fix: restrict temp file permissions, validate session prefix format

- tmux sendKeys: write temp files with mode 0o600 instead of default umask
- config: validate sessionPrefix matches [a-zA-Z0-9_-]+ (Zod schema)
- config: sanitize derived prefix from project ID to match metadata ID rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/core/src/config.ts

@@ -62,7 +62,7 @@ const ProjectConfigSchema = z.object({
   repo: z.string(),
   path: z.string(),
   defaultBranch: z.string().default("main"),
-  sessionPrefix: z.string().optional(),
+  sessionPrefix: z.string().regex(/^[a-zA-Z0-9_-]+$/, "sessionPrefix must match [a-zA-Z0-9_-]+").optional(),
   runtime: z.string().optional(),
   agent: z.string().optional(),
   workspace: z.string().optional(),
@@ -130,8 +130,9 @@ function applyProjectDefaults(config: OrchestratorConfig): OrchestratorConfig {
     }
 
     // Derive session prefix from project ID if not set
+    // Sanitize to match metadata ID rules: [a-zA-Z0-9_-]+
     if (!project.sessionPrefix) {
-      project.sessionPrefix = id;
+      project.sessionPrefix = id.replace(/[^a-zA-Z0-9_-]/g, "-");
     }
 
     // Infer SCM from repo if not set

packages/core/src/tmux.ts

@@ -139,7 +139,7 @@ export async function sendKeys(
 
     const bufferName = `ao-${randomUUID().slice(0, 8)}`;
     const tmpFile = join(tmpdir(), `ao-tmux-${bufferName}.txt`);
-    writeFileSync(tmpFile, text, "utf-8");
+    writeFileSync(tmpFile, text, { encoding: "utf-8", mode: 0o600 });
 
     try {
       await tmux("load-buffer", "-b", bufferName, tmpFile);