@passioncode-ai/passioncode 0.2.42 → 0.2.44

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/references/session-hooks.md

@@ -20,7 +20,7 @@ need from Fabric. In Claude Code they live in the plugin's `hooks/hooks.json` an
 | Event | When it acts | What it does |
 |---|---|---|
 | SessionStart (`startup`, `clear`; the plugin's matcher, and the script ignores `compact` and `resume` for every host) | Claude Code has an MCP server named `fabric` (local, project or user scope) | Fabric running, in a project that uses Fabric (below): adds the preamble: `fabric_whoami` first; `com.status` and `com.list`, `com.read_ack` only what was read; `fabric_work_list`, then `fabric_work_claim`; `fabric_work_release` at the end; ask another Project only through `com.submit`. Fabric running in a folder with no such sign (a user-scope registration reaches every folder): one line pointing at `fabric_whoami`, which names the project when Fabric serves the folder anyway (FAA-60). Fabric down, in a project that uses Fabric: one line, skip `fabric_whoami` and the board, start Fabric through the lifecycle broker only if the task needs it. Fabric down anywhere else, or not registered: nothing. |
-| Stop (each turn) | as for SessionStart, and the running Fabric's `hub.json` lists `"session-hooks/1"` in `features` | measures the turn's facts (HEAD, files changed, lines added and removed: counts and ids only, git sharing 1.5 s), spools them in one entry and starts a detached worker that sends `fabric_session_observe {event: "turn", head, filesChanged, linesAdded, linesRemoved, …}` as stored, keeps the `nudges` its answer carries (Fabric 0.3.14: each `{kind, says, task_id?, request_id?}`, shown on a turn once, at most five; it stays for `fabric_work_list` and `fabric_heartbeat`, so it may come again there) in `nudges.json`, then reads `com.status` and keeps the unread count in the session's spool (`board.json`) |
+| Stop (each turn) | as for SessionStart, and the running Fabric's `hub.json` lists `"session-hooks/1"` in `features` | measures the turn's facts (HEAD, files changed, lines added and removed: counts and ids only, git sharing 1.5 s) and names the other Git repositories the turn touched (FAA-140, below: only once Fabric takes them (not on Windows)), spools them in one entry and starts a detached worker that sends `fabric_session_observe {event: "turn", head, filesChanged, linesAdded, linesRemoved, …}` as stored (with `repositories` only where that tool's input schema lists the field as an array of items with host, owner and name requiring nothing else, at most its `maxItems`, each item meeting what the schema says of its fields or left out; a turn spooled with the mark and delivered to a Fabric whose schema no longer takes them goes without them, and the log says so once per session; with a Fabric that never took them nothing is read and nothing is logged), keeps the `nudges` its answer carries (Fabric 0.3.14: each `{kind, says, task_id?, request_id?}`, shown on a turn once, at most five; it stays for `fabric_work_list` and `fabric_heartbeat`, so it may come again there) in `nudges.json`, then reads `com.status` and keeps the unread count in the session's spool (`board.json`) |
 | UserPromptSubmit | the session's spool holds a count or nudges | adds ONE line, `N unread on the project board: com.list`, only when the count rose since the last line (a fall or the same count says nothing), then each nudge's `says` once, as Fabric writes it (Fabric 0.3.14 starts each with `Fabric:`; any other line gets the tag `Fabric reminder: `), one line each, at most five lines of at most 400 characters; the nudges file is taken by renaming it away before they are printed (FAA-142). It reads, renames and writes small files in the session's folder and never calls Fabric. |
 | SessionEnd | as for Stop | spools the end; the worker sends `fabric_work_release {claims: "session", outcome: "let-go", …}` (with `observedAt`, the time the hook fired, where the tool's input schema names it: Fabric 0.3.9 then refuses an end from before the session enrolled), then `fabric_session_observe {event: "end", reason}`, and removes the session's spool. Reason `clear` ends nothing: `/clear` keeps the agent process and its fabric-mcp, so no claim is released and no end observed; turns already spooled still go out (since 0.42.0). Their nudges stay in the old id's folder and are not printed here; Fabric 0.3.14 only shows a nudge on a turn's answer and keeps it for `fabric_work_list` and `fabric_heartbeat`, so the new session gets it there (board `b605a636`; decision of 0.51.2, FAA-142) |
 
@@ -31,6 +31,29 @@ id, and keeps the retry only while the end is the newest entry. When `fabric-mcp
 no session holds the id), the worker drops the spool, writes a `no-session` mark in the session's folder and logs it
 once; for 15 minutes the hooks spool nothing for that id (an end removes the folder), then one rejoin tries again.
 
