@cybedefend/vibedefend 1.4.7 → 1.5.0

package/dist/hook-runner.js

@@ -5764,26 +5764,34 @@ async function resolveProjectIdWithApi(cwd = process.cwd(), deps = {}) {
   const resolveSync = deps.resolveSync ?? resolveProjectId;
   const base = resolveSync(cwd);
   if (base.projectId) return base;
+  let repository;
+  const none = (inactiveReason) => ({
+    ...base,
+    inactiveReason,
+    ...repository ? { repository } : {}
+  });
   try {
     const getOrigin = deps.getOrigin ?? getOriginRemote;
     const originUrl = getOrigin(cwd);
-    if (!originUrl) return base;
+    if (!originUrl) return none("no-git-origin");
     const remote = parseRemoteUrl(originUrl);
-    if (!remote || remote.provider === null) return base;
+    if (!remote) return none("unsupported-remote");
+    repository = `${remote.host}/${remote.slug}`;
+    if (remote.provider === null) return none("unsupported-remote");
     const key = `${remote.provider}:${remote.host}:${remote.slug}`;
     const cached = getCachedRepoLink(key, deps.cacheDeps);
     if (cached.kind === "positive") {
       return { projectId: cached.projectId, apiBase: base.apiBase };
     }
     if (cached.kind === "negative") {
-      return base;
+      return none("no-linked-project");
     }
     const config = (deps.loadConfig ?? loadRuntimeConfig)();
-    if (!config) return base;
+    if (!config) return none("lookup-failed");
     const apiBase = base.apiBase ?? config.region.apiBase;
     const resolveTokenFn = deps.resolveTokenFn ?? resolveTokenWithRefresh;
     const token = await resolveTokenFn(config.region.mcpName);
-    if (!token) return base;
+    if (!token) return none("not-signed-in");
     const resolveByRepo = deps.resolveByRepo ?? resolveProjectByRepository;
     const matches = await resolveByRepo(
       apiBase,
@@ -5791,7 +5799,7 @@ async function resolveProjectIdWithApi(cwd = process.cwd(), deps = {}) {
       { provider: remote.provider, slug: remote.slug, host: remote.host },
       { timeoutMs: deps.timeoutMs ?? RESOLVE_API_TIMEOUT_MS }
     );
-    if (matches === null) return base;
+    if (matches === null) return none("lookup-failed");
     if (matches.length === 1 && matches[0].vibedefendEnabled !== false) {
       const m = matches[0];
       writeCachedRepoLink(
@@ -5802,9 +5810,9 @@ async function resolveProjectIdWithApi(cwd = process.cwd(), deps = {}) {
       return { projectId: m.projectId, apiBase: base.apiBase };
     }
     writeCachedRepoLink(key, { negative: true }, deps.cacheDeps);
-    return base;
+    return none("no-linked-project");
   } catch {
-    return base;
+    return none("lookup-failed");
   }
 }
 
@@ -6064,6 +6072,12 @@ async function fetchProposalsCount(opts) {
   return { total, raw: body };
 }
 
+// src/hooks/runtime/session-activation.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join6, resolve as resolvePath2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
 // src/hooks/runtime/emit.ts
 var ENVELOPE_CLIENTS = {
   SessionStart: /* @__PURE__ */ new Set(["codex"]),
@@ -6084,6 +6098,10 @@ function emit(body, client) {
 }
 function emitContext(body, client, hookEventName) {
   if (!body) return;
+  if (client === "cursor" && hookEventName === "SessionStart") {
+    process.stdout.write(JSON.stringify({ additional_context: body }) + "\n");
+    return;
+  }
   if (ENVELOPE_CLIENTS[hookEventName].has(client)) {
     const payload = JSON.stringify({
       hookSpecificOutput: {
@@ -6096,6 +6114,25 @@ function emitContext(body, client, hookEventName) {
   }
   emit(body, client);
 }
+var SYSTEM_MESSAGE_CLIENTS = /* @__PURE__ */ new Set([
+  "claude-code",
+  "codex"
+]);
+function emitSessionNotice(notice, client) {
+  if (SYSTEM_MESSAGE_CLIENTS.has(client)) {
+    process.stdout.write(
+      JSON.stringify({
+        systemMessage: notice.userMessage,
+        hookSpecificOutput: {
+          hookEventName: "SessionStart",
+          additionalContext: notice.modelContext
+        }
+      }) + "\n"
+    );
+    return;
+  }
+  emitContext(notice.modelContext, client, "SessionStart");
+}
 function emitStop(body, client, reason) {
   if (!body) return;
   if (client === "claude-code") {
@@ -6110,6 +6147,143 @@ function emitStop(body, client, reason) {
   emit(body, client);
 }
 
