@muggleai/works 5.30.0-staging.263 → 5.30.0-staging.264

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "muggleai",
       "source": "./plugin",
       "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-      "version": "5.30.0-staging.263"
+      "version": "5.30.0-staging.264"
     }
   ]
 }

package/dist/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muggle",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.30.0-staging.263",
+  "version": "5.30.0-staging.264",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/dist/plugin/.codex-mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.30.0-staging.263",
+        "@muggleai/works@5.30.0-staging.264",
         "serve"
       ],
       "env": {

package/dist/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muggle",
-  "version": "5.30.0-staging.263",
+  "version": "5.30.0-staging.264",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
   "author": {
     "name": "Muggle AI",

package/dist/plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "muggle",
   "displayName": "Muggle AI",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.30.0-staging.263",
+  "version": "5.30.0-staging.264",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/dist/plugin/.mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.30.0-staging.263",
+        "@muggleai/works@5.30.0-staging.264",
         "serve"
       ]
     }

package/dist/plugin/hooks/hooks.json

@@ -244,6 +244,13 @@
             "command": "set -- guardrail-dispatch.sh guardrail-e2e-gate.sh guardrail-terminal-gate.sh guardrail-watch-gate.sh guardrail-watch-follow-through-gate.sh guardrail-build-followthrough-gate.sh guardrail-walkthrough-gate.sh guardrail-comment-reply-gate.sh guardrail-stage-gate.sh guardrail-debug-path-gate.sh guardrail-capability-claim.sh; . \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh\"",
             "async": false,
             "timeout": 1
+          },
+          {
+            "type": "command",
+            "command": "set -- guardrail-rewake.sh guardrail-e2e-gate.sh guardrail-terminal-gate.sh guardrail-watch-gate.sh guardrail-watch-follow-through-gate.sh guardrail-build-followthrough-gate.sh guardrail-walkthrough-gate.sh guardrail-comment-reply-gate.sh guardrail-stage-gate.sh guardrail-debug-path-gate.sh guardrail-capability-claim.sh; . \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh\"",
+            "async": true,
+            "asyncRewake": true,
+            "timeout": 30
           }
         ]
       }
@@ -256,6 +263,13 @@
             "command": "set -- guardrail-build-router.sh; . \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh\"",
             "async": false,
             "timeout": 1
+          },
+          {
+            "type": "command",
+            "command": "set -- guardrail-rewake.sh guardrail-build-router.sh; . \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh\"",
+            "async": true,
+            "asyncRewake": true,
+            "timeout": 30
           }
         ]
       }

package/dist/plugin/scripts/guardrail-lib.sh

@@ -150,6 +150,13 @@ guardrail_run_node() {
   node "${root}/scripts/guardrails.mjs" "$@" <<<"$GUARDRAIL_PAYLOAD" 2>/dev/null || printf '{}'
 }
 
+# Runs guardrails.mjs for an asyncRewake companion, which answers through its stderr and exit status rather than
+# stdout: exit 2 is what makes Claude Code wake the session with that stderr, so neither is swallowed here.
+guardrail_run_rewake_node() {
+  local root="${CLAUDE_PLUGIN_ROOT:-${CURSOR_PLUGIN_ROOT:-}}"
+  node "${root}/scripts/guardrails.mjs" "$@" <<<"$GUARDRAIL_PAYLOAD"
+}
+
 # Entry for a gate script executed directly: its guardrail_wants decides whether Node runs.
 guardrail_run_standalone() {
   guardrail_read_payload