+**The other repositories a turn touched** (FAA-140, Fabric CO-367). Never on Windows (FAA-175: a Bash command's
+paths there are not the host's). Elsewhere, only after a worker has seen the running Fabric's
+`fabric_session_observe` declare `repositories` as an array of items with `host`, `owner` and `name` that require
+nothing else does the Stop hook read the
+session's transcript at all: the worker then leaves `observe-takes-repositories` in the hooks' folder (beside
+`hooks.log`) and removes it when the schema stops saying so (after a Fabric downgrade, the turns that end before a worker next
+runs, about a minute, are still read; none of their names is sent); without it nothing below happens. With it, the hook reads the last 512 KB of the
+transcript (the payload's `transcript_path`; earlier turns included) and uses only the entries after the last prompt
+the person typed. Those lines hold message text and tool output too (file contents, command output: a secret the session displayed can be there; it stays in memory and is never spooled, logged or sent); of each entry it uses only a tool call's
+name and path argument: the `file_path` of Edit, Write and MultiEdit, the `notebook_path` of NotebookEdit, and in a
+Bash command `cd <absolute path>` and `git -C <path>` (absolute, or relative to the session's folder), split only in
+commands that hold `cd` or `git`, at most 64 KB of command text a turn. These are the repositories the turn
+*touched*: a `cd` or a read-only `git -C <path> log` names one as much as an edit does. A subagent's entries are not
+read, so a repository only a subagent touched is not named. Each
+path is resolved with one `git rev-parse --show-toplevel` and its repository's `origin` with one `git config --get
+remote.origin.url`, every call inside the same 1.5 s as the turn's facts (the facts first); a path outside every
+checkout costs no git call, and when the budget runs out the hook spools what it found. Each repository is named
+`{host, owner, name}` from its `origin` (https, `ssh://`, `git@host:owner/name`; credentials, a port and `.git`
+dropped; a nested group stays in `owner`, and on a self-hosted ssh remote `owner` is the folder path on that server
+before the repository's name, which may hold a user name). The repository of the session's folder when the turn ends (the Stop payload's `cwd`; any checkout of it: a worktree, a clone), a repository whose `origin`
+is missing or does not parse, and a second checkout of one repository are not named; at most 10. No local path leaves the hook; a
+missing or unreadable transcript names none and is no error.
+
 **A project that uses Fabric** (`project_uses_fabric`), cheapest sign first: `fabric` registered at local or project
 scope for the folder (user scope is every folder's, so it says nothing about this one); a `fabric-agent.json`,
 `fabric-contract.lock.json` or `fabric.package.json` file from the folder up to its checkout's root (the folder alone
@@ -104,14 +127,19 @@ only variable names are looked at, never a value (two of them carry the session'
 ## What they never do
 