+// src/hooks/runtime/session-activation.ts
+var SETTLED_REASONS = /* @__PURE__ */ new Set([
+  "no-git-origin",
+  "unsupported-remote",
+  "no-linked-project"
+]);
+function isSettledReason(reason) {
+  return SETTLED_REASONS.has(reason);
+}
+var SESSIONS_CAP = 200;
+function defaultStoreFile() {
+  const dir = process.env.CYBEDEFEND_BASELINE_DIR ?? join6(homedir7(), ".cybedefend");
+  return join6(dir, "inactive-sessions.json");
+}
+function defaultInactiveSessionStore(file = defaultStoreFile(), now = Date.now) {
+  function load() {
+    if (!existsSync8(file)) return {};
+    try {
+      const parsed = JSON.parse(readFileSync7(file, "utf8"));
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
+  }
+  function save(map) {
+    try {
+      mkdirSync5(dirname4(file), { recursive: true });
+      writeFileSync4(file, JSON.stringify(map) + "\n", "utf8");
+    } catch {
+    }
+  }
+  return {
+    get(sessionId) {
+      const rec = load()[sessionId];
+      if (!rec || typeof rec !== "object" || typeof rec.cwd !== "string" || typeof rec.reason !== "string") {
+        return null;
+      }
+      return rec;
+    },
+    mark(sessionId, record) {
+      const map = load();
+      map[sessionId] = { ...record, at: now() };
+      const entries = Object.entries(map);
+      if (entries.length > SESSIONS_CAP) {
+        entries.sort(([, a], [, b]) => (a.at ?? 0) - (b.at ?? 0));
+        save(Object.fromEntries(entries.slice(-SESSIONS_CAP)));
+        return;
+      }
+      save(map);
+    },
+    clear(sessionId) {
+      const map = load();
+      if (!(sessionId in map)) return;
+      delete map[sessionId];
+      save(map);
+    }
+  };
+}
+function sessionIdOf(stdin) {
+  for (const key of ["session_id", "sessionId", "conversation_id", "trajectory_id"]) {
+    const v = stdin[key];
+    if (typeof v === "string" && v.length > 0) return v;
+  }
+  return null;
+}
+function sessionFolderOf(stdin, client, env = process.env) {
+  const candidates = [];
+  if (client === "cursor") {
+    const roots = stdin.workspace_roots;
+    if (Array.isArray(roots)) candidates.push(roots[0]);
+    candidates.push(env.CURSOR_PROJECT_DIR);
+  }
+  candidates.push(stdin.cwd);
+  for (const c of candidates) {
+    const folder = absoluteFolder(c);
+    if (folder) return folder;
+  }
+  return process.cwd();
+}
+function absoluteFolder(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  let p = value;
+  if (p.startsWith("file://")) {
+    try {
+      p = fileURLToPath(p);
+    } catch {
+      return null;
+    }
+  }
+  return isAbsolute2(p) ? resolvePath2(p) : null;
+}
+function isSessionInactive(stdin, deps = {}) {
+  try {
+    const sessionId = sessionIdOf(stdin);
+    if (!sessionId) return false;
+    const record = (deps.store ?? defaultInactiveSessionStore()).get(sessionId);
+    if (!record || !isSettledReason(record.reason)) return false;
+    const cwd = deps.cwd ?? process.cwd();
+    if (record.cwd !== cwd) return false;
+    const resolveSync = deps.resolveSync ?? resolveProjectId;
+    return !resolveSync(cwd).projectId;
+  } catch {
+    return false;
+  }
+}
+function whyInactive(reason, repository) {
+  const repo = repository ? `\`${repository}\`` : "this folder";
+  switch (reason) {
+    case "no-git-origin":
+      return "this folder has no `.cybedefend/config.json` and no GitHub or GitLab `origin` remote";
+    case "unsupported-remote":
+      return `this folder has no \`.cybedefend/config.json\` and its git \`origin\`${repository ? ` (${repo})` : ""} is not on GitHub or GitLab`;
