@orchestrator-claude/definitions 3.37.0 → 3.37.2

package/hooks/subagent-stop.mjs

@@ -7322,34 +7322,64 @@ var require_dist = __commonJS({
 
 // hooks/lib/api-client.ts
 import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
-import { join as join2, dirname as dirname2 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
 
 // ../project-root-resolver/dist/index.js
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
+function hasProjectRootMarker(candidate, sentinel) {
+  return existsSync(join(candidate, ".git")) || existsSync(join(candidate, "package.json")) || existsSync(join(candidate, sentinel, ".root"));
+}
 function resolveProjectRoot(cwd, sentinel = ".orchestrator") {
+  const candidates = [];
   let currentDir = cwd;
   for (; ; ) {
     if (existsSync(join(currentDir, sentinel))) {
-      return currentDir;
+      candidates.push(currentDir);
     }
     const parentDir = dirname(currentDir);
     if (parentDir === currentDir) {
-      return null;
+      break;
     }
     currentDir = parentDir;
   }
+  const [innermost] = candidates;
+  if (innermost === void 0) {
+    return null;
+  }
+  for (const candidate of candidates) {
+    if (hasProjectRootMarker(candidate, sentinel)) {
+      return candidate;
+    }
+  }
+  return innermost;
 }
 
 // hooks/lib/api-client.ts
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname2(__filename);
-var PROJECT_ROOT = join2(__dirname, "..", "..", "..");
-var STATE_DIR = join2(PROJECT_ROOT, ".orchestrator", ".state");
+function resolveFallbackStateDir(cwd) {
+  const cwdHash = createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  return join2(tmpdir(), "orchestrator-hook-fallback", cwdHash);
+}
+var PROJECT_ROOT = (() => {
+  const resolved = resolveHookProjectRoot(process.cwd());
+  if (resolved !== null && hasProjectRootMarker(resolved, ".orchestrator")) {
+    return resolved;
+  }
+  return null;
+})();
+var STATE_DIR_OVERRIDE = process.env.ORCHESTRATOR_STATE_DIR;
+var STATE_DIR = STATE_DIR_OVERRIDE !== void 0 && STATE_DIR_OVERRIDE !== "" ? STATE_DIR_OVERRIDE : PROJECT_ROOT !== null ? join2(PROJECT_ROOT, ".orchestrator", ".state") : resolveFallbackStateDir(process.cwd());
 var JWT_CACHE = join2(STATE_DIR, "jwt-token");
 var DEBUG_LOG = join2(STATE_DIR, "hook-debug.log");
 mkdirSync(STATE_DIR, { recursive: true });
+if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT === null) {
+  log(
+    "API-CLIENT",
+    `PROJECT_ROOT: no marker-verified ".orchestrator" project root found above ${process.cwd()} \u2014 falling back to isolated state dir ${STATE_DIR} (RF-003)`
+  );
+}
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
 var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
 var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
@@ -7393,6 +7423,10 @@ async function ensureProjectIdResolved(token) {
     );
   }
 }
+function normalizeAgentName(subagentType) {
+  const i = subagentType.lastIndexOf(":");
+  return i === -1 ? subagentType : subagentType.slice(i + 1);
+}
 function log(prefix, msg) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
   try {
@@ -7597,13 +7631,12 @@ function getField(obj, path) {
 }
 