 - **Block or slow the session.** Each hook has a 5 s ceiling in `hooks.json`; the script reads a few small files and
-  returns in tens of milliseconds, plus the turn's git facts in Stop and SessionEnd (at most 1.5 s, shared by every
-  git call). Every call to Fabric happens in a detached worker with a 10 s deadline; at its end the worker closes
+  returns in tens of milliseconds, plus the turn's git facts in Stop and SessionEnd and, in Stop once Fabric takes them (not on Windows), the transcript's
+  tail and the other repositories' names (the git calls share at most 1.5 s; the tail read is at most 512 KB). Every call to Fabric happens in a detached worker with a 10 s deadline; at its end the worker closes
   `fabric-mcp`'s stdin and then ends its whole process group, so a wrapper (`npx`, a shell script,
   `fabric-mcp.cmd`) cannot keep it waiting. Every hook exits 0, on every path.
-- **Read a secret.** The hooks never open Fabric's door token or an enrollment credential; `fabric-mcp` holds
-  those. Nothing secret is in argv (the worker's argv is the script and a spool folder) or in the log.
-- **Send or read content.** A turn is the HEAD commit, the number of files that differ from it (untracked included)
-  and the lines added and removed against it; no path, branch name, commit message or diff text. The board is read
+- **Keep a secret.** The hooks never open Fabric's door token or an enrollment credential; `fabric-mcp` holds
+  those. Nothing secret is in argv (the worker's argv is the script and a spool folder) or in the log. Once Fabric
+  takes repositories (not on Windows), an `origin` URL that embeds a credential (`https://user:token@host/...`) is read by
+  `git config` with it; the Stop hook drops the credential in memory before anything is spooled, logged or sent.
+- **Send content, or use more than it reads for.** A turn is the HEAD commit, the number of files that differ from it
+  (untracked included) and the lines added and removed against it, and, once Fabric takes them (not on Windows), the other repositories
+  it touched by their `origin` name (`{host, owner, name}`); no path, branch name, commit message or diff text. The
+  transcript's tail is read, message text and tool output with it, and only tool names and path arguments are used; a sent turn's log
+  line counts its repositories, never names them. The board is read
   as a count (`com.status`), never a message. Git runs with `--no-optional-locks`.
 - **Start a second Fabric session.** A `fabric-mcp` started on its own would enroll a new session, and Fabric ends a
   binding's oldest live session past eight (ADR-0134 amendment 2): the agent's own. The worker and `watch-mail` run
@@ -129,7 +157,8 @@ only variable names are looked at, never a value (two of them carry the session'
 One line per event that did something, never content: `~/Library/Caches/ai.passioncode.fabric-agent-adapter/hooks.log`
 (macOS), `$XDG_CACHE_HOME/fabric-agent-adapter/hooks.log` (Linux, default `~/.cache`),
 `%LOCALAPPDATA%\fabric-agent-adapter\hooks.log` (Windows). Mode 0600, rotated at 1 MB to `hooks.log.1`. The
-per-session spool is `sessions/<session id>/` beside it (turn entries capped at 50, `board.json`, `board.shown`, and the nudges not yet printed: `nudges.json` for the prompt
+per-session spool is `sessions/<session id>/` beside it (turn entries capped at 50, each holding the session's folder when
+the turn ended (the Stop payload's `cwd`) and, when the turn touched another repository (only once Fabric takes them (not on Windows)), `repositories` as `{host, owner, name}`; `board.json`, `board.shown`, `repositories.degraded` (the once-a-session note that repositories were left out: the schema no longer takes them, or refused every item), and the nudges not yet printed: `nudges.json` for the prompt
 hook, `nudges.watch.json` for `watch-mail`, each taken by renaming it away; a
 folder untouched for 7 days, whose worker failed or whose session ended without SessionEnd, is removed by the next
 Stop or SessionEnd hook, even while the hooks are inert; an end entry whose release or observation got no answer stays
@@ -151,6 +180,6 @@ launched-session check exact.
 | D1 | `fabric-mcp` enrolls with the runtime session id | for `--runner claude-code`, `runtimeSessionId` = env `CLAUDE_CODE_SESSION_ID` in `fabric.session.enroll {cwd, runtimeSessionId}` (Claude Code 2.1.296 gives MCP stdio servers and Bash commands that variable, equal to the hooks' `session_id`) |
 | D2 | rejoin only | `fabric-mcp --runner claude-code --rejoin-only --runtime-session-id <id>` attaches to that runtime session's live enrolled session; never asks, never mints; otherwise only `fabric_whoami`, as not enrolled; Fabric 0.3.9 exits 3 at once when no session holds the id |
 | D3 | the flag | `hub.json` `"features": ["session-hooks/1"]` once D1, D2, D4 and D5 ship |
-| D4 | `fabric_session_observe` | `{event: "turn" or "end", runtime: "claude-code", runtimeSessionId, observedAt, head, filesChanged, linesAdded, linesRemoved, reason (end only), idempotencyKey}` → `session.turn.observed@1`, `session.ended@1`; from Fabric 0.3.14 a turn's answer is `{recorded, seq, nudges?}`, each nudge `{kind, says, task_id?, request_id?}` shown on a turn once, at most five, the same on a repeated turn, and kept for `fabric_work_list` and `fabric_heartbeat` (FAA-142) |
+| D4 | `fabric_session_observe` | `{event: "turn" or "end", runtime: "claude-code", runtimeSessionId, observedAt, head, filesChanged, linesAdded, linesRemoved, reason (end only), repositories (turn only, optional), idempotencyKey}` → `session.turn.observed@1`, `session.ended@1`; `repositories` (FAA-140, proposed to Fabric on `a8bdda7a`, accepted on `d3f9e6fb`) is at most 10 `{host, owner, name}` and is sent only where the tool's input schema lists it with items carrying host, owner and name, so a Fabric without it gets the call it gets today; from Fabric 0.3.14 a turn's answer is `{recorded, seq, nudges?}`, each nudge `{kind, says, task_id?, request_id?}` shown on a turn once, at most five, the same on a repeated turn, and kept for `fabric_work_list` and `fabric_heartbeat` (FAA-142) |
 | D5 | release a whole session | `fabric_work_release {claims: "session", outcome: "let-go", reason, idempotencyKey}`; `observedAt` too where its input schema names it (Fabric 0.3.9: `stale-end` for an end observed before the session enrolled) |
 | D6 | a launched-session marker | `FABRIC_LAUNCHED_SESSION=1` in the environment of every session Fabric launches, whatever its adapter; until then, the inference above |

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session.py

@@ -76,6 +76,8 @@ from fabric_session_env import (  # noqa: F401
     spawn_worker,
     _remove_tree,
     NO_SESSION_MARK,
+    REPOSITORIES_MARK,
+    repositories_wanted,
     NO_SESSION_HOLD_S,
     no_session_held,
 )
@@ -100,6 +102,15 @@ from fabric_session_mcp import (  # noqa: F401
     _wait_for_session_tools,
     NO_SESSION_EXIT,
     NoSessionError,
+    TRANSCRIPT_TAIL_BYTES,
+    MAX_REPOSITORIES,
+    BASH_BYTES,
+    _takes_repositories,
+    parse_origin,
+    bash_paths,
+    turn_paths,
+    turn_repositories,
+    stored_repositories,
 )
 from fabric_session_mail import (  # noqa: F401
     WATCH_MIN_INTERVAL_S,