package/dist/plugin/scripts/guardrail-rewake.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# Async companion of a synchronous guardrail hook (Stop, UserPromptSubmit). hooks.json runs it beside that hook with
+# `async` and `asyncRewake`, handing it the same gate scripts:
+#
+#   guardrail-rewake.sh guardrail-e2e-gate.sh guardrail-watch-gate.sh ...
+#
+# Claude Code cancels the synchronous hook at its one-second cap and discards what it printed, and on a loaded Windows
+# machine its own Git Bash start can spend that second, so a block or offer decided there can silently never land.
+# Nothing waits on this one. When a gate's pre-filter could fire, or the synchronous run saved an output for the event,
+# guardrails.mjs waits for the transcript to record how the synchronous run ended and, only when it was cancelled,
+# prints what it would have said to stderr and exits 2, which wakes Claude with it. Every other firing ends here in
+# shell, with no process started.
+
+guardrail_script_dir="${BASH_SOURCE[0]%/*}"
+[[ $guardrail_script_dir == "${BASH_SOURCE[0]}" ]] && guardrail_script_dir=.
+. "$guardrail_script_dir/guardrail-lib.sh"
+
+guardrail_read_payload
+
+firing_subcommands=()
+for gate_script in "$@"; do
+  GUARDRAIL_SUBCOMMAND=""
+  . "$guardrail_script_dir/$gate_script" || continue
+  if [[ -n $GUARDRAIL_SUBCOMMAND ]] && guardrail_wants; then
+    firing_subcommands+=("$GUARDRAIL_SUBCOMMAND")
+  fi
+done
+
+guardrail_payload_field hook_event_name || exit 0
+guardrail_resolve_state_file
+# Named as sessionState.ts names the sidecar SYNC_HOOK_OUTPUT_SUFFIX describes.
+sync_output_file="${GUARDRAIL_STATE_FILE%.json}.${GUARDRAIL_FIELD_VALUE}-sync-output.json"
+if [[ ${#firing_subcommands[@]} -eq 0 && ! -f $sync_output_file ]]; then
+  exit 0
+fi
+
+# The expansion guard keeps an empty list from tripping `set -u` on bash 3.2.
+guardrail_run_rewake_node rewake ${firing_subcommands[@]+"${firing_subcommands[@]}"}

package/dist/plugin/scripts/guardrails.mjs

@@ -1,8 +1,9 @@
-import { readFileSync, existsSync, readdirSync, mkdirSync, openSync, fstatSync, readSync, closeSync, statSync, writeFileSync, renameSync, writeSync, unlinkSync, rmSync } from 'fs';
+import { readFileSync, rmSync, existsSync, readdirSync, mkdirSync, openSync, fstatSync, readSync, closeSync, statSync, writeFileSync, renameSync, writeSync, unlinkSync } from 'fs';
 import { join, isAbsolute, resolve, basename, dirname } from 'path';
 import { homedir, tmpdir, hostname } from 'os';
 import { execFileSync, spawn } from 'child_process';
 import { fileURLToPath } from 'url';
+import { createHash } from 'crypto';
 
 // src/guardrails/cli.ts
 
@@ -110,6 +111,26 @@ var E2E_STOP_VERDICT_SUFFIX = ".e2e-stop-verdict";
 var E2E_SHELL_BLOCKS_SUFFIX = ".e2e-shell-blocks";
 var AUTO_E2E_TEST_PREFERENCE_KEY = "autoE2ETest";
 var POST_PR_VISUAL_WALKTHROUGH_PREFERENCE_KEY = "postPRVisualWalkthrough";
+var REWAKE_HOOK_EVENTS = ["Stop", "UserPromptSubmit"];
+var REWAKE_SUBCOMMAND = "rewake";
+var REWAKE_HOOK_SCRIPT = "guardrail-rewake.sh";
+var GUARDRAIL_HOOK_COMMAND_MARKER = "guardrail-";
+var SYNC_HOOK_OUTPUT_SUFFIX = "-sync-output.json";
+var TRANSCRIPT_HOOK_CANCELLED_TYPE = "hook_cancelled";
+var TRANSCRIPT_HOOK_RECORD_TYPE_PREFIX = "hook_";
+var REWAKE_OUTCOME_WAIT_MS = 2e4;
+var REWAKE_OUTCOME_POLL_MS = 250;
+var REWAKE_TRANSCRIPT_TAIL_BYTES = 512e3;
+var REWAKE_ANCHOR_CHARS = 120;
+var REWAKE_MESSAGE_PREFIX = {
+  Stop: "Muggle Stop check, delivered late because the turn-end hook outlasted its 1 s budget and was cancelled \u2014 act on it now:",
+  UserPromptSubmit: "Muggle prompt check, delivered late because the prompt hook outlasted its 1 s budget and was cancelled:"
+};
+var COMMANDLESS_HOOK_DELIVERY_TYPES = ["hook_additional_context", "hook_blocking_error"];
+var REWAKE_ANCHOR_ROLE_BY_EVENT = {
+  Stop: "assistant",
+  UserPromptSubmit: "user"
+};
 