+    case "no-linked-project":
+      return `this folder has no \`.cybedefend/config.json\` and no CybeDefend project with VibeDefend enabled matches ${repo}`;
+    case "not-signed-in":
+      return `you are not signed in, so the CybeDefend project for ${repo} could not be looked up`;
+    case "lookup-failed":
+      return `the CybeDefend API did not answer, so the project for ${repo} could not be looked up`;
+  }
+}
+function composeInactiveNotice(reason, repository, client) {
+  const why = whyInactive(reason, repository);
+  const settled = isSettledReason(reason);
+  const userMessage = settled ? `\u{1F6E1}\uFE0F CybeDefend is off for this session: ${why}. Run \`vibedefend link\` in this folder to turn it on.` : reason === "not-signed-in" ? `\u{1F6E1}\uFE0F CybeDefend is off for now: ${why}. Run \`vibedefend login\` to turn it on.` : `\u{1F6E1}\uFE0F CybeDefend is off for now: ${why}. It will try again on the next prompt or edit.`;
+  const scope = settled ? "- Its hooks stay off until this session ends: no rules fetch, no proposal inbox, no Action Guards, no end-of-session review." : "- Its hooks stay quiet until the project can be found.";
+  const relay = SYSTEM_MESSAGE_CLIENTS.has(client) ? "- The user has already been shown this notice; do not repeat it." : "- Tell the user once, in one short line, that CybeDefend is off for this session and why.";
+  const modelContext = [
+    "## CybeDefend is not active in this session",
+    `CybeDefend found no project for this folder: ${why}.`,
+    scope,
+    "- Do not call CybeDefend MCP tools, run the CybeDefend workflow or ask for a CybeDefend project id unless the user asks about CybeDefend.",
+    relay,
+    ""
+  ].join("\n");
+  return { userMessage, modelContext };
+}
+
 // src/hooks/runtime/fetch-rules.ts
 function emitPreToolUseContext(body, client) {
   emitContext(body, client, "PreToolUse");
@@ -6136,7 +6310,9 @@ async function fetchRulesHook(deps = {}) {
   if (!event.filePath) return;
   const config = loadConfig();
   if (!config) return;
-  const { projectId, apiBase: configApiBase } = await resolveProject();
+  const folder = sessionFolderOf(stdin, event.client);
+  if (isSessionInactive(stdin, { store: deps.sessionStore, cwd: folder })) return;
+  const { projectId, apiBase: configApiBase } = await resolveProject(folder);
   if (!projectId) return;
   const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
   const token = resolveTok(config.region.mcpName, {
@@ -6146,7 +6322,7 @@ async function fetchRulesHook(deps = {}) {
   const intent = buildIntent(event);
   const files = event.filePaths.length > 0 ? event.filePaths : [event.filePath];
   const fileLabel = files.join(", ");
-  const sessionId = sessionIdOf(stdin);
+  const sessionId = sessionIdOf2(stdin);
   const usageNotices = [];
   const onUsageSignal = (signal) => {
     const sentence = signal.kind === "blocked" ? usageNotifier.notifyBlock(sessionId, signal.block) : usageNotifier.notifyWarning(sessionId, signal.warning);
@@ -6190,7 +6366,7 @@ async function fetchRulesHook(deps = {}) {
   }
   if (blocks.length > 0) emitFn(blocks.join("\n"), event.client);
 }
-function sessionIdOf(stdin) {
+function sessionIdOf2(stdin) {
   if (typeof stdin.session_id === "string" && stdin.session_id) return stdin.session_id;
   if (typeof stdin.sessionId === "string" && stdin.sessionId) return stdin.sessionId;
   return void 0;
@@ -6275,9 +6451,9 @@ var DIRECT_PROPOSE_DIRECTIVES = {
 