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session_cli.py

@@ -36,6 +36,7 @@ from fabric_session_env import (  # noqa: E402 - the kit (FAA-65)
     prune_stale_sessions,
     read_small,
     rejoined_recently,
+    repositories_wanted,
     session_dir,
     spawn_worker,
     spool,
@@ -44,6 +45,7 @@ from fabric_session_mcp import (  # noqa: E402 - the kit (FAA-65)
     FACTS_BUDGET_S,
     deliver,
     git_facts,
+    turn_repositories,
 )
 from fabric_session_mail import (  # noqa: E402 - the kit (FAA-65)
     watch_mail_cli,
@@ -164,7 +166,8 @@ def hook_user_prompt_submit(payload: Dict[str, Any], env: Optional[Dict[str, str
 
 
 def hook_spool(payload: Dict[str, Any], event: str, env: Optional[Dict[str, str]] = None, spawn=spawn_worker) -> str:
-    """Stop (`turn`) and SessionEnd (`end`): spool one entry, with the turn's facts measured now, and start the worker.
+    """Stop (`turn`) and SessionEnd (`end`): spool one entry, with the turn's facts measured now (and a turn's other
+    repositories, FAA-140), and start the worker.
     Returns what happened, for the tests. Nothing is spooled and no worker runs unless the running Fabric advertises
     `session-hooks/1` and `fabric` is registered: hub.json is read first because it is the cheap check that fails for
     every Fabric before the one that ships the hooks' dependency (`status` says so: "Session hooks: inert"). Stale
@@ -213,10 +216,16 @@ def hook_spool(payload: Dict[str, Any], event: str, env: Optional[Dict[str, str]
                 directory.mkdir(parents=True, exist_ok=True, mode=0o700)
                 _write_private(directory / LAUNCHED_MARK, "")
             return "skipped: launched by Fabric"
-    # The turn's own facts, measured when it ended (counts and ids only, never a path), not when a worker runs.
+    # The turn's own facts, measured when it ended (counts and ids only, never a path), not when a worker runs. The
+    # other repositories the turn changed (FAA-140) share the same budget: git_facts first, then what time is left.
+    until = time.monotonic() + FACTS_BUDGET_S
     entry = {"event": event, "runtimeSessionId": session_id, "cwd": str(cwd),
              "observedAt": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
-             "facts": git_facts(cwd, budget_s=FACTS_BUDGET_S)}
+             "facts": git_facts(cwd, until=until)}
+    if event == "turn" and repositories_wanted(env):  # only once Fabric takes them: no transcript read before (FAA-140)
+        repositories = turn_repositories(payload.get("transcript_path"), cwd, until)
+        if repositories:
+            entry["repositories"] = repositories
     if event == "end" and isinstance(payload.get("reason"), str):
         entry["reason"] = payload["reason"][:64]
     spool(directory, entry)

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session_env.py

@@ -58,7 +58,7 @@ SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 
 
-VERSION = "0.52.0"
+VERSION = "0.54.0"
 
 
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",
@@ -476,6 +476,10 @@ LAUNCHED_MARK = "launched"
 #: (Fabric 0.3.9, TR-11). For NO_SESSION_HOLD_S the hooks spool nothing for that id; after it, one rejoin tries again,
 #: so a Fabric that restarted and enrolled the id again is found (board thread 02bf19c5, ask 4).
 NO_SESSION_MARK = "no-session"
+#: The file in the hooks' own folder (state_root) that says the running Fabric's fabric_session_observe takes
+#: `repositories` as {host, owner, name}: a worker writes it from the tool's schema and removes it when the schema stops
+#: saying so. Until it exists the Stop hook reads no transcript (FAA-140, seam and product readings 1).
+REPOSITORIES_MARK = "observe-takes-repositories"
 NO_SESSION_HOLD_S = 15 * 60.0
 
 
@@ -527,6 +531,12 @@ def _write_private(path: Path, text: str) -> None:
     os.replace(str(tmp), str(path))
 
 
+def repositories_wanted(env: Optional[Dict[str, str]] = None) -> bool:
+    """Whether the Stop hook reads the transcript for the turn's other repositories (FAA-140): only once a worker
+    left the mark, and never on Windows, where a Bash command's paths are not this host's (FAA-175)."""
+    return sys.platform != "win32" and (state_root(env=env) / REPOSITORIES_MARK).exists()
+
+
 def session_dir(session_id: str, env: Optional[Dict[str, str]] = None) -> Path:
     return state_root(env=env) / "sessions" / session_id
 

package/payload/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session_mcp.py

@@ -23,6 +23,7 @@ from fabric_session_env import (  # noqa: E402 - the kit (FAA-65)
     LOCK_STALE_S,
     NO_SESSION_MARK,
     NUDGES_FILE,
+    REPOSITORIES_MARK,
     SESSION_ID,
     VERSION,
     WORKER_DEADLINE_S,
@@ -60,23 +61,30 @@ FACT_KEYS = ("head", "filesChanged", "linesAdded", "linesRemoved")
 HEAD = re.compile(r"[0-9a-f]{40}|[0-9a-f]{64}")
 
