@tekmidian/pai 0.15.0 → 0.17.0

package/dist/hooks/security-validator.mjs.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "sources": ["../../src/hooks/ts/pre-tool-use/security-validator.ts"],
+  "sources": ["../../../src/hooks/ts/pre-tool-use/security-validator.ts"],
   "sourcesContent": ["#!/usr/bin/env node\n\n/**\n * security-validator.ts - PreToolUse Security Validation Hook\n *\n * Fast pattern-based security validation for Bash commands.\n * Blocks commands matching known attack patterns before execution.\n *\n * Design Principles:\n * - Fast path: Most commands allowed with minimal processing\n * - Pre-compiled regex patterns at module load\n * - Only log/block on high-confidence attack detection\n * - Fail open on errors (don't break legitimate work)\n *\n * CUSTOMIZATION REQUIRED:\n * This template includes basic examples. Add your own security patterns\n * based on your threat model and environment.\n */\n\nimport { appendFileSync, mkdirSync, existsSync } from 'fs';\nimport { dirname } from 'path';\n\n// ============================================================================\n// ATTACK PATTERNS - CUSTOMIZE THESE FOR YOUR ENVIRONMENT\n// ============================================================================\n\n// Example: Reverse Shell Patterns (BLOCK - rarely legitimate)\nconst REVERSE_SHELL_PATTERNS: RegExp[] = [\n  /\\/dev\\/(tcp|udp)\\/[0-9]/,                    // Bash TCP/UDP device\n  /bash\\s+-i\\s+>&?\\s*\\/dev\\//,                  // Interactive bash redirect\n  // Add your own reverse shell patterns here\n];\n\n// Example: Instruction Override (BLOCK - prompt injection)\nconst INSTRUCTION_OVERRIDE_PATTERNS: RegExp[] = [\n  /ignore\\s+(all\\s+)?previous\\s+instructions?/i,\n  /disregard\\s+(all\\s+)?(prior|previous)\\s+(instructions?|rules?)/i,\n  // Add your own prompt injection patterns here\n];\n\n// Example: Catastrophic Deletion Patterns (BLOCK - filesystem destruction)\nconst CATASTROPHIC_DELETION_PATTERNS: RegExp[] = [\n  // Trailing tilde bypass\n  /\\s+~\\/?(\\s*$|\\s+)/,                              // Space then ~/ at end\n  /\\brm\\s+(-[rfivd]+\\s+)*\\S+\\s+~\\/?/,               // rm something ~/\n\n  // Relative path recursive deletion\n  /\\brm\\s+(-[rfivd]+\\s+)*\\.\\/\\s*$/,                 // rm -rf ./\n  /\\brm\\s+(-[rfivd]+\\s+)*\\.\\.\\/\\s*$/,               // rm -rf ../\n\n  // Add your own dangerous deletion patterns here\n];\n\n// Example: Dangerous File Operations (BLOCK - data destruction)\nconst DANGEROUS_FILE_OPS_PATTERNS: RegExp[] = [\n  /\\bchmod\\s+(-R\\s+)?0{3,}/,                        // chmod 000\n  // Add your own dangerous file operation patterns here\n];\n\n// OPTIONAL: Operations that require confirmation instead of blocking\nconst DANGEROUS_GIT_PATTERNS: RegExp[] = [\n  /\\bgit\\s+push\\s+.*(-f\\b|--force)/i,               // git push --force\n  /\\bgit\\s+reset\\s+--hard/i,                        // git reset --hard\n  // Add your own git safety patterns here\n];\n\n// Combined patterns for fast iteration\nconst ALL_BLOCK_PATTERNS: { category: string; patterns: RegExp[] }[] = [\n  { category: 'reverse_shell', patterns: REVERSE_SHELL_PATTERNS },\n  { category: 'instruction_override', patterns: INSTRUCTION_OVERRIDE_PATTERNS },\n  { category: 'catastrophic_deletion', patterns: CATASTROPHIC_DELETION_PATTERNS },\n  { category: 'dangerous_file_ops', patterns: DANGEROUS_FILE_OPS_PATTERNS },\n];\n\nconst CONFIRM_PATTERNS: { category: string; patterns: RegExp[] }[] = [\n  { category: 'dangerous_git', patterns: DANGEROUS_GIT_PATTERNS },\n];\n\n// ============================================================================\n// TYPES\n// ============================================================================\n\ninterface HookInput {\n  session_id: string;\n  tool_name: string;\n  tool_input: Record<string, unknown> | string;\n}\n\ninterface HookOutput {\n  permissionDecision: 'allow' | 'deny';\n  additionalContext?: string;\n  feedback?: string;\n}\n\n// ============================================================================\n// DETECTION LOGIC\n// ============================================================================\n\ninterface DetectionResult {\n  blocked: boolean;\n  requiresConfirmation?: boolean;\n  category?: string;\n  pattern?: string;\n}\n\nfunction detectAttack(content: string): DetectionResult {\n  // First check for hard blocks\n  for (const { category, patterns } of ALL_BLOCK_PATTERNS) {\n    for (const pattern of patterns) {\n      if (pattern.test(content)) {\n        return { blocked: true, category, pattern: pattern.source };\n      }\n    }\n  }\n\n  // Then check for confirmation-required patterns\n  for (const { category, patterns } of CONFIRM_PATTERNS) {\n    for (const pattern of patterns) {\n      if (pattern.test(content)) {\n        return { blocked: false, requiresConfirmation: true, category, pattern: pattern.source };\n      }\n    }\n  }\n\n  return { blocked: false };\n}\n\n// ============================================================================\n// ASYNC LOGGING (fire-and-forget on block only)\n// ============================================================================\n\nfunction logSecurityEvent(event: Record<string, unknown>): void {\n  const logPath = `${process.env.PAI_DIR || '~/.claude'}/history/security/security-events.jsonl`;\n  const entry = JSON.stringify({ timestamp: new Date().toISOString(), ...event }) + '\\n';\n\n  try {\n    const dir = dirname(logPath);\n    if (!existsSync(dir)) {\n      mkdirSync(dir, { recursive: true });\n    }\n    appendFileSync(logPath, entry);\n  } catch {\n    // Silently fail - logging should never break the hook\n  }\n}\n\n// ============================================================================\n// MAIN HOOK LOGIC\n// ============================================================================\n\nasync function main(): Promise<void> {\n  let input: HookInput;\n\n  try {\n    // Read stdin\n    const chunks: Buffer[] = [];\n    const timeoutPromise = new Promise<Buffer[]>((_, reject) =>\n      setTimeout(() => reject(new Error('timeout')), 100)\n    );\n    const readPromise = (async () => {\n      for await (const chunk of process.stdin) {\n        chunks.push(chunk);\n      }\n      return chunks;\n    })();\n\n    let text = '';\n    try {\n      const result = await Promise.race([readPromise, timeoutPromise]);\n      text = Buffer.concat(result).toString('utf-8');\n    } catch {\n      console.log(JSON.stringify({ permissionDecision: 'allow' }));\n      return;\n    }\n\n    if (!text.trim()) {\n      console.log(JSON.stringify({ permissionDecision: 'allow' }));\n      return;\n    }\n\n    input = JSON.parse(text);\n  } catch {\n    // Parse error or timeout - fail open\n    console.log(JSON.stringify({ permissionDecision: 'allow' }));\n    return;\n  }\n\n  // Only validate Bash commands\n  if (input.tool_name !