 // src/hooks/runtime/self-update-check.ts
 import { spawn } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join7 } from "node:path";
 
 // src/hooks/runtime/semver.ts
 function parseVersion(input) {
@@ -6304,8 +6480,8 @@ function isNewer(latest, current) {
 }
 
 // src/self-update.ts
-import { fileURLToPath } from "node:url";
-import { existsSync as existsSync8, realpathSync } from "node:fs";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { existsSync as existsSync9, realpathSync } from "node:fs";
 var GLOBAL_MODES = /* @__PURE__ */ new Set([
   "npm-global",
   "pnpm-global",
@@ -6333,14 +6509,14 @@ function detectInstallMode(scriptPath) {
 }
 function resolveScriptPath() {
   const fromArgv = process.argv[1];
-  if (fromArgv && existsSync8(fromArgv)) {
+  if (fromArgv && existsSync9(fromArgv)) {
     try {
       return realpathSync(fromArgv);
     } catch {
       return fromArgv;
     }
   }
-  return fileURLToPath(import.meta.url);
+  return fileURLToPath2(import.meta.url);
 }
 
 // src/hooks/runtime/self-update-check.ts
@@ -6355,9 +6531,9 @@ function isValidRegistryVersion(value) {
 }
 async function selfUpdateCheck(deps) {
   const now = deps.now ?? (() => Date.now());
-  const dir = deps.cybeDir ?? join6(process.env.CYBEDEFEND_HOME ?? homedir7(), ".cybedefend");
-  const throttlePath = join6(dir, "update-check.json");
-  const logPath = join6(dir, "last-update.log");
+  const dir = deps.cybeDir ?? join7(process.env.CYBEDEFEND_HOME ?? homedir8(), ".cybedefend");
+  const throttlePath = join7(dir, "update-check.json");
+  const logPath = join7(dir, "last-update.log");
   const installMode = deps.installMode ?? (deps.runnerSource ? detectInstallMode(deps.runnerSource) : detectInstallMode(resolveScriptPath()));
   const priorFailure = takeUpdateLogNotice(logPath);
   const throttle = readThrottle(throttlePath);
@@ -6390,8 +6566,8 @@ function applyOrNotify(deps, installMode, latest, logPath) {
 }
 function readThrottle(path) {
   try {
-    if (!existsSync9(path)) return null;
-    const data = JSON.parse(readFileSync7(path, "utf8"));
+    if (!existsSync10(path)) return null;
+    const data = JSON.parse(readFileSync8(path, "utf8"));
     if (typeof data.lastCheckedAt !== "number") return null;
     return { lastCheckedAt: data.lastCheckedAt };
   } catch {
@@ -6401,16 +6577,16 @@ function readThrottle(path) {
 function writeThrottle(path, throttle) {
   try {
     ensureDirFor(path);
-    writeFileSync4(path, JSON.stringify(throttle) + "\n");
+    writeFileSync5(path, JSON.stringify(throttle) + "\n");
   } catch {
   }
 }
 function takeUpdateLogNotice(logPath) {
   try {
-    if (!existsSync9(logPath)) return null;
+    if (!existsSync10(logPath)) return null;
     let parsed = {};
     try {
-      parsed = JSON.parse(readFileSync7(logPath, "utf8"));
+      parsed = JSON.parse(readFileSync8(logPath, "utf8"));
     } catch {
       parsed = {};
     }
@@ -6485,18 +6661,18 @@ function pmCommand(mode, spec) {
 
 // src/hooks/runtime/hook-refresh-trigger.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname5, join as join8 } from "node:path";
 function maybeRefreshStaleWiring(deps) {
   try {
     const { config, runnerVersion } = deps;
     if (!config.runnerSource || config.installedVersion === runnerVersion) {
       return false;
     }
-    const cliEntry = join7(dirname4(dirname4(config.runnerSource)), "bin", "vibedefend.js");
-    if (!(deps.exists ?? existsSync10)(cliEntry)) return false;
-    const markerPath = deps.markerPath ?? join7(process.env.CYBEDEFEND_HOME ?? homedir8(), ".cybedefend", "hook-refresh.json");
+    const cliEntry = join8(dirname5(dirname5(config.runnerSource)), "bin", "vibedefend.js");
+    if (!(deps.exists ?? existsSync11)(cliEntry)) return false;
+    const markerPath = deps.markerPath ?? join8(process.env.CYBEDEFEND_HOME ?? homedir9(), ".cybedefend", "hook-refresh.json");
     if (readMarkerVersion(markerPath) === runnerVersion) return false;
     (deps.spawnRefresh ?? defaultSpawnRefresh)(cliEntry);
     writeMarker(markerPath, runnerVersion);
@@ -6507,8 +6683,8 @@ function maybeRefreshStaleWiring(deps) {
 }
 function readMarkerVersion(path) {
   try {
-    if (!existsSync10(path)) return null;
-    const data = JSON.parse(readFileSync8(path, "utf8"));
+    if (!existsSync11(path)) return null;
+    const data = JSON.parse(readFileSync9(path, "utf8"));
     return typeof data.version === "string" ? data.version : null;
   } catch {
     return null;
@@ -6517,7 +6693,7 @@ function readMarkerVersion(path) {
 function writeMarker(path, version) {
   try {
     ensureDirFor(path);
-    writeFileSync5(path, JSON.stringify({ version, spawnedAt: Date.now() }) + "\n");
+    writeFileSync6(path, JSON.stringify({ version, spawnedAt: Date.now() }) + "\n");
   } catch {
   }
 }
@@ -6531,18 +6707,18 @@ function defaultSpawnRefresh(cliEntry) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync9 } from "node:fs";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname5, join as join8 } from "node:path";
+import { readFileSync as readFileSync10 } from "node:fs";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { dirname as dirname6, join as join9 } from "node:path";
 var PKG_NAME = "@cybedefend/vibedefend";
 function defaultPkgPath() {
-  return join8(dirname5(fileURLToPath2(import.meta.url)), "..", "package.json");
+  return join9(dirname6(fileURLToPath3(import.meta.url)), "..", "package.json");
 }
 function readPackageMeta(opts = {}) {
   if (typeof opts.bakedVersion === "string" && opts.bakedVersion.length > 0) {
     return { name: PKG_NAME, version: opts.bakedVersion };
   }
-  const readFile = opts.readFile ?? ((p) => readFileSync9(p, "utf8"));
+  const readFile = opts.readFile ?? ((p) => readFileSync10(p, "utf8"));
   const pkgPath = opts.pkgPath ?? defaultPkgPath();
   try {
     return JSON.parse(readFile(pkgPath));
@@ -6551,13 +6727,22 @@ function readPackageMeta(opts = {}) {
   }
 }
 var pkg = readPackageMeta({
-  bakedVersion: true ? "1.4.7" : void 0
+  bakedVersion: true ? "1.5.0" : void 0
 });
 