 // src/guardrails/store/fileLock.ts
 function isProcessAlive(pid) {
@@ -244,6 +265,21 @@ function readE2eShellBlockCount(sessionId2, dirOverride) {
 function clearE2eShellBlocks(sessionId2, dirOverride) {
   rmSync(fileFor(sessionId2, dirOverride, E2E_SHELL_BLOCKS_SUFFIX), { force: true });
 }
+var syncHookOutputFile = (sessionId2, hookEventName, dirOverride) => fileFor(sessionId2, dirOverride, `.${hookEventName}${SYNC_HOOK_OUTPUT_SUFFIX}`);
+function writeSyncHookOutput(sessionId2, hookEventName, record, dirOverride) {
+  writeAtomically(syncHookOutputFile(sessionId2, hookEventName, dirOverride), record, dirOverride);
+}
+function takeSyncHookOutput(sessionId2, hookEventName, payloadDigest2, dirOverride) {
+  const target = syncHookOutputFile(sessionId2, hookEventName, dirOverride);
+  try {
+    const record = JSON.parse(readFileSync(target, "utf-8"));
+    if (record.payloadDigest !== payloadDigest2) return null;
+    rmSync(target, { force: true });
+    return record;
+  } catch {
+    return null;
+  }
+}
 var lockFor = (sessionId2, dirOverride) => `${fileFor(sessionId2, dirOverride)}.lock`;
 function commitUnderHeldLock(sessionId2, mutate, dirOverride) {
   const current = readState(sessionId2, dirOverride);
@@ -2829,6 +2865,63 @@ function normalizeHookInput(raw) {
   }
   return payload;
 }
+function payloadDigest(rawPayload2) {
+  return createHash("sha1").update(rawPayload2).digest("hex");
+}
+function transcriptAnchor(input2) {
+  const anchorText = input2.hook_event_name === "Stop" ? input2.last_assistant_message?.trimEnd().slice(-REWAKE_ANCHOR_CHARS) : input2.hook_event_name === "UserPromptSubmit" ? input2.prompt?.trimStart().slice(0, REWAKE_ANCHOR_CHARS) : void 0;
+  if (!anchorText?.trim()) return void 0;
+  return JSON.stringify(anchorText).slice(1, -1);
+}
+var jsonFieldPattern = (field, value) => new RegExp(`"${field}"\\s*:\\s*"${value}"`);
+function parseHookRecord(line, hookEventName) {
+  if (!jsonFieldPattern("hookEvent", hookEventName).test(line)) return void 0;
+  try {
+    const record = JSON.parse(line).attachment;
+    if (!record?.type?.startsWith(TRANSCRIPT_HOOK_RECORD_TYPE_PREFIX) || record.hookEvent !== hookEventName) return void 0;
+    return record;
+  } catch {
+    return void 0;
+  }
+}
+function isSyncGuardrailCommand(command) {
+  return command.includes(GUARDRAIL_HOOK_COMMAND_MARKER) && !command.includes(REWAKE_HOOK_SCRIPT);
+}
+function findSyncHookOutcome(transcriptTail, hookEventName, anchor) {
+  const lines = transcriptTail.split("\n");
+  const anchorRolePattern = jsonFieldPattern("type", REWAKE_ANCHOR_ROLE_BY_EVENT[hookEventName] ?? "");
+  let anchorIndex = -1;
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    if (lines[index].includes(anchor) && anchorRolePattern.test(lines[index])) {
+      anchorIndex = index;
+      break;
+    }
+  }
+  if (anchorIndex < 0) return "unrecorded" /* Unrecorded */;
+  for (const line of lines.slice(anchorIndex + 1)) {
+    const record = parseHookRecord(line, hookEventName);
+    if (!record) continue;
+    if (typeof record.command === "string") {
+      if (!isSyncGuardrailCommand(record.command)) continue;
+      return record.type === TRANSCRIPT_HOOK_CANCELLED_TYPE ? "cancelled" /* Cancelled */ : "delivered" /* Delivered */;
+    }
+    if (COMMANDLESS_HOOK_DELIVERY_TYPES.includes(record.type)) return "delivered" /* Delivered */;
+  }
+  return "unrecorded" /* Unrecorded */;
+}
+function rewakeMessage(hookEventName, hookOutput) {
+  let parsedOutput;
+  try {
+    parsedOutput = JSON.parse(hookOutput);
+  } catch {
+    return "";
+  }
+  const deliveredText = hookEventName === "Stop" ? parsedOutput.decision === "block" ? parsedOutput.reason : void 0 : parsedOutput.hookSpecificOutput?.additionalContext ?? parsedOutput.additional_context;
+  if (!deliveredText) return "";
+  return `${REWAKE_MESSAGE_PREFIX[hookEventName] ?? ""}
+
+${deliveredText}`;
+}
 