 // hooks/lib/git-checkpoint.ts
-import { execSync } from "node:child_process";
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join3, dirname as dirname3 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = dirname3(__filename2);
-var PROJECT_ROOT2 = join3(__dirname2, "..", "..", "..");
+import { join as join3, dirname as dirname2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = dirname2(__filename);
+var PROJECT_ROOT2 = join3(__dirname, "..", "..", "..");
 var STATE_DIR2 = join3(PROJECT_ROOT2, ".orchestrator", ".state");
 var LAST_PHASE_FILE = join3(STATE_DIR2, "last-checkpointed-phase");
 var PHASE_ORDER = ["research", "specify", "plan", "tasks", "implement", "validate"];
@@ -7612,14 +7645,11 @@ function getCompletedPhase(currentPhase) {
   const idx = PHASE_ORDER.indexOf(lower);
   return idx > 0 ? PHASE_ORDER[idx - 1] ?? null : null;
 }
-function exec(cmd) {
-  return execSync(cmd, { cwd: PROJECT_ROOT2, encoding: "utf-8" }).trim();
-}
 async function createCheckpointIfNeeded(workflowId, currentPhase) {
   const completedPhase = getCompletedPhase(currentPhase);
   if (!completedPhase) {
     log("CHECKPOINT", `No completed phase from: ${currentPhase}`);
-    return null;
+    return false;
   }
   let lastPhase = "";
   try {
@@ -7628,31 +7658,16 @@ async function createCheckpointIfNeeded(workflowId, currentPhase) {
   }
   if (lastPhase === completedPhase) {
     log("CHECKPOINT", `Already checkpointed: ${completedPhase}`);
-    return null;
+    return false;
   }
   try {
-    exec("git add -A");
-    try {
-      exec("git diff --cached --quiet");
-      log("CHECKPOINT", `No changes for phase: ${completedPhase}`);
-      writeFileSync2(LAST_PHASE_FILE, completedPhase);
-      return null;
-    } catch {
-    }
-    const commitMsg = `[orchestrator] ${completedPhase}: Auto-checkpoint after ${completedPhase} phase`;
-    exec(`git commit -m "${commitMsg}" --no-verify`);
-    const commitHash = exec("git rev-parse HEAD");
-    log("CHECKPOINT", `Created: phase=${completedPhase} commit=${commitHash}`);
-    await registerCheckpoint(
-      workflowId,
-      `Auto-checkpoint after ${completedPhase} phase`,
-      commitHash
-    );
+    log("CHECKPOINT", `Registering checkpoint for phase: ${completedPhase}`);
+    await registerCheckpoint(workflowId, `Auto-checkpoint after ${completedPhase} phase`, "");
     writeFileSync2(LAST_PHASE_FILE, completedPhase);
-    return commitHash;
+    return true;
   } catch (err) {
     log("CHECKPOINT", `Error: ${err}`);
-    return null;
+    return false;
   }
 }
 
@@ -7664,7 +7679,7 @@ var MAX_ENTRIES = 50;
 var MAX_SUMMARY_LENGTH = 200;
 function appendObservation(memoryDir, agent, entry) {
   try {
-    const agentDir = join4(memoryDir, agent);
+    const agentDir = join4(memoryDir, normalizeAgentName(agent));
     const filePath = join4(agentDir, "observations.yaml");
     if (!existsSync2(agentDir)) {
       mkdirSync2(agentDir, { recursive: true });
@@ -7708,68 +7723,93 @@ function appendObservation(memoryDir, agent, entry) {
 