 
-def git_facts(cwd: Path, budget_s: Optional[float] = None) -> Dict[str, Optional[int]]:
+def _git(cwd: Any, args: Tuple[str, ...], until: Optional[float]) -> Optional[str]:
+    """One git call in `cwd`, its stdout or None (failed, or not answered before `until`, a time.monotonic())."""
+    timeout = GIT_TIMEOUT_S if until is None else min(GIT_TIMEOUT_S, until - time.monotonic())
+    if timeout <= 0:
+        return None
+    try:
+        done = subprocess.run(["git", "--no-optional-locks", "-C", str(cwd)] + list(args),
+                              stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
+                              timeout=timeout, check=False)
+    except (OSError, subprocess.SubprocessError):
+        return None
+    return done.stdout.decode("utf-8", "replace") if done.returncode == 0 else None
+
+
+def git_facts(cwd: Path, budget_s: Optional[float] = None, until: Optional[float] = None) -> Dict[str, Optional[int]]:
     """HEAD, files that differ from it (untracked included) and lines added/removed. No path, no text. With
-    `budget_s`, every git call shares that total; a fact git could not give in time is None."""
+    `budget_s`, every git call shares that total; with `until` (a time.monotonic()), they share it with the caller's
+    other git calls (FAA-140). A fact git could not give in time is None."""
     facts: Dict[str, Any] = {"head": None, "filesChanged": None, "linesAdded": None, "linesRemoved": None}
-    until = None if budget_s is None else time.monotonic() + budget_s
+    if until is None and budget_s is not None:
+        until = time.monotonic() + budget_s
 
     def git(*args: str) -> Optional[str]:
-        timeout = GIT_TIMEOUT_S if until is None else min(GIT_TIMEOUT_S, until - time.monotonic())
-        if timeout <= 0:
-            return None
-        try:
-            done = subprocess.run(["git", "--no-optional-locks", "-C", str(cwd)] + list(args),
-                                  stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
-                                  timeout=timeout, check=False)
-        except (OSError, subprocess.SubprocessError):
-            return None
-        return done.stdout.decode("utf-8", "replace") if done.returncode == 0 else None
+        return _git(cwd, args, until)
 
     head = (git("rev-parse", "--verify", "-q", "HEAD") or "").strip()
     facts["head"] = head if HEAD.fullmatch(head) else None
@@ -108,6 +116,276 @@ def _count_status(z: str) -> int:
     return count
 