== 'Bash') {\n    console.log(JSON.stringify({ permissionDecision: 'allow' }));\n    return;\n  }\n\n  // Extract command string\n  const command = typeof input.tool_input === 'string'\n    ? input.tool_input\n    : (input.tool_input?.command as string) || '';\n\n  if (!command) {\n    console.log(JSON.stringify({ permissionDecision: 'allow' }));\n    return;\n  }\n\n  // Check all patterns\n  const result = detectAttack(command);\n\n  if (result.blocked) {\n    // Log and block\n    logSecurityEvent({\n      type: 'attack_blocked',\n      category: result.category,\n      pattern: result.pattern,\n      command: command.slice(0, 200), // Truncate for log\n      session_id: input.session_id,\n    });\n\n    const output: HookOutput = {\n      permissionDecision: 'deny',\n      additionalContext: `SECURITY: Blocked ${result.category} pattern`,\n      feedback: `This command matched a security pattern (${result.category}). If this is legitimate, please rephrase the command.`,\n    };\n\n    console.log(JSON.stringify(output));\n    process.exit(2); // Exit 2 = blocking error\n  }\n\n  if (result.requiresConfirmation) {\n    // Log warning and require confirmation\n    logSecurityEvent({\n      type: 'confirmation_required',\n      category: result.category,\n      pattern: result.pattern,\n      command: command.slice(0, 200),\n      session_id: input.session_id,\n    });\n\n    const output: HookOutput = {\n      permissionDecision: 'deny',\n      additionalContext: `DANGEROUS: ${result.category} operation requires confirmation`,\n      feedback: `This is a dangerous operation (${command.slice(0, 50)}...). This can cause data loss. If you're sure, explicitly confirm this command.`,\n    };\n\n    console.log(JSON.stringify(output));\n    process.exit(2); // Exit 2 = requires user confirmation\n  }\n\n  // Allow - no logging, immediate exit\n  console.log(JSON.stringify({ permissionDecision: 'allow' }));\n}\n\n// ============================================================================\n// RUN\n// ============================================================================\n\nmain().catch(() => {\n  // On any error, fail open\n  console.log(JSON.stringify({ permissionDecision: 'allow' }));\n});\n"],
   "mappings": ";;;AAmBA,SAAS,gBAAgB,WAAW,kBAAkB;AACtD,SAAS,eAAe;AAOxB,IAAM,yBAAmC;AAAA,EACvC;AAAA;AAAA,EACA;AAAA;AAAA;AAEF;AAGA,IAAM,gCAA0C;AAAA,EAC9C;AAAA,EACA;AAAA;AAEF;AAGA,IAAM,iCAA2C;AAAA;AAAA,EAE/C;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAGF;AAGA,IAAM,8BAAwC;AAAA,EAC5C;AAAA;AAAA;AAEF;AAGA,IAAM,yBAAmC;AAAA,EACvC;AAAA;AAAA,EACA;AAAA;AAAA;AAEF;AAGA,IAAM,qBAAiE;AAAA,EACrE,EAAE,UAAU,iBAAiB,UAAU,uBAAuB;AAAA,EAC9D,EAAE,UAAU,wBAAwB,UAAU,8BAA8B;AAAA,EAC5E,EAAE,UAAU,yBAAyB,UAAU,+BAA+B;AAAA,EAC9E,EAAE,UAAU,sBAAsB,UAAU,4BAA4B;AAC1E;AAEA,IAAM,mBAA+D;AAAA,EACnE,EAAE,UAAU,iBAAiB,UAAU,uBAAuB;AAChE;AA6BA,SAAS,aAAa,SAAkC;AAEtD,aAAW,EAAE,UAAU,SAAS,KAAK,oBAAoB;AACvD,eAAW,WAAW,UAAU;AAC9B,UAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,eAAO,EAAE,SAAS,MAAM,UAAU,SAAS,QAAQ,OAAO;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AAGA,aAAW