 // src/guardrails/hookHost.ts
 function resolveHookHost(env = process.env) {
@@ -2842,17 +2935,25 @@ function skillInvocation(slashCommand, host2) {
 }
 
 // src/guardrails/cli.ts
-function readStdin() {
+function readStdinText() {
+  try {
+    return readFileSync(0, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function parseHookInput(rawHookPayload) {
   try {
-    return normalizeHookInput(JSON.parse(readFileSync(0, "utf-8")));
+    return normalizeHookInput(JSON.parse(rawHookPayload));
   } catch {
     return {};
   }
 }
 var host = resolveHookHost();
 var sub = process.argv[2];
-if (!isBackgroundJob(sub)) enforceHookChildProcessDeadline();
-var input = readStdin();
+if (!isBackgroundJob(sub) && sub !== REWAKE_SUBCOMMAND) enforceHookChildProcessDeadline();
+var rawPayload = readStdinText();
+var input = parseHookInput(rawPayload);
 var sessionId = input.session_id ?? "unknown";
 function releaseGate(field) {
   commitStateMutation(sessionId, { kind: "fields" /* Fields */, fields: { [field]: true } });
@@ -3422,5 +3523,47 @@ var backgroundJobs = {
   ["scan-watch-pr-states" /* ScanWatchPrStates */]: scanWatchPrStatesJob,
   ["commit-deferred-state" /* CommitDeferredState */]: commitDeferredStateJob
 };
-var runSubcommand = isBackgroundJob(sub) ? backgroundJobs[sub] : handlers[sub] ?? (() => "{}");
-process.stdout.write(runSubcommand());
+function waitSync(milliseconds) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+function awaitSyncHookOutcome(hookEventName) {
+  const anchor = transcriptAnchor(
+    hookEventName === "Stop" ? { ...input, last_assistant_message: closingAssistantText() } : input
+  );
+  const transcriptPath = input.transcript_path;
+  if (!anchor || !transcriptPath) return "unrecorded" /* Unrecorded */;
+  const deadline = Date.now() + REWAKE_OUTCOME_WAIT_MS;
+  for (; ; ) {
+    const transcriptTail = readFileTail(transcriptPath, REWAKE_TRANSCRIPT_TAIL_BYTES) ?? "";
+    const outcome = findSyncHookOutcome(transcriptTail, hookEventName, anchor);
+    if (outcome !== "unrecorded" /* Unrecorded */ || Date.now() >= deadline) return outcome;
+    waitSync(REWAKE_OUTCOME_POLL_MS);
+  }
+}
+function rewake() {
+  const hookEventName = input.hook_event_name ?? "";
+  const outcome = awaitSyncHookOutcome(hookEventName);
+  const savedOutput = takeSyncHookOutput(sessionId, hookEventName, payloadDigest(rawPayload));
+  if (outcome === "delivered" /* Delivered */) return "";
+  return rewakeMessage(hookEventName, savedOutput ? savedOutput.hookOutput : runFiringGates());
+}
+function saveSyncHookOutput(hookOutput) {
+  const hookEventName = input.hook_event_name ?? "";
+  if (!REWAKE_HOOK_EVENTS.includes(hookEventName)) return;
+  try {
+    writeSyncHookOutput(sessionId, hookEventName, { payloadDigest: payloadDigest(rawPayload), hookOutput });
+  } catch {
+  }
+}
+if (sub === REWAKE_SUBCOMMAND) {
+  const rewakeText = rewake();
+  if (rewakeText) {
+    process.stderr.write(rewakeText);
+    process.exitCode = 2;
+  }
+} else {
+  const runSubcommand = isBackgroundJob(sub) ? backgroundJobs[sub] : handlers[sub] ?? (() => "{}");
+  const hookOutput = runSubcommand();
+  if (!isBackgroundJob(sub)) saveSyncHookOutput(hookOutput);
+  process.stdout.write(hookOutput);
+}

package/dist/release-manifest.json

@@ -1,7 +1,7 @@
 {
   "release": "5.26.0",
-  "buildId": "run-263-1",
-  "commitSha": "6a3249334b037fa0fa14f446e6345aa1c3a0fe01",
-  "buildTime": "2026-10-30T23:12:33Z",
+  "buildId": "run-264-1",
+  "commitSha": "31c63b7f92a9fbe2a2cf3bfc1bcf4c4828f93e49",
+  "buildTime": "2026-10-31T04:22:47Z",
   "serviceName": "muggle-ai-works-mcp"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@muggleai/works",
   "mcpName": "io.github.multiplex-ai/muggle",
-  "version": "5.30.0-staging.263",
+  "version": "5.30.0-staging.264",
   "description": "13 years of Microsoft hyperscale engineering, packaged as a harness for your AI coding agent.",
   "type": "module",
   "main": "dist/index.js",