 // hooks/subagent-stop.ts
 var HOOK = "SUBAGENT-STOP";
-async function main() {
-  const stdin = await readStdin();
-  log(HOOK, "SubagentStop triggered");
-  const agentType = getField(stdin, "agent_type") || getField(stdin, "tool_input.subagent_type") || "unknown";
-  const workflow = await getActiveWorkflow();
+var defaultDeps = {
+  readStdin,
+  log,
+  getActiveWorkflow,
+  readInvocationState,
+  isInvocationStateStale,
+  consumeInvocationState,
+  completeAgentInvocation,
+  createCheckpointIfNeeded,
+  resolveAgentMemoryBaseDir,
+  appendObservation
+};
+async function mainWithDeps(deps) {
+  const stdin = await deps.readStdin();
+  deps.log(HOOK, "SubagentStop triggered");
+  const rawAgentType = getField(stdin, "agent_type") || getField(stdin, "tool_input.subagent_type") || "unknown";
+  const agentType = normalizeAgentName(rawAgentType);
+  if (agentType === "unknown") {
+    deps.log(
+      HOOK,
+      `[ERROR] could not resolve agent identity from stdin (checked agent_type, tool_input.subagent_type \u2014 both empty; raw payload=${JSON.stringify(stdin)})`
+    );
+  }
+  const workflow = await deps.getActiveWorkflow();
   if (!workflow) {
-    log(HOOK, "No active workflow, skipping");
+    deps.log(HOOK, "No active workflow, skipping");
     return;
   }
-  log(HOOK, `agent=${agentType} workflow=${workflow.id} phase=${workflow.currentPhase}`);
-  const invocationState = readInvocationState(workflow.id, agentType);
+  deps.log(HOOK, `agent=${agentType} workflow=${workflow.id} phase=${workflow.currentPhase}`);
+  const invocationState = deps.readInvocationState(workflow.id, agentType);
   if (invocationState) {
-    log(
+    deps.log(
       HOOK,
       `COMPLETE safety-net: found state file for agent=${agentType} invocationId=${invocationState.invocationId}`
     );
-    if (isInvocationStateStale(invocationState)) {
-      log(
+    if (deps.isInvocationStateStale(invocationState)) {
+      deps.log(
         HOOK,
         `COMPLETE safety-net: state file is stale (>4h) for invocationId=${invocationState.invocationId} \u2014 deleting without completing`
       );
-      consumeInvocationState(workflow.id, agentType);
+      deps.consumeInvocationState(workflow.id, agentType);
     } else {
-      const completed = await completeAgentInvocation(
+      const completed = await deps.completeAgentInvocation(
         invocationState.invocationId,
         "completed",
         `Safety-net completion: agent ${agentType} finished phase ${workflow.currentPhase}`
       );
       if (completed) {
-        consumeInvocationState(workflow.id, agentType);
-        log(
+        deps.consumeInvocationState(workflow.id, agentType);
+        deps.log(
           HOOK,
           `COMPLETE safety-net: invocationId=${invocationState.invocationId} marked complete, state file deleted`
         );
       } else {
-        log(
+        deps.log(
           HOOK,
           `COMPLETE safety-net: POST failed for invocationId=${invocationState.invocationId} (fail-open, continuing)`
         );
       }
     }
   } else {
-    log(
+    deps.log(
       HOOK,
       `COMPLETE: agent=${agentType} \u2014 no state file (agent self-reported via MCP or start hook skipped)`
     );
   }
-  const commitHash = await createCheckpointIfNeeded(workflow.id, workflow.currentPhase);
+  const checkpointed = await deps.createCheckpointIfNeeded(workflow.id, workflow.currentPhase);
   try {
     const sessionId = getField(stdin, "session_id") || getField(stdin, "claude_session_id") || "";
-    const memoryBaseDir = resolveAgentMemoryBaseDir(process.cwd());
-    appendObservation(memoryBaseDir, agentType, {
+    const memoryBaseDir = deps.resolveAgentMemoryBaseDir(process.cwd());
+    deps.appendObservation(memoryBaseDir, agentType, {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       session_id: sessionId,
       phase: workflow.currentPhase,
       workflow_id: workflow.id,
-      summary: `Agent ${agentType} completed phase ${workflow.currentPhase}${commitHash ? ` (checkpoint: ${commitHash})` : ""}`,
+      summary: `Agent ${agentType} completed phase ${workflow.currentPhase}${checkpointed ? " (checkpoint registered)" : ""}`,
       tags: [`agent:${agentType}`, `phase:${workflow.currentPhase}`]
     });
-    log(HOOK, `Observation written for agent=${agentType}`);
+    deps.log(HOOK, `Observation written for agent=${agentType}`);
   } catch {
-    log(HOOK, "Failed to write observation (fail-open, continuing)");
+    deps.log(HOOK, "Failed to write observation (fail-open, continuing)");
   }
 }
+async function main() {
+  await mainWithDeps(defaultDeps);
+}
 main().catch(() => process.exit(0));
+export {
+  mainWithDeps
+};

package/hooks/subagent-stop.ts

@@ -6,6 +6,29 @@
  *   3. post-phase-checkpoint.sh
  *
  * Single handler, single auth, sequential logic.
+ *
+ * TD-214/TD-239 TASK-006 (RF-008, identity point #4 of the consolidator —
+ * see packages/definitions/tests/IdentityNormalizationConsolidator.test.ts):
+ * `agentType` is now normalized via `normalizeAgentName` IMMEDIATELY after
+ * being read from stdin — mirroring TASK-004's fix to subagent-start.ts.
+ *
+ * Root cause (measured S435, project-guidelines/sessions/S435.md, "ENTREGA
+ * 3"): subagent-start.ts (TASK-004, subagent-start.ts:276) writes the
+ * per-key invocation-state file using the NORMALIZED bare agent name
+ * (`writeInvocationState(workflowId, normalizeAgentName(...), ...)`). This
+ * file, before this task, was read back using the RAW un-normalized
+ * `agentType` — under plugin scope (`orchestrator:reviewer`),
+ * `buildInvocationStatePath` built a DIFFERENT file path than the one
+ * subagent-start.ts wrote to, so `readInvocationState` always missed,
+ * silently skipping the ENTIRE safety-net block below (no
+ * `completeAgentInvocation`, no `consumeInvocationState`). The mismatch was
+ * introduced by TASK-004 itself — before it, both sides extracted identity
+ * without normalizing and agreed (`git show 36a9179f~1`).
+ *
+ * Refactored to the `HookDeps`/`mainWithDeps` dependency-injection pattern
+ * (mirrors subagent-start.ts, agent-git-guard.ts) so this behavior — and
+ * its regression — is unit-testable; the file had zero test coverage
+ * before this task. See `.claude/hooks/__tests__/subagent-stop.test.ts`.
  */
 