 
+#: FAA-140 (D2): the Stop hook reads at most this much of the transcript, from its end.
+TRANSCRIPT_TAIL_BYTES = 512 * 1024
+
+
+#: FAA-140 (seam reading 1): the Bash command text one turn may split, in characters; a long unterminated quote costs
+#: shlex its whole length, so this caps the Stop hook's time on it.
+BASH_BYTES = 65536
+
+
+#: FAA-140 (REQ-1): at most this many other repositories are named for one turn.
+MAX_REPOSITORIES = 10
+
+
+#: Distinct candidate paths one turn may offer; past it the rest of the turn is not looked at.
+MAX_CANDIDATES = 64
+
+
+#: The tools whose path argument is a file the turn changed, and the argument that names it.
+CHANGING_TOOLS = {"Edit": "file_path", "Write": "file_path", "MultiEdit": "file_path", "NotebookEdit": "notebook_path"}
+
+
+_HOST_NAME = re.compile(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*")
+_PATH_SEGMENT = re.compile(r"[A-Za-z0-9_][A-Za-z0-9._-]{0,99}|[.][A-Za-z0-9_][A-Za-z0-9._-]{0,98}")
+_URL = re.compile(r"(?i)(?:https?|ssh|git|git\+ssh|ssh\+git)://([^/]*)/(.*)")
+_SCP = re.compile(r"(?:[^@/:\s]+@)?([^@/:\s]+):(?!/)(.+)")
+
+
+def _repository(host: str, path: str) -> Optional[Dict[str, str]]:
+    """{host, owner, name} from a host and a remote path, or None when either is not a plain one."""
+    host = host.lower()
+    if len(host) > 253 or not _HOST_NAME.fullmatch(host):
+        return None
+    path = path.strip("/")
+    if path.lower().endswith(".git"):
+        path = path[:-4]
+    segments = path.split("/")
+    if len(segments) < 2 or not all(_PATH_SEGMENT.fullmatch(s) for s in segments):
+        return None
+    return {"host": host, "owner": "/".join(segments[:-1]), "name": segments[-1]}
+
+
+def parse_origin(url: str) -> Optional[Dict[str, str]]:
+    """A remote URL as {host, owner, name} (FAA-140, D1): https and http, `ssh://`, `git://` and the scp form
+    `git@host:owner/name.git`. Credentials, a port, `.git` and a trailing slash are dropped; a nested group stays in
+    `owner` (`group/sub`). None for a local path, a `file://` remote or anything that does not parse."""
+    url = (url or "").strip()
+    if not url or len(url) > 2048 or any(c.isspace() for c in url) or "\\" in url:
+        return None
+    match = _URL.fullmatch(url)
+    if match:
+        authority, path = match.groups()
+        host, _, port = authority.rpartition("@")[2].partition(":")
+        if port and not port.isdigit():
+            return None
+        return _repository(host, path)
+    match = _SCP.fullmatch(url)
+    if match and "://" not in url:
+        return _repository(*match.groups())
+    return None
+
+
+def bash_paths(command: str, cwd: Path) -> List[str]:
+    """The folders a Bash command names as `cd <absolute path>` or `git -C <path>` (absolute, or relative to `cwd`),
+    in order. Nothing else of the command is kept; a command that does not split is [] (FAA-140)."""
+    import shlex  # only a Stop hook with a transcript needs it
+    try:
+        lexer = shlex.shlex(command, posix=True, punctuation_chars=True)
+        lexer.whitespace_split = True
+        tokens = list(lexer)
+    except ValueError:
+        return []
+    found: List[str] = []
+    separators = set("();&|<>")
+    start = True  # a command word may stand here
+    index = 0
+    while index < len(tokens):
+        token = tokens[index]
+        if token and set(token) <= separators:
+            start, index = True, index + 1
+            continue
+        if start and token == "cd" and index + 1 < len(tokens) and os.path.isabs(tokens[index + 1]):
+            found.append(os.path.normpath(tokens[index + 1]))
+        elif start and os.path.basename(token) == "git":
+            look = index + 1
+            while look < len(tokens) and tokens[look].startswith("-") and not set(tokens[look]) <= separators:
+                if tokens[look] == "-C" and look + 1 < len(tokens) and not set(tokens[look + 1]) <= separators:
+                    found.append(os.path.normpath(os.path.join(str(cwd), tokens[look + 1])))
+                    look += 1
+                elif tokens[look] == "-c":
+                    look += 1
+                look += 1
+        start = False
+        index += 1
+    return found
+
+
+def _prompt(entry: Dict[str, Any]) -> bool:
+    """Whether a transcript entry is a prompt the person typed: a user entry that is no tool result, no meta entry
+    and no subagent's."""
+    if entry.get("type") != "user" or entry.get("isMeta") or entry.get("isSidechain") or "toolUseResult" in entry:
+        return False
+    message = entry.get("message")
+    content = message.get("content") if isinstance(message, dict) else None
+    if isinstance(content, str):
+        return True
+    return isinstance(content, list) and bool(content) and not any(
+        isinstance(block, dict) and block.get("type") == "tool_result" for block in content)
+
+
+def _transcript_tail(transcript: str) -> List[bytes]:
+    """The whole lines of the transcript's last TRANSCRIPT_TAIL_BYTES; [] when it is not a regular file."""
+    import stat
+    flags = os.O_RDONLY | getattr(os, "O_NONBLOCK", 0) | getattr(os, "O_BINARY", 0)
+    fd = os.open(transcript, flags)
+    try:
+        info = os.fstat(fd)
+        if not stat.S_ISREG(info.st_mode):
+            return []
+        offset = max(0, info.st_size - TRANSCRIPT_TAIL_BYTES)
+        os.lseek(fd, offset, os.SEEK_SET)
+        chunks, left = [], info.st_size - offset
+        while left > 0:
+            chunk = os.read(fd, min(left, 65536))
+            if not chunk:
+                break
+            chunks.append(chunk)
+            left -= len(chunk)
+    finally:
+        os.close(fd)
+    data = b"".join(chunks)
+    lines = data.split(b"\n")
+    return lines[1:] if offset > 0 else lines  # the first line of a tail is cut
+
+
+def turn_paths(transcript: Any, cwd: Path, until: Optional[float] = None) -> List[str]:
+    """The paths the current turn's tool calls name (FAA-140, D2): Edit, Write, MultiEdit and NotebookEdit's file, and
+    the folders of `cd` and `git -C` in Bash, in order, without repeats. Only the tail of the transcript is read, from
+    its end back to the last prompt the person typed; of an entry only a tool call's name and its path argument are
+    used, never a message's text. [] when the transcript is missing or unreadable. Bash commands are split only when
+    they hold `cd` or `git`, at most BASH_BYTES of them a turn, and none once `until` (a time.monotonic()) has passed."""
+    if not isinstance(transcript, str) or not transcript or "\0" in transcript:
+        return []
+    try:
+        lines = _transcript_tail(transcript)
+    except OSError:
+        return []
+    calls: List[Dict[str, Any]] = []
+    for raw in reversed(lines):
+        if not raw.strip():
+            continue
+        try:
+            entry = json.loads(raw.decode("utf-8"))
+        except ValueError:
+            continue
+        if not isinstance(entry, dict):
+            continue
+        if _prompt(entry):
+            break
+        message = entry.get("message")
+        content = message.get("content") if isinstance(message, dict) else None
+        if entry.get("type") != "assistant" or entry.get("isSidechain") or not isinstance(content, list):
+            continue
+        for block in reversed(content):
+            if isinstance(block, dict) and block.get("type") == "tool_use" and isinstance(block.get("input"), dict):
+                calls.append(block)
+    found: List[str] = []
+    left = BASH_BYTES
+    for block in reversed(calls):
+        if until is not None and time.monotonic() >= until:
+            break
+        arguments, name = block["input"], block.get("name")
+        if name in CHANGING_TOOLS:
+            value = arguments.get(CHANGING_TOOLS[name])
+            named = [os.path.normpath(os.path.join(str(cwd), value))] if isinstance(value, str) and value else []
+        elif name == "Bash" and isinstance(arguments.get("command"), str) and left > 0 \
+                and ("cd" in arguments["command"] or "git" in arguments["command"]):
+            command = arguments["command"][:left]
+            left -= len(command)
+            named = bash_paths(command, cwd)
+        else:
+            continue
+        for path in named:
+            if path not in found and "\0" not in path and len(path) <= 4096:
+                found.append(path)
+                if len(found) >= MAX_CANDIDATES:
+                    return found
+    return found
+
+
+def _existing_folder(path: str) -> Optional[str]:
+    """The path when it is a folder, else the nearest existing folder above it (a file's own folder)."""
+    current = path
+    while not os.path.isdir(current):
+        parent = os.path.dirname(current)
+        if parent == current:
+            return None
+        current = parent
+    return current
+
+
+def _nearest_checkout(folder: str) -> Optional[str]:
+    """The nearest folder at or above `folder` with a `.git` entry; None outside a checkout. No subprocess."""
+    current = folder
+    while True:
+        if os.path.lexists(os.path.join(current, ".git")):
+            return current
+        parent = os.path.dirname(current)
+        if parent == current:
+            return None
+        current = parent
+
+
+def turn_repositories(transcript: Any, cwd: Path, until: float) -> List[Dict[str, str]]:
+    """The other Git repositories the current turn changed, as {host, owner, name} (FAA-140, REQ-1): each path of
+    turn_paths resolved with one `git rev-parse --show-toplevel` and its repository's `origin` with one `git config`,
+    every call before `until` (the Stop hook's facts budget). The start folder's repository (any checkout of it), a
+    repository without an `origin` that parses, and a second checkout of one repository are not named; at most MAX_REPOSITORIES. A path
+    outside every checkout costs no git call. Never raises: what was found when the budget ran out is the answer."""
+    found: List[Dict[str, str]] = []
+    try:
+        paths = turn_paths(transcript, cwd, until)
+        if not paths or time.monotonic() >= until:
+            return found
+        start = (_git(cwd, ("rev-parse", "--show-toplevel"), until) or "").strip() or None
+        checkouts, tops, keys = set(), set(), set()
+        own = parse_origin(_git(start, ("config", "--get", "remote.origin.url"), until) or "") if start else None
+        if own:  # another checkout of the start folder's repository (a worktree, a clone) is that repository
+            keys.add(tuple(own[k].lower() for k in ("host", "owner", "name")))
+        for path in paths:
+            if len(found) >= MAX_REPOSITORIES or time.monotonic() >= until:
+                break
+            folder = _existing_folder(path)
+            checkout = _nearest_checkout(folder) if folder else None
+            if checkout is None or checkout in checkouts:
+                continue
+            checkouts.add(checkout)
+            if start and os.path.realpath(checkout) == start:
+                continue
+            top = (_git(folder, ("rev-parse", "--show-toplevel"), until) or "").strip()
+            if not top or top == start or top in tops:
+                continue
+            tops.add(top)
+            repository = parse_origin(_git(top, ("config", "--get", "remote.origin.url"), until) or "")
+            key = tuple(repository[k].lower() for k in ("host", "owner", "name")) if repository else None
+            if key and key not in keys:
+                keys.add(key)
+                found.append(repository)
+    except Exception:  # noqa: BLE001 - a turn without its repositories is still a turn
+        pass
+    return found
+
+
+def stored_repositories(entry: Dict[str, Any]) -> List[Dict[str, str]]:
+    """The repositories a spool entry carries, checked again at delivery: each exactly {host, owner, name} as
+    parse_origin makes them, at most MAX_REPOSITORIES; anything else is left out."""
+    value = entry.get("repositories") if isinstance(entry, dict) else None
+    out: List[Dict[str, str]] = []
+    for item in value if isinstance(value, list) else []:
+        if not isinstance(item, dict) or sorted(item) != ["host", "name", "owner"]:
+            continue
+        if not all(isinstance(item[k], str) for k in item):
+            continue
+        if _repository(item["host"], "%s/%s" % (item["owner"], item["name"])) != item:
+            continue
+        out.append(dict(item))
+        if len(out) >= MAX_REPOSITORIES:
+            break
+    return out
+
+
 def stored_facts(entry: Dict[str, Any]) -> Dict[str, Any]:
     """The facts a spool entry carries, as the hook measured them when its turn ended (FAA-68): a head of 40 or 64
     hex digits and non-negative counts, each else None. Nothing is measured at delivery."""
@@ -432,7 +710,8 @@ def deliver(directory: Path, env: Optional[Dict[str, str]] = None, deadline_s: f
             answer = _answer_said(result)
         except JsonRpcError as exc:
             answer = exc.said()
-        note("session=%s event=%s tool=%s answer=%s" % (session_id[:8], event, tool, answer))
+        counted = " repositories=%d" % len(arguments["repositories"]) if "repositories" in arguments else ""
+        note("session=%s event=%s tool=%s answer=%s%s" % (session_id[:8], event, tool, answer, counted))
         return result
 