,EAAE,UAAU,SAAS,KAAK,kBAAkB;AACrD,eAAW,WAAW,UAAU;AAC9B,UAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,eAAO,EAAE,SAAS,OAAO,sBAAsB,MAAM,UAAU,SAAS,QAAQ,OAAO;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,MAAM;AAC1B;AAMA,SAAS,iBAAiB,OAAsC;AAC9D,QAAM,UAAU,GAAG,QAAQ,IAAI,WAAW,WAAW;AACrD,QAAM,QAAQ,KAAK,UAAU,EAAE,YAAW,oBAAI,KAAK,GAAE,YAAY,GAAG,GAAG,MAAM,CAAC,IAAI;AAElF,MAAI;AACF,UAAM,MAAM,QAAQ,OAAO;AAC3B,QAAI,CAAC,WAAW,GAAG,GAAG;AACpB,gBAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,IACpC;AACA,mBAAe,SAAS,KAAK;AAAA,EAC/B,QAAQ;AAAA,EAER;AACF;AAMA,eAAe,OAAsB;AACnC,MAAI;AAEJ,MAAI;AAEF,UAAM,SAAmB,CAAC;AAC1B,UAAM,iBAAiB,IAAI;AAAA,MAAkB,CAAC,GAAG,WAC/C,WAAW,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC,GAAG,GAAG;AAAA,IACpD;AACA,UAAM,eAAe,YAAY;AAC/B,uBAAiB,SAAS,QAAQ,OAAO;AACvC,eAAO,KAAK,KAAK;AAAA,MACnB;AACA,aAAO;AAAA,IACT,GAAG;AAEH,QAAI,OAAO;AACX,QAAI;AACF,YAAMA,UAAS,MAAM,QAAQ,KAAK,CAAC,aAAa,cAAc,CAAC;AAC/D,aAAO,OAAO,OAAOA,OAAM,EAAE,SAAS,OAAO;AAAA,IAC/C,QAAQ;AACN,cAAQ,IAAI,KAAK,UAAU,EAAE,oBAAoB,QAAQ,CAAC,CAAC;AAC3D;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,KAAK,GAAG;AAChB,cAAQ,IAAI,KAAK,UAAU,EAAE,oBAAoB,QAAQ,CAAC,CAAC;AAC3D;AAAA,IACF;AAEA,YAAQ,KAAK,MAAM,IAAI;AAAA,EACzB,QAAQ;AAEN,YAAQ,IAAI,KAAK,UAAU,EAAE,oBAAoB,QAAQ,CAAC,CAAC;AAC3D;AAAA,EACF;AAGA,MAAI,MAAM,cAAc,QAAQ;AAC9B,YAAQ,IAAI,KAAK,UAAU,EAAE,oBAAoB,QAAQ,CAAC,CAAC;AAC3D;AAAA,EACF;AAGA,QAAM,UAAU,OAAO,MAAM,eAAe,WACxC,MAAM,aACL,MAAM,YAAY,WAAsB;AAE7C,MAAI,CAAC,SAAS;AACZ,YAAQ,IAAI,KAAK,UAAU,EAAE,oBAAoB,QAAQ,CAAC,CAAC;AAC3D;AAAA,EACF;AAGA,QAAM,SAAS,aAAa,OAAO;AAEnC,MAAI,OAAO,SAAS;AAElB,qBAAiB;AAAA,MACf,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,MAChB,SAAS,QAAQ,MAAM,GAAG,GAAG;AAAA;AAAA,MAC7B,YAAY,MAAM;AAAA,IACpB,CAAC;AAED,UAAM,SAAqB;AAAA,MACzB,oBAAoB;AAAA,MACpB,mBAAmB,qBAAqB,OAAO,QAAQ;AAAA,MACvD,UAAU,4CAA4C,OAAO,QAAQ;AAAA,IACvE;AAEA,YAAQ,IAAI,KAAK,UAAU,MAAM,CAAC;AAClC,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,OAAO,sBAAsB;AAE/B,qBAAiB;AAAA,MACf,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,MAChB,SAAS,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC7B,YAAY,MAAM;AAAA,IACpB,CAAC;AAED,UAAM,SAAqB;AAAA,MACzB,oBAAoB;AAAA,MACpB,mBAAmB,cAAc,OAAO,QAAQ;AAAA,MAChD,UAAU,kCAAkC,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IAClE;AAEA,YAAQ,IAAI,KAAK,UAAU,MAAM,CAAC;AAClC,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,UAAQ,IAAI,KAAK,UAAU,EAAE,oBAAoB,QAAQ,CAAC,CAAC;AAC7D;AAMA,KAAK,EAAE,MAAM,MAAM;AAEjB,UAAQ,IAAI,KAAK,UAAU,EAAE,oBAAoB,QAAQ,CAAC,CAAC;AAC7D,CAAC;",
   "names": ["result"]

package/dist/hooks/session-commands.mjs.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "sources": ["../../src/hooks/ts/session-start/session-commands.ts"],
+  "sources": ["../../../src/hooks/ts/session-start/session-commands.ts"],
   "sourcesContent": ["#!/usr/bin/env node\n\n/**\n * session-commands.ts\n *\n * Tiny SessionStart hook that injects critical session commands inline.\n * Stays under 2KB to avoid persisted-output truncation.\n *\n * This runs BEFORE load-core-context so these commands are always available\n * even when the full CORE skill gets truncated.