@mnemonik/claude-code-hooks 0.9.22 → 0.9.23

package/dist/lib/sessionLifecycle.js

@@ -0,0 +1,115 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { link, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+function errorCode(error) {
+    return error && typeof error === 'object' && 'code' in error
+        ? String(error.code)
+        : undefined;
+}
+function lifecyclePath(input) {
+    const key = createHash('sha256')
+        .update(input.server.replace(/\/$/, ''))
+        .update('\0')
+        .update(input.cwd)
+        .update('\0')
+        .update(input.sessionId)
+        .digest('hex');
+    return join(homedir(), '.mnemonik', 'hooks', 'claude-code-hooks', 'session-incarnations', `${key}.json`);
+}
+export async function storeSessionLifecycleToken(input) {
+    const path = lifecyclePath(input);
+    const tmp = `${path}.${process.pid}.tmp`;
+    try {
+        await mkdir(join(path, '..'), { recursive: true, mode: 0o700 });
+        await writeFile(tmp, JSON.stringify({ lifecycleToken: input.lifecycleToken, receivedAt: Date.now() }), { encoding: 'utf8', mode: 0o600 });
+        await rename(tmp, path);
+        return true;
+    }
+    catch {
+        await unlink(tmp).catch(() => { });
+        return false;
+    }
+}
+/**
+ * Read the token that existed when this hook subprocess started. If a newer
+ * SessionStart overwrote the file while an older SessionEnd was delayed, the
+ * local receive timestamp makes the old process fail closed instead of reading
+ * and presenting the new incarnation's capability. Equality also fails closed:
+ * Date.now() has millisecond resolution, so a newer write can share the hook's
+ * captured start timestamp.
+ */
+export async function readSessionLifecycleToken(input) {
+    try {
+        const parsed = JSON.parse(await readFile(lifecyclePath(input), 'utf8'));
+        if (typeof parsed.lifecycleToken !== 'string' ||
+            parsed.lifecycleToken.length === 0 ||
+            typeof parsed.receivedAt !== 'number' ||
+            parsed.receivedAt >= input.invocationStartedAt) {
+            return null;
+        }
+        return parsed.lifecycleToken;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compare-and-remove without a read→unlink TOCTOU. Rename the current record to
+ * a unique quarantine path first, then inspect the exact inode we moved. If a
+ * resumed SessionStart won the race, restore that newer record only when the
+ * canonical path is still absent; hard-link creation is atomic and never
+ * overwrites a still-newer token.
+ */
+export async function removeSessionLifecycleToken(input) {
+    const path = lifecyclePath(input);
+    const quarantine = `${path}.${process.pid}.${randomUUID()}.remove`;
+    let moved = false;
+    try {
+        // Confirm the source is readable before moving it. The content is read
+        // again from quarantine because another process may replace the path after
+        // this check and before rename.
+        await readFile(path, 'utf8');
+        await rename(path, quarantine);
+        moved = true;
+        const raw = await readFile(quarantine, 'utf8');
+        let matches = false;
+        try {
+            matches = JSON.parse(raw).lifecycleToken === input.lifecycleToken;
+        }
+        catch {
+            // Malformed/unknown state is never safe to delete; restore it below.
+        }
+        if (matches) {
+            await unlink(quarantine);
+            moved = false;
+            return;
+        }
+        try {
+            await link(quarantine, path);
+        }
+        catch (error) {
+            if (errorCode(error) !== 'EEXIST')
+                throw error;
+        }
+        await unlink(quarantine);
+        moved = false;
+    }
+    catch {
+        if (moved) {
+            let safeToRemoveQuarantine = false;
+            try {
+                await link(quarantine, path);
+                safeToRemoveQuarantine = true;
+            }
+            catch (error) {
+                safeToRemoveQuarantine = ['EEXIST', 'ENOENT'].includes(errorCode(error) ?? '');
+            }
+            if (safeToRemoveQuarantine)
+                await unlink(quarantine).catch(() => { });
+        }
+        // Best-effort local cleanup; the server token remains authoritative and a
+        // missing capability merely defers to normal inactivity expiry.
+    }
+}
+//# sourceMappingURL=sessionLifecycle.js.map