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muggle",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.30.0-staging.263",
+  "version": "5.30.0-staging.264",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/plugin/.codex-mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.30.0-staging.263",
+        "@muggleai/works@5.30.0-staging.264",
         "serve"
       ],
       "env": {

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muggle",
-  "version": "5.30.0-staging.263",
+  "version": "5.30.0-staging.264",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
   "author": {
     "name": "Muggle AI",

package/plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "muggle",
   "displayName": "Muggle AI",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.30.0-staging.263",
+  "version": "5.30.0-staging.264",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/plugin/.mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.30.0-staging.263",
+        "@muggleai/works@5.30.0-staging.264",
         "serve"
       ]
     }

package/plugin/hooks/hooks.json

@@ -244,6 +244,13 @@
             "command": "set -- guardrail-dispatch.sh guardrail-e2e-gate.sh guardrail-terminal-gate.sh guardrail-watch-gate.sh guardrail-watch-follow-through-gate.sh guardrail-build-followthrough-gate.sh guardrail-walkthrough-gate.sh guardrail-comment-reply-gate.sh guardrail-stage-gate.sh guardrail-debug-path-gate.sh guardrail-capability-claim.sh; . \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh\"",
             "async": false,
             "timeout": 1
+          },
+          {
+            "type": "command",
+            "command": "set -- guardrail-rewake.sh guardrail-e2e-gate.sh guardrail-terminal-gate.sh guardrail-watch-gate.sh guardrail-watch-follow-through-gate.sh guardrail-build-followthrough-gate.sh guardrail-walkthrough-gate.sh guardrail-comment-reply-gate.sh guardrail-stage-gate.sh guardrail-debug-path-gate.sh guardrail-capability-claim.sh; . \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh\"",
+            "async": true,
+            "asyncRewake": true,
+            "timeout": 30
           }
         ]
       }
@@ -256,6 +263,13 @@
             "command": "set -- guardrail-build-router.sh; . \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh\"",
             "async": false,
             "timeout": 1
+          },
+          {
+            "type": "command",
+            "command": "set -- guardrail-rewake.sh guardrail-build-router.sh; . \"${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh\"",
+            "async": true,
+            "asyncRewake": true,
+            "timeout": 30
           }
         ]
       }

package/plugin/scripts/guardrail-lib.sh

@@ -150,6 +150,13 @@ guardrail_run_node() {
   node "${root}/scripts/guardrails.mjs" "$@" <<<"$GUARDRAIL_PAYLOAD" 2>/dev/null || printf '{}'
 }
 
+# Runs guardrails.mjs for an asyncRewake companion, which answers through its stderr and exit status rather than
+# stdout: exit 2 is what makes Claude Code wake the session with that stderr, so neither is swallowed here.
+guardrail_run_rewake_node() {
+  local root="${CLAUDE_PLUGIN_ROOT:-${CURSOR_PLUGIN_ROOT:-}}"
+  node "${root}/scripts/guardrails.mjs" "$@" <<<"$GUARDRAIL_PAYLOAD"
+}
+
 # Entry for a gate script executed directly: its guardrail_wants decides whether Node runs.
 guardrail_run_standalone() {
   guardrail_read_payload