\n */\n\nconst commands = `<system-reminder>\nSESSION COMMANDS (always available):\n\n- \"go\" / \"continue\" / \"weiter\" \u2192 Read Notes/TODO.md, find ## Continue section, resume work\n- \"pause session\" \u2192 Save state to TODO.md, update session note, stop (no compact)\n- \"end session\" \u2192 Finalize note, commit if needed, start fresh next time\n- \"cpp\" \u2192 Release workflow: version bump \u2192 build \u2192 npm publish \u2192 git add ALL \u2192 ONE commit \u2192 git push\n\nWhen user says \"go\" with no other context, ALWAYS check TODO.md first.\n\nIMPORTANT: Full PAI context may be truncated due to size. For complete instructions (response format, workflows, principles), READ: ~/.claude/Skills/CORE/SKILL.md\n</system-reminder>`;\n\nconsole.log(commands);\n"],
   "mappings": ";;;AAYA,IAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAajB,QAAQ,IAAI,QAAQ;",
   "names": []

package/dist/hooks/stop-hook.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/hooks/ts/stop/stop-hook.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync6, unlinkSync } from "fs";
-import { join as join6, basename as basename3, dirname } from "path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, existsSync as existsSync7, unlinkSync } from "fs";
+import { join as join7, basename as basename3, dirname } from "path";
 import { connect } from "net";
 import { randomUUID } from "crypto";
 
@@ -387,13 +387,292 @@ ${summary || "Session completed."}`
 }
 
 // src/hooks/ts/lib/project-utils/todo.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join6 } from "path";
+
+// src/session/checkpoint-block.ts
+import {
+  existsSync as existsSync5,
+  readFileSync as readFileSync4,
+  writeFileSync as writeFileSync2,
+  readdirSync as readdirSync3,
+  renameSync as renameSync3,
+  mkdirSync as mkdirSync3,
+  realpathSync
+} from "node:fs";
+import { join as join5 } from "node:path";
+var TODO_LOCATIONS = [
+  "Notes/TODO.md",
+  ".claude/Notes/TODO.md",
+  "tasks/todo.md",
+  "TODO.md"
+];
+var MARKER_OPEN = "<!-- pai:checkpoint";
+var MARKER_CLOSE = "<!-- /pai:checkpoint -->";
+var CONTINUE_HEADING = "## Continue";
+function findProjectTodo(rootPath) {
+  for (const rel of TODO_LOCATIONS) {
+    const full = join5(rootPath, rel);
+    if (existsSync5(full)) {
+      try {
+        return { path: full, content: readFileSync4(full, "utf8") };
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function resolveTodoTarget(rootPath, opts = {}) {
+  const found = findProjectTodo(rootPath);
+  if (found) return found;
+  const notesDir = join5(rootPath, "Notes");
+  if (opts.create !== false) {
+    try {
+      if (!existsSync5(notesDir)) mkdirSync3(notesDir, { recursive: true });
+    } catch {
+      return null;
+    }
+  }
+  return { path: join5(notesDir, "TODO.md"), content: "" };
+}
+function parseMarker(line) {
+  const trimmed = line.trim();
+  if (!trimmed.startsWith(MARKER_OPEN)) return null;
+  const attrs = {};
+  for (const m of trimmed.matchAll(/([a-zA-Z][\w-]*)="([^"]*)"/g)) {
+    attrs[m[1]] = m[2];
+  }
+  return {
+    authored: attrs.authored === "model" ? "model" : "auto",
+    session: attrs.session || void 0,
+    sessionId: attrs["session-id"] || void 0,
+    ts: attrs.ts || void 0
+  };
+}
+var BOILERPLATE_PATTERNS = [
+  /^##\s+Continue$/,
+  /^<!--\s*\/?pai:checkpoint/,
+  /^>\s*\*\*Last session:\*\*/,
+  /^>\s*\*\*Paused at:\*\*/,
+  /^>\s*Working directory:/,
+  /^>\s*Resume with:/,
+  /^>\s*_No checkpoint body was recorded/,
+  /^-{3,}$/
+];
+var BLANK_LINE = /^>?\s*$/;