 // src/hooks/runtime/session-start.ts
 function emitSessionStartContext(body, client) {
   emitContext(body, client, "SessionStart");
 }
+function announceInactive(resolution, sessionId, cwd, store, client, emitNoticeFn) {
+  const reason = resolution.inactiveReason ?? "no-linked-project";
+  if (sessionId) {
+    const prior = store.get(sessionId);
+    if (prior && prior.cwd === cwd && prior.reason === reason) return;
+    store.mark(sessionId, { cwd, reason });
+  }
+  emitNoticeFn(composeInactiveNotice(reason, resolution.repository, client), client);
+}
 async function sessionStartHook(deps = {}) {
   const readStdin = deps.readStdin ?? readStdinJson;
   const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
@@ -6566,6 +6751,7 @@ async function sessionStartHook(deps = {}) {
   const fetchProposals = deps.fetchProposalsFn ?? fetchProposalsCount;
   const selfUpdateCheckFn = deps.selfUpdateCheckFn ?? selfUpdateCheck;
   const emitFn = deps.emitFn ?? emitSessionStartContext;
+  const emitNoticeFn = deps.emitNoticeFn ?? emitSessionNotice;
   const stdin = await readStdin();
   const event = sniff(stdin);
   const config = loadConfig();
@@ -6574,8 +6760,16 @@ async function sessionStartHook(deps = {}) {
     config,
     runnerVersion: pkg.version
   });
-  const { projectId, apiBase: configApiBase } = await resolveProject();
-  if (!projectId) return;
+  const folder = sessionFolderOf(stdin, event.client);
+  const resolution = await resolveProject(folder);
+  const { projectId, apiBase: configApiBase } = resolution;
+  const sessionStore = deps.sessionStore ?? defaultInactiveSessionStore();
+  const sessionId = sessionIdOf(stdin);
+  if (!projectId) {
+    announceInactive(resolution, sessionId, folder, sessionStore, event.client, emitNoticeFn);
+    return;
+  }
+  if (sessionId) sessionStore.clear(sessionId);
   const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
   if (process.env.CYBEDEFEND_DRY_RUN === "1") {
     emitFn(
@@ -6667,7 +6861,7 @@ async function sessionStartHook(deps = {}) {
 }
 
 // src/hooks/runtime/session-review.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "node:fs";
 var COUNTED_TOOLS = /* @__PURE__ */ new Set([
   "Edit",
   "Write",
@@ -6709,6 +6903,10 @@ async function sessionReviewHook(deps = {}) {
   }
   if (editCount === 0) return;
   if (editCount < resolveReviewThreshold(config)) return;
+  const folder = sessionFolderOf(stdin, event.client);
+  if (isSessionInactive(stdin, { store: deps.sessionStore, cwd: folder })) return;
+  const { projectId } = await (deps.resolveProject ?? resolveProjectIdWithApi)(folder);
+  if (!projectId) return;
   const userPrompt = extractFirstUserPrompt(transcript);
   const proposalMode = resolveProposalMode(config);
   let body = composeReviewBody(
@@ -6719,8 +6917,7 @@ async function sessionReviewHook(deps = {}) {
   );
   const withDiffScan = config.hooks.enableDiffScan !== false;
   if (withDiffScan) {
-    const cwd = typeof stdin.cwd === "string" && stdin.cwd ? stdin.cwd : process.cwd();
-    body += "\n" + composeDiffScanBody(extractChangedFiles(transcript, void 0, cwd));
+    body += "\n" + composeDiffScanBody(extractChangedFiles(transcript, void 0, folder));
   }
   emitFn(body, event.client, composeStopReason(withDiffScan, proposalMode));
 }
@@ -6751,9 +6948,9 @@ function loadTranscript(stdin, readFile) {
   return out;
 }
 function defaultReadTranscript(path) {
-  if (!existsSync11(path)) return null;
+  if (!existsSync12(path)) return null;
   try {
-    return readFileSync10(path, "utf8");
+    return readFileSync11(path, "utf8");
   } catch {
     return null;
   }
@@ -6986,6 +7183,10 @@ async function preCompactHook(deps = {}) {
   const config = loadConfig();
   if (!config) return;
   if (!config.hooks.enableSessionReview) return;
+  const folder = sessionFolderOf(stdin, event.client);
+  if (isSessionInactive(stdin, { store: deps.sessionStore, cwd: folder })) return;
+  const { projectId } = await (deps.resolveProject ?? resolveProjectIdWithApi)(folder);
+  if (!projectId) return;
   if (process.env.CYBEDEFEND_DRY_RUN === "1") {
     emitFn(
       `## \u{1F6E1}\uFE0F CybeDefend PreCompact (dry-run, client=${event.client})
@@ -7013,19 +7214,19 @@ async function preCompactHook(deps = {}) {
 }
 
