980,6 @@ async function main() {
   // CLI, Cursor today) the own-id set is empty, so this gate is permanently
   // `'unknown'` = full pre-#1153 behaviour there.
   {
-    const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
     const { verdict, manifestIds } = classifyManifestSession(scope ?? {}, ownIds);
     if (verdict === 'foreign') {
       // Observability only — one event per stand-down decision, awaited so the

package/hooks/post-edit-validate.mjs

@@ -35,8 +35,13 @@ import { shouldRunHook } from './_lib/profile-gate.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
 
 import { readStdin } from '../scripts/lib/io.mjs';
-import { resolveProjectDir } from '../scripts/lib/platform.mjs';
-import { findScopeFile, gateEnabled } from '../scripts/lib/hardening.mjs';
+import { resolveSessionRoot } from '../scripts/lib/platform.mjs';
+import { gateEnabled } from '../scripts/lib/hardening.mjs';
+import { findOwnScopeFile } from '../scripts/lib/scope-gate.mjs';
+import {
+  classifyManifestSession,
+  readProcessLocalSessionIds,
+} from '../scripts/lib/session-identity/own-session.mjs';
 import { readConfigFile, parseSessionConfig } from '../scripts/lib/config.mjs';
 
 // ---------------------------------------------------------------------------
@@ -184,7 +189,9 @@ async function main() {
   const ext = path.extname(filePath).toLowerCase();
   if (!TS_EXTS.has(ext)) process.exit(0);
 
-  const projectRoot = resolveProjectDir();
+  // The SESSION root the scope guards use (#1492, #1504 point 4) — not the
+  // launch dir, which stays put while a session works in an entered worktree.
+  const projectRoot = resolveSessionRoot(input?.cwd);
 
   // Compute relative path (REQ-03)
   const absFilePath = path.isAbsolute(filePath)
@@ -192,8 +199,11 @@ async function main() {
     : path.resolve(projectRoot, filePath);
   const relPath = path.relative(projectRoot, absFilePath);
 
-  // G5: per-gate toggle — skip if post-edit-validate gate is disabled
-  const scopeFile = findScopeFile(projectRoot);
+  // G5: per-gate toggle — skip if post-edit-validate gate is disabled. Only
+  // THIS session's manifest may switch it off: a peer's manifest in the same
+  // working copy is skipped, and a peer-only result means no toggle (#1504).
+  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+  const { path: scopeFile } = findOwnScopeFile(projectRoot, ownIds, classifyManifestSession);
   if (scopeFile && !gateEnabled(scopeFile, 'post-edit-validate')) {
     process.exit(0);
   }