package/dist/lib/sessionLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionLifecycle.js","sourceRoot":"","sources":["../../src/lib/sessionLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAajC,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;QAC1D,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC7B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;SACvC,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;SACjB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;SACvB,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,IAAI,CACT,OAAO,EAAE,EACT,WAAW,EACX,OAAO,EACP,mBAAmB,EACnB,sBAAsB,EACtB,GAAG,GAAG,OAAO,CACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAqD;IAErD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,CACb,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAChF,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;QACF,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA0D;IAE1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;QAC3F,IACE,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;YACzC,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAClC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,mBAAmB,EAC9C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,cAAc,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAqD;IAErD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,SAAS,CAAC;IACnE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,uEAAuE;QACvE,2EAA2E;QAC3E,gCAAgC;QAChC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/B,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YACzB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,sBAAsB,GAAG,KAAK,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAC7B,sBAAsB,GAAG,IAAI,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,sBAAsB,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,sBAAsB;gBAAE,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,0EAA0E;QAC1E,gEAAgE;IAClE,CAAC;AACH,CAAC"}

package/dist/lib/types.d.ts

@@ -9,6 +9,8 @@ export type HookEventName = 'PreToolUse' | 'PostToolUse' | 'SessionStart' | 'Sto
 export interface HookInput {
     session_id: string;
     transcript_path?: string;
+    trigger?: string;
+    custom_instructions?: string;
     cwd: string;
     hook_event_name: HookEventName;
     permission_mode?: string;
@@ -17,6 +19,8 @@ export interface HookInput {
     tool_input?: Record<string, unknown>;
     tool_response?: Record<string, unknown>;
     tool_use_id?: string;
+    /** Claude SessionEnd reason (for example clear/logout/exit). */
+    reason?: string;
 }
 /** PreToolUse decision shape recognised by Claude Code. */
 export type PermissionDecision = 'allow' | 'deny' | 'ask' | 'defer';
@@ -93,6 +97,8 @@ export interface PolicyReminderResponse {
 export interface InjectionsResponse {
     ok: boolean;
     reason?: 'unauthorized' | 'no_project';
+    /** SessionStart recovery readback for a lost /hooks/session-start response. */
+    lifecycleToken?: string;
     injections: Array<{
         signal: string;
         kind: 'directive' | 'nudge';

package/dist/lib/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmOH,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lib/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAyOH,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mnemonik/claude-code-hooks",
-  "version": "0.9.22",
-  "description": "Claude Code lifecycle contextual hooks for Mnemonik. PreToolUse Edit/Write/NotebookEdit/Bash gates plus SessionStart bootstrap pre-injection, Stop checkpoint gate (advisory), PreCompact context_snapshot pre-injection, SessionEnd save, and UserPromptSubmit context inject. filesToWrite delivery of skill/rules/.mnemonik.json continues to flow for ALL clients including Claude Code — this package adds host-side hook gating only. Versioned independently from the @mnemonik/server release cadence (mirrors @mnemonik/scanner).",
+  "version": "0.9.23",
+  "description": "Claude Code lifecycle contextual hooks for Mnemonik. PreToolUse Edit/Write/NotebookEdit/Bash gates plus SessionStart bootstrap warming, clean Stop, PreCompact context_snapshot creation, bounded SessionEnd cleanup, and UserPromptSubmit context injection. This hooks-only package does not install skills, rules, project identity, or MCP config. Versioned independently from the @mnemonik/server release cadence (mirrors @mnemonik/scanner).",
   "type": "module",
   "bin": {
     "mnemonik-claude-code-hooks": "dist/install.js"