 // src/hooks/runtime/user-prompt-submit.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join9 } from "node:path";
-var SESSIONS_CAP = 100;
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir as homedir10 } from "node:os";
+import { join as join10 } from "node:path";
+var SESSIONS_CAP2 = 100;
 function defaultSessionsFile() {
-  const dir = process.env.CYBEDEFEND_BASELINE_DIR ?? join9(homedir9(), ".cybedefend");
-  return join9(dir, "user-prompt-seen-sessions.json");
+  const dir = process.env.CYBEDEFEND_BASELINE_DIR ?? join10(homedir10(), ".cybedefend");
+  return join10(dir, "user-prompt-seen-sessions.json");
 }
 function defaultSessionTracker(file = defaultSessionsFile()) {
   function load() {
-    if (!existsSync12(file)) return [];
+    if (!existsSync13(file)) return [];
     try {
-      const raw = readFileSync11(file, "utf8");
+      const raw = readFileSync12(file, "utf8");
       const data = JSON.parse(raw);
       if (!Array.isArray(data.sessions)) return [];
       return data.sessions.filter((s) => typeof s === "string");
@@ -7040,10 +7241,10 @@ function defaultSessionTracker(file = defaultSessionsFile()) {
     async markSeen(sessionId) {
       const existing = load();
       if (existing.includes(sessionId)) return;
-      const next = [...existing, sessionId].slice(-SESSIONS_CAP);
+      const next = [...existing, sessionId].slice(-SESSIONS_CAP2);
       try {
-        mkdirSync5(join9(file, ".."), { recursive: true });
-        writeFileSync6(file, JSON.stringify({ sessions: next }), "utf8");
+        mkdirSync6(join10(file, ".."), { recursive: true });
+        writeFileSync7(file, JSON.stringify({ sessions: next }), "utf8");
       } catch {
       }
     }
@@ -7065,7 +7266,9 @@ async function userPromptSubmitHook(deps = {}) {
   }
   const config = loadConfig();
   if (!config) return;
-  const { projectId, apiBase: configApiBase } = await resolveProject();
+  const folder = sessionFolderOf(stdin, event.client);
+  if (isSessionInactive(stdin, { store: deps.sessionStore, cwd: folder })) return;
+  const { projectId, apiBase: configApiBase } = await resolveProject(folder);
   if (!projectId) return;
   const apiBase = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
   const token = resolveTok(config.region.mcpName, {
@@ -8114,10 +8317,10 @@ function nearMiss(req, rule) {
 }
 
 // src/hooks/runtime/guard-rules-cache.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync7, existsSync as existsSync13, mkdirSync as mkdirSync6 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
-import { homedir as homedir10 } from "node:os";
-import { join as join10 } from "node:path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync8, existsSync as existsSync14, mkdirSync as mkdirSync7 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { join as join11 } from "node:path";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -12229,8 +12432,8 @@ function parseRuleFields(raw) {
 }
 
 // src/hooks/runtime/guard-rules-cache.ts
-var DEFAULT_CACHE_FILE = join10(
-  homedir10(),
+var DEFAULT_CACHE_FILE = join11(
+  homedir11(),
   ".cybedefend",
   "guards-cache.json"
 );
@@ -12366,9 +12569,9 @@ function makeGuardRulesCache(opts) {
     }
   }
   function readCache(projectId) {
-    if (!existsSync13(cacheFile)) return null;
+    if (!existsSync14(cacheFile)) return null;
     try {
-      const raw = readFileSync12(cacheFile, "utf8");
+      const raw = readFileSync13(cacheFile, "utf8");
       const data = JSON.parse(raw);
       if (data.projectId !== projectId) return null;
       return data;
@@ -12379,16 +12582,16 @@ function makeGuardRulesCache(opts) {
   function writeCache(entry) {
     try {
       ensureDirFor2(cacheFile);
-      writeFileSync7(cacheFile, JSON.stringify(entry), "utf8");
+      writeFileSync8(cacheFile, JSON.stringify(entry), "utf8");
     } catch {
     }
   }
   return { refreshIfStale };
 }
 function ensureDirFor2(filePath) {
-  const dir = dirname6(filePath);
-  if (!existsSync13(dir)) {
-    mkdirSync6(dir, { recursive: true });
+  const dir = dirname7(filePath);
+  if (!existsSync14(dir)) {
+    mkdirSync7(dir, { recursive: true });
   }
 }
 var DEFAULT_TIMEOUT_MS2 = 8e3;
@@ -12521,11 +12724,11 @@ function detectPromptInjection(text) {
 }
 