package/plugin/scripts/guardrail-rewake.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# Async companion of a synchronous guardrail hook (Stop, UserPromptSubmit). hooks.json runs it beside that hook with
+# `async` and `asyncRewake`, handing it the same gate scripts:
+#
+#   guardrail-rewake.sh guardrail-e2e-gate.sh guardrail-watch-gate.sh ...
+#
+# Claude Code cancels the synchronous hook at its one-second cap and discards what it printed, and on a loaded Windows
+# machine its own Git Bash start can spend that second, so a block or offer decided there can silently never land.
+# Nothing waits on this one. When a gate's pre-filter could fire, or the synchronous run saved an output for the event,
+# guardrails.mjs waits for the transcript to record how the synchronous run ended and, only when it was cancelled,
+# prints what it would have said to stderr and exits 2, which wakes Claude with it. Every other firing ends here in
+# shell, with no process started.
+
+guardrail_script_dir="${BASH_SOURCE[0]%/*}"
+[[ $guardrail_script_dir == "${BASH_SOURCE[0]}" ]] && guardrail_script_dir=.
+. "$guardrail_script_dir/guardrail-lib.sh"
+
+guardrail_read_payload
+
+firing_subcommands=()
+for gate_script in "$@"; do
+  GUARDRAIL_SUBCOMMAND=""
+  . "$guardrail_script_dir/$gate_script" || continue
+  if [[ -n $GUARDRAIL_SUBCOMMAND ]] && guardrail_wants; then
+    firing_subcommands+=("$GUARDRAIL_SUBCOMMAND")
+  fi
+done
+
+guardrail_payload_field hook_event_name || exit 0
+guardrail_resolve_state_file
+# Named as sessionState.ts names the sidecar SYNC_HOOK_OUTPUT_SUFFIX describes.
+sync_output_file="${GUARDRAIL_STATE_FILE%.json}.${GUARDRAIL_FIELD_VALUE}-sync-output.json"
+if [[ ${#firing_subcommands[@]} -eq 0 && ! -f $sync_output_file ]]; then
+  exit 0
+fi
+
+# The expansion guard keeps an empty list from tripping `set -u` on bash 3.2.
+guardrail_run_rewake_node rewake ${firing_subcommands[@]+"${firing_subcommands[@]}"}

package/plugin/scripts/guardrails.mjs

@@ -1,8 +1,9 @@
-import { readFileSync, existsSync, readdirSync, mkdirSync, openSync, fstatSync, readSync, closeSync, statSync, writeFileSync, renameSync, writeSync, unlinkSync, rmSync } from 'fs';
+import { readFileSync, rmSync, existsSync, readdirSync, mkdirSync, openSync, fstatSync, readSync, closeSync, statSync, writeFileSync, renameSync, writeSync, unlinkSync } from 'fs';
 import { join, isAbsolute, resolve, basename, dirname } from 'path';
 import { homedir, tmpdir, hostname } from 'os';
 import { execFileSync, spawn } from 'child_process';
 import { fileURLToPath } from 'url';
+import { createHash } from 'crypto';
 
 // src/guardrails/cli.ts
 
@@ -110,6 +111,26 @@ var E2E_STOP_VERDICT_SUFFIX = ".e2e-stop-verdict";
 var E2E_SHELL_BLOCKS_SUFFIX = ".e2e-shell-blocks";
 var AUTO_E2E_TEST_PREFERENCE_KEY = "autoE2ETest";
 var POST_PR_VISUAL_WALKTHROUGH_PREFERENCE_KEY = "postPRVisualWalkthrough";
+var REWAKE_HOOK_EVENTS = ["Stop", "UserPromptSubmit"];
+var REWAKE_SUBCOMMAND = "rewake";
+var REWAKE_HOOK_SCRIPT = "guardrail-rewake.sh";
+var GUARDRAIL_HOOK_COMMAND_MARKER = "guardrail-";
+var SYNC_HOOK_OUTPUT_SUFFIX = "-sync-output.json";
+var TRANSCRIPT_HOOK_CANCELLED_TYPE = "hook_cancelled";
+var TRANSCRIPT_HOOK_RECORD_TYPE_PREFIX = "hook_";
+var REWAKE_OUTCOME_WAIT_MS = 2e4;
+var REWAKE_OUTCOME_POLL_MS = 250;
+var REWAKE_TRANSCRIPT_TAIL_BYTES = 512e3;
+var REWAKE_ANCHOR_CHARS = 120;
+var REWAKE_MESSAGE_PREFIX = {
+  Stop: "Muggle Stop check, delivered late because the turn-end hook outlasted its 1 s budget and was cancelled \u2014 act on it now:",
+  UserPromptSubmit: "Muggle prompt check, delivered late because the prompt hook outlasted its 1 s budget and was cancelled:"
+};
+var COMMANDLESS_HOOK_DELIVERY_TYPES = ["hook_additional_context", "hook_blocking_error"];
+var REWAKE_ANCHOR_ROLE_BY_EVENT = {
+  Stop: "assistant",
+  UserPromptSubmit: "user"
+};
 