     try:
@@ -457,6 +736,15 @@ def deliver(directory: Path, env: Optional[Dict[str, str]] = None, deadline_s: f
         client.notify("notifications/initialized")
         names = _wait_for_session_tools(client, deadline)
         _write_private(directory / "rejoined", "")
+        takes = _takes_repositories(client)
+        mark = directory.parent.parent / REPOSITORIES_MARK  # state_root: the Stop hook reads a transcript only with it
+        try:  # shared by every session's worker: a race with another one never ends this delivery
+            if takes and not mark.exists():
+                _write_private(mark, "")
+            elif not takes and mark.exists():
+                mark.unlink()
+        except OSError as exc:
+            note("session=%s outcome=degraded reason=%r" % (session_id[:8], "the repositories mark: %s" % type(exc).__name__))
         while entries:
             for path in entries:
                 entry = _read_entry(path)
@@ -484,6 +772,14 @@ def deliver(directory: Path, env: Optional[Dict[str, str]] = None, deadline_s: f
                                      observedAt=entry.get("observedAt"), idempotencyKey=key)
                     if event == "end":
                         arguments["reason"] = reason
+                    repositories = stored_repositories(entry) if event == "turn" else []
+                    fitted = [r for r in repositories if _fits(r, _repository_rules(client))][:takes] if takes else []
+                    if fitted:
+                        arguments["repositories"] = fitted  # FAA-140 (REQ-2): only where the tool takes it
+                    elif repositories and not (directory / "repositories.degraded").exists():
+                        why = "repositories its schema refuses were left out" if takes else "does not take repositories"
+                        note("session=%s event=turn outcome=degraded reason=%r" % (session_id[:8], "%s %s" % (OBSERVE_TOOL, why)))
+                        (directory / "repositories.degraded").touch()
                     answered = call(event, OBSERVE_TOOL, arguments)
                     if event == "turn" and not answered.get("isError"):
                         _keep_nudges(directory, _answer_json(answered).get("nudges"), note, session_id, nudges_file)
@@ -586,6 +882,54 @@ def _input_fields(client: McpStdio, tool: str) -> List[str]:
     return []
 