 import {
@@ -18,68 +41,133 @@ import {
   completeAgentInvocation,
   isInvocationStateStale,
   resolveAgentMemoryBaseDir,
+  normalizeAgentName,
+  type InvocationStatePayload,
 } from './lib/api-client.js';
 import { createCheckpointIfNeeded } from './lib/git-checkpoint.js';
-import { appendObservation } from './lib/observations-helper.js';
+import { appendObservation, type ObservationEntry } from './lib/observations-helper.js';
 
 const HOOK = 'SUBAGENT-STOP';
 
-async function main(): Promise<void> {
-  const stdin = await readStdin();
-  log(HOOK, 'SubagentStop triggered');
+// ─────────────────────────────────────────────────────────────
+// Dependency injection (testability — see subagent-start.ts precedent)
+// ─────────────────────────────────────────────────────────────
 
-  const agentType =
+export interface HookDeps {
+  readStdin: () => Promise<Record<string, unknown>>;
+  log: (prefix: string, msg: string) => void;
+  getActiveWorkflow: () => Promise<{ id: string; currentPhase: string } | null>;
+  readInvocationState: (workflowId: string, agentType: string) => InvocationStatePayload | null;
+  isInvocationStateStale: (payload: InvocationStatePayload) => boolean;
+  consumeInvocationState: (workflowId: string, agentType: string) => boolean;
+  completeAgentInvocation: (
+    invocationId: string,
+    status: string,
+    summary?: string
+  ) => Promise<boolean>;
+  createCheckpointIfNeeded: (workflowId: string, currentPhase: string) => Promise<boolean>;
+  resolveAgentMemoryBaseDir: (cwd: string) => string;
+  appendObservation: (
+    memoryDir: string,
+    agent: string,
+    entry: Omit<ObservationEntry, 'promoted'>
+  ) => void;
+}
+
+const defaultDeps: HookDeps = {
+  readStdin,
+  log,
+  getActiveWorkflow,
+  readInvocationState,
+  isInvocationStateStale,
+  consumeInvocationState,
+  completeAgentInvocation,
+  createCheckpointIfNeeded,
+  resolveAgentMemoryBaseDir,
+  appendObservation,
+};
+
+// ─────────────────────────────────────────────────────────────
+// Core logic (exported for testing)
+// ─────────────────────────────────────────────────────────────
+
+export async function mainWithDeps(deps: HookDeps): Promise<void> {
+  const stdin = await deps.readStdin();
+  deps.log(HOOK, 'SubagentStop triggered');
+
+  // TD-214/TD-239 TASK-006: normalize IMMEDIATELY after read — see module
+  // doc for why (subagent-start.ts writes the state file keyed by the
+  // normalized bare name; reading it back with the raw namespaced value
+  // silently misses).
+  const rawAgentType =
     getField(stdin, 'agent_type') || getField(stdin, 'tool_input.subagent_type') || 'unknown';
+  const agentType = normalizeAgentName(rawAgentType);
+
+  if (agentType === 'unknown') {
+    // Elevated from implicit/untagged to explicit [ERROR] (entregável of
+    // this task) — this is a signal the upstream payload shape changed, not
+    // an everyday case (same rationale as subagent-start.ts's read-failure
+    // branch). Does NOT return early: checkpoint and the invocation
+    // safety-net below are keyed by workflow.id/currentPhase, not by
+    // identity (RNF-001), and MUST keep running even when identity fails to
+    // resolve.
+    deps.log(
+      HOOK,
+      `[ERROR] could not resolve agent identity from stdin (checked agent_type, ` +
+        `tool_input.subagent_type — both empty; raw payload=${JSON.stringify(stdin)})`
+    );
+  }
 
-  const workflow = await getActiveWorkflow();
+  const workflow = await deps.getActiveWorkflow();
   if (!workflow) {
-    log(HOOK, 'No active workflow, skipping');
+    deps.log(HOOK, 'No active workflow, skipping');
     return;
   }
 