 // src/guardrails/store/fileLock.ts
 function isProcessAlive(pid) {
@@ -244,6 +265,21 @@ function readE2eShellBlockCount(sessionId2, dirOverride) {
 function clearE2eShellBlocks(sessionId2, dirOverride) {
   rmSync(fileFor(sessionId2, dirOverride, E2E_SHELL_BLOCKS_SUFFIX), { force: true });
 }
+var syncHookOutputFile = (sessionId2, hookEventName, dirOverride) => fileFor(sessionId2, dirOverride, `.${hookEventName}${SYNC_HOOK_OUTPUT_SUFFIX}`);
+function writeSyncHookOutput(sessionId2, hookEventName, record, dirOverride) {
+  writeAtomically(syncHookOutputFile(sessionId2, hookEventName, dirOverride), record, dirOverride);
+}
+function takeSyncHookOutput(sessionId2, hookEventName, payloadDigest2, dirOverride) {
+  const target = syncHookOutputFile(sessionId2, hookEventName, dirOverride);
+  try {
+    const record = JSON.parse(readFileSync(target, "utf-8"));
+    if (record.payloadDigest !== payloadDigest2) return null;
+    rmSync(target, { force: true });
+    return record;
+  } catch {
+    return null;
+  }
+}
 var lockFor = (sessionId2, dirOverride) => `${fileFor(sessionId2, dirOverride)}.lock`;
 function commitUnderHeldLock(sessionId2, mutate, dirOverride) {
   const current = readState(sessionId2, dirOverride);
@@ -2829,6 +2865,63 @@ function normalizeHookInput(raw) {
   }
   return payload;
 }
+function payloadDigest(rawPayload2) {
+  return createHash("sha1").update(rawPayload2).digest("hex");
+}
+function transcriptAnchor(input2) {
+  const anchorText = input2.hook_event_name === "Stop" ? input2.last_assistant_message?.trimEnd().slice(-REWAKE_ANCHOR_CHARS) : input2.hook_event_name === "UserPromptSubmit" ? input2.prompt?.trimStart().slice(0, REWAKE_ANCHOR_CHARS) : void 0;
+  if (!anchorText?.trim()) return void 0;
+  return JSON.stringify(anchorText).slice(1, -1);
+}
+var jsonFieldPattern = (field, value) => new RegExp(`"${field}"\\s*:\\s*"${value}"`);
+function parseHookRecord(line, hookEventName) {
+  if (!jsonFieldPattern("hookEvent", hookEventName).test(line)) return void 0;
+  try {
+    const record = JSON.parse(line).attachment;
+    if (!record?.type?.startsWith(TRANSCRIPT_HOOK_RECORD_TYPE_PREFIX) || record.hookEvent !== hookEventName) return void 0;
+    return record;
+  } catch {
+    return void 0;
+  }
+}
+function isSyncGuardrailCommand(command) {
+  return command.includes(GUARDRAIL_HOOK_COMMAND_MARKER) && !command.includes(REWAKE_HOOK_SCRIPT);
+}
+function findSyncHookOutcome(transcriptTail, hookEventName, anchor) {
+  const lines = transcriptTail.split("\n");
+  const anchorRolePattern = jsonFieldPattern("type", REWAKE_ANCHOR_ROLE_BY_EVENT[hookEventName] ?? "");
+  let anchorIndex = -1;
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    if (lines[index].includes(anchor) && anchorRolePattern.test(lines[index])) {
+      anchorIndex = index;
+      break;
+    }
+  }
+  if (anchorIndex < 0) return "unrecorded" /* Unrecorded */;
+  for (const line of lines.slice(anchorIndex + 1)) {
+    const record = parseHookRecord(line, hookEventName);
+    if (!record) continue;
+    if (typeof record.command === "string") {
+      if (!isSyncGuardrailCommand(record.command)) continue;
+      return record.type === TRANSCRIPT_HOOK_CANCELLED_TYPE ? "cancelled" /* Cancelled */ : "delivered" /* Delivered */;
+    }
+    if (COMMANDLESS_HOOK_DELIVERY_TYPES.includes(record.type)) return "delivered" /* Delivered */;
+  }
+  return "unrecorded" /* Unrecorded */;
+}
+function rewakeMessage(hookEventName, hookOutput) {
+  let parsedOutput;
+  try {
+    parsedOutput = JSON.parse(hookOutput);
+  } catch {
+    return "";
+  }
+  const deliveredText = hookEventName === "Stop" ? parsedOutput.decision === "block" ? parsedOutput.reason : void 0 : parsedOutput.hookSpecificOutput?.additionalContext ?? parsedOutput.additional_context;
+  if (!deliveredText) return "";
+  return `${REWAKE_MESSAGE_PREFIX[hookEventName] ?? ""}
+
+${deliveredText}`;
+}
 