 // src/hooks/runtime/judge-cache.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync8, existsSync as existsSync14, mkdirSync as mkdirSync7 } from "node:fs";
-import { dirname as dirname7, join as join11 } from "node:path";
-import { homedir as homedir11 } from "node:os";
-var DEFAULT_JUDGE_CACHE_FILE = join11(
-  homedir11(),
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync9, existsSync as existsSync15, mkdirSync as mkdirSync8 } from "node:fs";
+import { dirname as dirname8, join as join12 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+var DEFAULT_JUDGE_CACHE_FILE = join12(
+  homedir12(),
   ".cybedefend",
   "guards-judge-cache.json"
 );
@@ -12535,9 +12738,9 @@ function makeJudgeCache(opts = {}) {
   const ttlMs = opts.ttlMs ?? DEFAULT_JUDGE_TTL_MS;
   const now = opts.now ?? (() => Date.now());
   function readAll() {
-    if (!existsSync14(cacheFile)) return {};
+    if (!existsSync15(cacheFile)) return {};
     try {
-      return JSON.parse(readFileSync13(cacheFile, "utf8"));
+      return JSON.parse(readFileSync14(cacheFile, "utf8"));
     } catch {
       return {};
     }
@@ -12557,36 +12760,36 @@ function makeJudgeCache(opts = {}) {
       }
       all[key] = { res, at: t };
       ensureDirFor3(cacheFile);
-      writeFileSync8(cacheFile, JSON.stringify(all), "utf8");
+      writeFileSync9(cacheFile, JSON.stringify(all), "utf8");
     } catch {
     }
   }
   return { get, set };
 }
 function ensureDirFor3(filePath) {
-  const dir = dirname7(filePath);
-  if (!existsSync14(dir)) {
-    mkdirSync7(dir, { recursive: true });
+  const dir = dirname8(filePath);
+  if (!existsSync15(dir)) {
+    mkdirSync8(dir, { recursive: true });
   }
 }
 
 // src/hooks/runtime/guard-check.ts
-import { homedir as homedir13 } from "node:os";
-import { join as join13 } from "node:path";
+import { homedir as homedir14 } from "node:os";
+import { join as join14 } from "node:path";
 