-  log(HOOK, `agent=${agentType} workflow=${workflow.id} phase=${workflow.currentPhase}`);
+  deps.log(HOOK, `agent=${agentType} workflow=${workflow.id} phase=${workflow.currentPhase}`);
 
   // 1. Invocation tracking safety net — complete via state file if agent did not self-report via MCP
-  const invocationState = readInvocationState(workflow.id, agentType);
+  const invocationState = deps.readInvocationState(workflow.id, agentType);
   if (invocationState) {
-    log(
+    deps.log(
       HOOK,
       `COMPLETE safety-net: found state file for agent=${agentType} invocationId=${invocationState.invocationId}`
     );
-    if (isInvocationStateStale(invocationState)) {
-      log(
+    if (deps.isInvocationStateStale(invocationState)) {
+      deps.log(
         HOOK,
         `COMPLETE safety-net: state file is stale (>4h) for invocationId=${invocationState.invocationId} — deleting without completing`
       );
-      consumeInvocationState(workflow.id, agentType);
+      deps.consumeInvocationState(workflow.id, agentType);
     } else {
-      const completed = await completeAgentInvocation(
+      const completed = await deps.completeAgentInvocation(
         invocationState.invocationId,
         'completed',
         `Safety-net completion: agent ${agentType} finished phase ${workflow.currentPhase}`
       );
       if (completed) {
-        consumeInvocationState(workflow.id, agentType);
-        log(
+        deps.consumeInvocationState(workflow.id, agentType);
+        deps.log(
           HOOK,
           `COMPLETE safety-net: invocationId=${invocationState.invocationId} marked complete, state file deleted`
         );
       } else {
-        log(
+        deps.log(
           HOOK,
           `COMPLETE safety-net: POST failed for invocationId=${invocationState.invocationId} (fail-open, continuing)`
         );
       }
     }
   } else {
-    log(
+    deps.log(
       HOOK,
       `COMPLETE: agent=${agentType} — no state file (agent self-reported via MCP or start hook skipped)`
     );
   }
 
-  // 2. Git checkpoint if phase changed
-  const commitHash = await createCheckpointIfNeeded(workflow.id, workflow.currentPhase);
+  // 2. Checkpoint registration if phase changed (TD-257: no longer a git
+  // operation — see git-checkpoint.ts module doc for why).
+  const checkpointed = await deps.createCheckpointIfNeeded(workflow.id, workflow.currentPhase);
 
   // 3. NO context emission on SubagentStop — see below.
   //
@@ -103,32 +191,40 @@ async function main(): Promise<void> {
   // Do NOT reintroduce an additionalContext emission here. Any payload on this event
   // re-prompts the sub-agent — the defect is the emission itself, not its wording.
   // The orchestrator already receives the sub-agent's result directly and owns the gate
-  // check unconditionally (orchestrator Skin, MUST #2). The RFC-034 post-implement signal
+  // check unconditionally (orchestrator identity, MUST #2 guarantee + #3 instrument — renumbered S478). The RFC-034 post-implement signal
   // is unaffected: it lives in post-implement.ts on PostToolUse[advancePhase], which fires
   // in the MAIN conversation's context, where additionalContext is the correct mechanism.
   //
-  // The side effects above (invocation-completion safety net, git checkpoint) and the
+  // The side effects above (invocation-completion safety net, checkpoint registration) and the
   // observation below are unaffected — they are writes, not context injection.
-  // (commitHash is still consumed by the observation payload below.)
+  // (checkpointed is still consumed by the observation payload below.)
 
   // 4. Write Tier B observation (fail-open)
   try {
     const sessionId = getField(stdin, 'session_id') || getField(stdin, 'claude_session_id') || '';
     // RFC-040 Operator Multi-Project — Slice 5 (C5): resolves under the
     // project root walked up from cwd (falls back to cwd when unregistered).
-    const memoryBaseDir = resolveAgentMemoryBaseDir(process.cwd());
-    appendObservation(memoryBaseDir, agentType, {
+    const memoryBaseDir = deps.resolveAgentMemoryBaseDir(process.cwd());
+    deps.appendObservation(memoryBaseDir, agentType, {
       timestamp: new Date().toISOString(),
       session_id: sessionId,
       phase: workflow.currentPhase,
       workflow_id: workflow.id,
-      summary: `Agent ${agentType} completed phase ${workflow.currentPhase}${commitHash ? ` (checkpoint: ${commitHash})` : ''}`,
+      summary: `Agent ${agentType} completed phase ${workflow.currentPhase}${checkpointed ? ' (checkpoint registered)' : ''}`,
       tags: [`agent:${agentType}`, `phase:${workflow.currentPhase}`],
     });
-    log(HOOK, `Observation written for agent=${agentType}`);
+    deps.log(HOOK, `Observation written for agent=${agentType}`);
   } catch {
-    log(HOOK, 'Failed to write observation (fail-open, continuing)');
+    deps.log(HOOK, 'Failed to write observation (fail-open, continuing)');
   }
 }
 