 // src/guardrails/hookHost.ts
 function resolveHookHost(env = process.env) {
@@ -2842,17 +2935,25 @@ function skillInvocation(slashCommand, host2) {
 }
 
 // src/guardrails/cli.ts
-function readStdin() {
+function readStdinText() {
+  try {
+    return readFileSync(0, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function parseHookInput(rawHookPayload) {
   try {
-    return normalizeHookInput(JSON.parse(readFileSync(0, "utf-8")));
+    return normalizeHookInput(JSON.parse(rawHookPayload));
   } catch {
     return {};
   }
 }
 var host = resolveHookHost();
 var sub = process.argv[2];
-if (!isBackgroundJob(sub)) enforceHookChildProcessDeadline();
-var input = readStdin();
+if (!isBackgroundJob(sub) && sub !== REWAKE_SUBCOMMAND) enforceHookChildProcessDeadline();
+var rawPayload = readStdinText();
+var input = parseHookInput(rawPayload);
 var sessionId = input.session_id ?? "unknown";
 function releaseGate(field) {
   commitStateMutation(sessionId, { kind: "fields" /* Fields */, fields: { [field]: true } });
@@ -3422,5 +3523,47 @@ var backgroundJobs = {
   ["scan-watch-pr-states" /* ScanWatchPrStates */]: scanWatchPrStatesJob,
   ["commit-deferred-state" /* CommitDeferredState */]: commitDeferredStateJob
 };
-var runSubcommand = isBackgroundJob(sub) ? backgroundJobs[sub] : handlers[sub] ?? (() => "{}");
-process.stdout.write(runSubcommand());
+function waitSync(milliseconds) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+function awaitSyncHookOutcome(hookEventName) {
+  const anchor = transcriptAnchor(
+    hookEventName === "Stop" ? { ...input, last_assistant_message: closingAssistantText() } : input
+  );
+  const transcriptPath = input.transcript_path;
+  if (!anchor || !transcriptPath) return "unrecorded" /* Unrecorded */;
+  const deadline = Date.now() + REWAKE_OUTCOME_WAIT_MS;
+  for (; ; ) {
+    const transcriptTail = readFileTail(transcriptPath, REWAKE_TRANSCRIPT_TAIL_BYTES) ?? "";
+    const outcome = findSyncHookOutcome(transcriptTail, hookEventName, anchor);
+    if (outcome !== "unrecorded" /* Unrecorded */ || Date.now() >= deadline) return outcome;
+    waitSync(REWAKE_OUTCOME_POLL_MS);
+  }
+}
+function rewake() {
+  const hookEventName = input.hook_event_name ?? "";
+  const outcome = awaitSyncHookOutcome(hookEventName);
+  const savedOutput = takeSyncHookOutput(sessionId, hookEventName, payloadDigest(rawPayload));
+  if (outcome === "delivered" /* Delivered */) return "";
+  return rewakeMessage(hookEventName, savedOutput ? savedOutput.hookOutput : runFiringGates());
+}
+function saveSyncHookOutput(hookOutput) {
+  const hookEventName = input.hook_event_name ?? "";
+  if (!REWAKE_HOOK_EVENTS.includes(hookEventName)) return;
+  try {
+    writeSyncHookOutput(sessionId, hookEventName, { payloadDigest: payloadDigest(rawPayload), hookOutput });
+  } catch {
+  }
+}
+if (sub === REWAKE_SUBCOMMAND) {
+  const rewakeText = rewake();
+  if (rewakeText) {
+    process.stderr.write(rewakeText);
+    process.exitCode = 2;
+  }
+} else {
+  const runSubcommand = isBackgroundJob(sub) ? backgroundJobs[sub] : handlers[sub] ?? (() => "{}");
+  const hookOutput = runSubcommand();
+  if (!isBackgroundJob(sub)) saveSyncHookOutput(hookOutput);
+  process.stdout.write(hookOutput);
+}