 // src/hooks/runtime/guard-violations-buffer.ts
 import {
   appendFileSync,
-  existsSync as existsSync15,
-  readFileSync as readFileSync14,
-  writeFileSync as writeFileSync9,
-  mkdirSync as mkdirSync8
+  existsSync as existsSync16,
+  readFileSync as readFileSync15,
+  writeFileSync as writeFileSync10,
+  mkdirSync as mkdirSync9
 } from "node:fs";
-import { dirname as dirname8 } from "node:path";
-import { homedir as homedir12 } from "node:os";
-import { join as join12 } from "node:path";
-var DEFAULT_BUFFER_FILE = join12(
-  homedir12(),
+import { dirname as dirname9 } from "node:path";
+import { homedir as homedir13 } from "node:os";
+import { join as join13 } from "node:path";
+var DEFAULT_BUFFER_FILE = join13(
+  homedir13(),
   ".cybedefend",
   "guards-violations-buffer.jsonl"
 );
@@ -12605,10 +12808,10 @@ function makeViolationsBuffer(opts = {}) {
     }
   }
   async function flushViolations2(ctx, postFn) {
-    if (!existsSync15(bufferFile)) return;
+    if (!existsSync16(bufferFile)) return;
     let content;
     try {
-      content = readFileSync14(bufferFile, "utf8").trim();
+      content = readFileSync15(bufferFile, "utf8").trim();
     } catch {
       return;
     }
@@ -12627,7 +12830,7 @@ function makeViolationsBuffer(opts = {}) {
     }
     if (records.length === 0) {
       try {
-        writeFileSync9(bufferFile, "", "utf8");
+        writeFileSync10(bufferFile, "", "utf8");
       } catch {
       }
       return;
@@ -12657,10 +12860,10 @@ function makeViolationsBuffer(opts = {}) {
     }
     try {
       if (failed.length === 0) {
-        writeFileSync9(bufferFile, "", "utf8");
+        writeFileSync10(bufferFile, "", "utf8");
       } else {
         const serialised = failed.map((r) => JSON.stringify(r)).join("\n") + "\n";
-        writeFileSync9(bufferFile, serialised, "utf8");
+        writeFileSync10(bufferFile, serialised, "utf8");
       }
     } catch {
     }
@@ -12668,9 +12871,9 @@ function makeViolationsBuffer(opts = {}) {
   return { bufferViolation: bufferViolation2, flushViolations: flushViolations2 };
 }
 function ensureDirFor4(filePath) {
-  const dir = dirname8(filePath);
-  if (!existsSync15(dir)) {
-    mkdirSync8(dir, { recursive: true });
+  const dir = dirname9(filePath);
+  if (!existsSync16(dir)) {
+    mkdirSync9(dir, { recursive: true });
   }
 }
 var _defaultBuffer = makeViolationsBuffer();
@@ -12696,11 +12899,11 @@ function appendDebugLog(entry) {
   try {
     const homeDir = process.env.HOME ?? process.env.USERPROFILE ?? "";
     if (!homeDir) return;
-    const { mkdirSync: mkdirSync9, appendFileSync: appendFileSync2 } = __require("node:fs");
-    const { join: join14 } = __require("node:path");
-    const dir = join14(homeDir, ".cybedefend");
-    mkdirSync9(dir, { recursive: true });
-    appendFileSync2(join14(dir, "hook-debug.log"), entry + "\n", "utf8");
+    const { mkdirSync: mkdirSync10, appendFileSync: appendFileSync2 } = __require("node:fs");
+    const { join: join15 } = __require("node:path");
+    const dir = join15(homeDir, ".cybedefend");
+    mkdirSync10(dir, { recursive: true });
+    appendFileSync2(join15(dir, "hook-debug.log"), entry + "\n", "utf8");
   } catch {
   }
 }
@@ -13071,7 +13274,7 @@ function emitUnverifiedBanner(reason) {
     }
   }
 }
-function sessionIdOf2(envelope) {
+function sessionIdOf3(envelope) {
   return typeof envelope.session_id === "string" ? envelope.session_id : typeof envelope.sessionId === "string" ? envelope.sessionId : void 0;
 }
 async function runPreToolUseGuardWith(opts) {
@@ -13091,7 +13294,7 @@ async function runPreToolUseGuardWith(opts) {
   }
   if (rulesOutcome.kind === "blocked") {
     const sentence = opts.usageNotifier?.notifyBlock(
-      sessionIdOf2(stdinEnvelope),
+      sessionIdOf3(stdinEnvelope),
       rulesOutcome.block
     );
     if (sentence) emitAgentMessage("warn", sentence);
@@ -13101,7 +13304,7 @@ async function runPreToolUseGuardWith(opts) {
   const caller = sniff(stdinEnvelope);
   const partial = mapEnvelopeToGuardRequest(stdinEnvelope, caller.client);
   if (partial === null) return 0;
-  const sessionId = sessionIdOf2(stdinEnvelope);
+  const sessionId = sessionIdOf3(stdinEnvelope);
   const guardRequest = {
     ...partial,
     projectId: projectContext.projectId,
@@ -13245,12 +13448,12 @@ function emitAgentMessage(verdict, message) {
 }
 function makeProductionJudgeDeps() {
   const cache = makeJudgeCache();
-  const warnDir = process.env.CYBEDEFEND_BASELINE_DIR ?? join13(homedir13(), ".cybedefend");
+  const warnDir = process.env.CYBEDEFEND_BASELINE_DIR ?? join14(homedir14(), ".cybedefend");
   const warnTracker = defaultSessionTracker(
-    join13(warnDir, "guards-judge-warned-sessions.json")
+    join14(warnDir, "guards-judge-warned-sessions.json")
   );
   const blockedTracker = defaultSessionTracker(
-    join13(warnDir, "guards-judge-blocked-sessions.json")
+    join14(warnDir, "guards-judge-blocked-sessions.json")
   );
   return {
     usage: {
@@ -13279,7 +13482,9 @@ async function runPreToolUseGuard() {
     const envelope = await readStdinJson();
     const config = loadRuntimeConfig();
     if (!config) return 0;
-    const { projectId, apiBase: configApiBase } = await resolveProjectIdWithApi();
+    const folder = sessionFolderOf(envelope, sniff(envelope).client);
+    if (isSessionInactive(envelope, { cwd: folder })) return 0;
+    const { projectId, apiBase: configApiBase } = await resolveProjectIdWithApi(folder);
     if (!projectId) return 0;
     const apiBaseResolved = process.env.CYBEDEFEND_API_BASE ?? configApiBase ?? config.region.apiBase;
     const token = await resolveTokenWithRefresh(