+// ─────────────────────────────────────────────────────────────
+// Entry point (production use)
+// ─────────────────────────────────────────────────────────────
+
+async function main(): Promise<void> {
+  await mainWithDeps(defaultDeps);
+}
+
 main().catch(() => process.exit(0));

package/hooks/user-prompt.mjs

@@ -2,34 +2,64 @@ import { createRequire as __createRequireShim } from 'node:module'; const requir
 
 // hooks/lib/api-client.ts
 import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
-import { join as join2, dirname as dirname2 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
 
 // ../project-root-resolver/dist/index.js
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
+function hasProjectRootMarker(candidate, sentinel) {
+  return existsSync(join(candidate, ".git")) || existsSync(join(candidate, "package.json")) || existsSync(join(candidate, sentinel, ".root"));
+}
 function resolveProjectRoot(cwd, sentinel = ".orchestrator") {
+  const candidates = [];
   let currentDir = cwd;
   for (; ; ) {
     if (existsSync(join(currentDir, sentinel))) {
-      return currentDir;
+      candidates.push(currentDir);
     }
     const parentDir = dirname(currentDir);
     if (parentDir === currentDir) {
-      return null;
+      break;
     }
     currentDir = parentDir;
   }
+  const [innermost] = candidates;
+  if (innermost === void 0) {
+    return null;
+  }
+  for (const candidate of candidates) {
+    if (hasProjectRootMarker(candidate, sentinel)) {
+      return candidate;
+    }
+  }
+  return innermost;
 }
 
 // hooks/lib/api-client.ts
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname2(__filename);
-var PROJECT_ROOT = join2(__dirname, "..", "..", "..");
-var STATE_DIR = join2(PROJECT_ROOT, ".orchestrator", ".state");
+function resolveFallbackStateDir(cwd) {
+  const cwdHash = createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  return join2(tmpdir(), "orchestrator-hook-fallback", cwdHash);
+}
+var PROJECT_ROOT = (() => {
+  const resolved = resolveHookProjectRoot(process.cwd());
+  if (resolved !== null && hasProjectRootMarker(resolved, ".orchestrator")) {
+    return resolved;
+  }
+  return null;
+})();
+var STATE_DIR_OVERRIDE = process.env.ORCHESTRATOR_STATE_DIR;
+var STATE_DIR = STATE_DIR_OVERRIDE !== void 0 && STATE_DIR_OVERRIDE !== "" ? STATE_DIR_OVERRIDE : PROJECT_ROOT !== null ? join2(PROJECT_ROOT, ".orchestrator", ".state") : resolveFallbackStateDir(process.cwd());
 var JWT_CACHE = join2(STATE_DIR, "jwt-token");
 var DEBUG_LOG = join2(STATE_DIR, "hook-debug.log");
 mkdirSync(STATE_DIR, { recursive: true });
+if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT === null) {
+  log(
+    "API-CLIENT",
+    `PROJECT_ROOT: no marker-verified ".orchestrator" project root found above ${process.cwd()} \u2014 falling back to isolated state dir ${STATE_DIR} (RF-003)`
+  );
+}
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
 var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
 var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
@@ -224,11 +254,11 @@ function outputContext(hookEvent, context) {
 
 // hooks/lib/sprint-context.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync2 } from "node:fs";
-import { join as join3, dirname as dirname3 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = dirname3(__filename2);
-var PROJECT_ROOT2 = join3(__dirname2, "..", "..", "..");
+import { join as join3, dirname as dirname2 } from "node:path";
+import { fileURLToPath } from "node:url";
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = dirname2(__filename);
+var PROJECT_ROOT2 = join3(__dirname, "..", "..", "..");
 var SPRINT_CONTEXT_DIR = join3(PROJECT_ROOT2, ".claude", "sprint-context");
 function contextPath(workflowId) {
   return join3(SPRINT_CONTEXT_DIR, `${workflowId}.json`);