+function isBoilerplateOnly(lines) {
+  return lines.every((line) => {
+    const t = line.trim();
+    return BLANK_LINE.test(t) || BOILERPLATE_PATTERNS.some((re) => re.test(t));
+  });
+}
+function extractSectionContent(lines) {
+  const kept = [];
+  for (const line of lines) {
+    const t = line.trim();
+    if (BOILERPLATE_PATTERNS.some((re) => re.test(t))) continue;
+    kept.push(line);
+  }
+  return trimBlankEdges(collapseBlankRuns(kept)).join("\n");
+}
+function trimBlankEdges(lines) {
+  let start = 0;
+  let end = lines.length;
+  while (start < end && BLANK_LINE.test(lines[start].trim())) start += 1;
+  while (end > start && BLANK_LINE.test(lines[end - 1].trim())) end -= 1;
+  return lines.slice(start, end);
+}
+function collapseBlankRuns(lines) {
+  const out = [];
+  let lastWasBlank = false;
+  for (const line of lines) {
+    const isBlank = BLANK_LINE.test(line.trim());
+    if (isBlank && lastWasBlank) continue;
+    out.push(line);
+    lastWasBlank = isBlank;
+  }
+  return out;
+}
+function locateContinue(content) {
+  const lines = content.split("\n");
+  const startIdx = lines.findIndex((l) => l.trim() === CONTINUE_HEADING);
+  if (startIdx === -1) return null;
+  let meta = null;
+  let markerIdx = -1;
+  for (let i = startIdx + 1; i < Math.min(startIdx + 6, lines.length); i++) {
+    const parsed = parseMarker(lines[i]);
+    if (parsed) {
+      meta = parsed;
+      markerIdx = i;
+      break;
+    }
+    if (lines[i].trim() !== "") break;
+  }
+  let endIdx = lines.length;
+  if (markerIdx !== -1) {
+    const closeIdx = lines.findIndex(
+      (l, i) => i > markerIdx && l.trim() === MARKER_CLOSE
+    );
+    if (closeIdx !== -1) {
+      endIdx = closeIdx + 1;
+    } else {
+      endIdx = heuristicEnd(lines, startIdx);
+    }
+  } else {
+    endIdx = heuristicEnd(lines, startIdx);
+  }
+  let trailingEnd = endIdx;
+  while (trailingEnd < lines.length && lines[trailingEnd].trim() === "") {
+    trailingEnd += 1;
+  }
+  if (trailingEnd < lines.length && lines[trailingEnd].trim() === "---") {
+    trailingEnd += 1;
+  } else {
+    trailingEnd = endIdx;
+  }
+  return {
+    startIdx,
+    endIdx: trailingEnd,
+    meta,
+    lines: lines.slice(startIdx, trailingEnd)
+  };
+}
+function heuristicEnd(lines, startIdx) {
+  for (let i = startIdx + 1; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    if (trimmed === "---" || /^##(?!#)/.test(trimmed) && trimmed !== CONTINUE_HEADING) {
+      return i;
+    }
+  }
+  return lines.length;
+}
+function stripContinue(content) {
+  const found = locateContinue(content);
+  if (!found) return content;
+  const lines = content.split("\n");
+  const before = lines.slice(0, found.startIdx);
+  const after = lines.slice(found.endIdx);
+  while (after.length > 0 && after[0].trim() === "") after.shift();
+  return [...before, ...after].join("\n");
+}
+function escapeAttr(value) {
+  return value.replace(/"/g, "'");
+}
+function buildContinueBlock(opts) {
+  const ts = opts.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+  const attrs = [
+    `authored="${opts.authored}"`,
+    `session="${escapeAttr(opts.sessionLine)}"`,
+    opts.sessionId ? `session-id="${escapeAttr(opts.sessionId)}"` : null,
+    `ts="${ts}"`
+  ].filter(Boolean).join(" ");
+  const header = [
+    `> **Last session:** ${opts.sessionLine}`,