 
+def _fits(item: Dict[str, str], props: Dict[str, Any]) -> bool:
+    """Whether one {host, owner, name} meets what the schema says of each field (type, length, pattern, enum): an item
+    that does not is left out, so Fabric's check never refuses the whole turn for it (seam reading 4)."""
+    for key, value in item.items():
+        rule = props.get(key)
+        if not isinstance(rule, dict):
+            continue
+        try:
+            if rule.get("type", "string") != "string" or len(value) > rule.get("maxLength", len(value)) \
+                    or len(value) < rule.get("minLength", 0) or ("enum" in rule and value not in rule["enum"]) \
+                    or ("pattern" in rule and not re.search(rule["pattern"], value)):
+                return False
+        except (TypeError, re.error):
+            return False
+    return True
+
+
+def _repository_rules(client: McpStdio) -> Dict[str, Any]:
+    """The item properties fabric_session_observe declares for `repositories`; {} when there are none."""
+    for listed in client.tools:
+        if listed.get("name") == OBSERVE_TOOL:
+            schema = listed.get("inputSchema")
+            field = (schema.get("properties") or {}).get("repositories") if isinstance(schema, dict) else None
+            items = field.get("items") if isinstance(field, dict) else None
+            props = items.get("properties") if isinstance(items, dict) else None
+            return props if isinstance(props, dict) else {}
+    return {}
+
+
+def _takes_repositories(client: McpStdio) -> int:
+    """How many repositories fabric_session_observe takes a turn: 0 unless it declares `repositories` as an array of
+    objects with host, owner and name that requires nothing else, then at most its maxItems (FAA-140, REQ-2). A field
+    of another shape would fail Fabric's check and lose the turn's other facts with it."""
+    for listed in client.tools:
+        if listed.get("name") == OBSERVE_TOOL:
+            schema = listed.get("inputSchema")
+            field = (schema.get("properties") or {}).get("repositories") if isinstance(schema, dict) else None
+            items = field.get("items") if isinstance(field, dict) and field.get("type") == "array" else None
+            props = items.get("properties") if isinstance(items, dict) else None
+            required = items.get("required", []) if isinstance(items, dict) else None
+            if not (isinstance(props, dict) and {"host", "owner", "name"} <= set(props) and isinstance(required, list)
+                    and set(required) <= {"host", "owner", "name"}):
+                return 0
+            most = field.get("maxItems")
+            return max(0, min(MAX_REPOSITORIES, most)) if isinstance(most, int) and not isinstance(most, bool) else MAX_REPOSITORIES
+    return 0
+
+
 def _wait_for_session_tools(client: McpStdio, deadline: float) -> List[str]:
     """fabric-mcp lists only fabric_whoami until it holds a session; then it says its tools changed."""
     while True:

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.2.42",
+  "version": "0.2.44",
   "description": "Set up and check PassionCode.ai on a computer with one command (setting-up-passioncode), the organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",