+    `> **Paused at:** ${ts}`,
+    ">",
+    `> Working directory: ${opts.cwd}`
+  ];
+  if (opts.sessionId) {
+    header.push(">", `> Resume with: \`claude --resume ${opts.sessionId}\``);
+  }
+  const body = (opts.body ?? "").trim();
+  const parts = [
+    CONTINUE_HEADING,
+    "",
+    `${MARKER_OPEN} ${attrs} -->`,
+    "",
+    ...header
+  ];
+  if (body) {
+    parts.push("", body);
+  } else {
+    parts.push(
+      ">",
+      "> _No checkpoint body was recorded \u2014 see the latest session note._"
+    );
+  }
+  parts.push("", MARKER_CLOSE, "", "---", "");
+  return parts.join("\n");
+}
+function isSameSession(meta, opts) {
+  if (meta.sessionId && opts.sessionId) {
+    return meta.sessionId === opts.sessionId;
+  }
+  return meta.session === opts.sessionLine;
+}
+function applyContinue(opts) {
+  const target = resolveTodoTarget(opts.rootPath, { create: !opts.dryRun });
+  if (!target) {
+    return {
+      action: "failed",
+      path: null,
+      block: buildContinueBlock(opts),
+      error: "Could not resolve or create a TODO.md target"
+    };
+  }
+  const existing = locateContinue(target.content);
+  let carriedForward = false;
+  let effectiveBody = opts.body;
+  if (opts.authored === "auto" && existing) {
+    if (existing.meta?.authored === "model" && isSameSession(existing.meta, opts)) {
+      return {
+        action: "preserved",
+        path: target.path,
+        block: buildContinueBlock(opts),
+        preservedMeta: existing.meta
+      };
+    }
+    if (existing.meta && !(opts.body ?? "").trim() && !isBoilerplateOnly(existing.lines)) {
+      return {
+        action: "preserved",
+        path: target.path,
+        block: buildContinueBlock(opts),
+        preservedMeta: existing.meta ?? void 0
+      };
+    }
+    if (!existing.meta && !isBoilerplateOnly(existing.lines)) {
+      const salvaged = extractSectionContent(existing.lines);
+      if (salvaged) {
+        effectiveBody = [
+          "_Carried forward from the previous checkpoint (author unknown \u2014 this",
+          "block predates checkpoint authorship markers):_",
+          "",
+          salvaged
+        ].join("\n");
+        carriedForward = true;
+      }
+    }
+  }
+  const block = buildContinueBlock({ ...opts, body: effectiveBody });
+  if (opts.dryRun) {
+    return { action: "written", path: target.path, block, carriedForward };
+  }
+  const newContent = block + stripContinue(target.content).trimStart();
+  const tmpPath = `${target.path}.continue.tmp`;
+  try {
+    writeFileSync2(tmpPath, newContent, "utf8");
+    renameSync3(tmpPath, target.path);
+  } catch (err) {
+    try {
+      if (existsSync5(tmpPath)) renameSync3(tmpPath, `${tmpPath}.dead`);
+    } catch {
+    }
+    return {
+      action: "failed",
+      path: target.path,
+      block,
+      error: String(err)
+    };
+  }
+  return { action: "written", path: target.path, block, carriedForward };
+}
+
+// src/hooks/ts/lib/project-utils/todo.ts
 function ensureTodoMd(cwd) {
   const todoPath = findTodoPath(cwd);
-  if (!existsSync5(todoPath)) {
-    const parentDir = join5(todoPath, "..");
-    if (!existsSync5(parentDir)) mkdirSync3(parentDir, { recursive: true });
+  if (!existsSync6(todoPath)) {
+    const parentDir = join6(todoPath, "..");
+    if (!existsSync6(parentDir)) mkdirSync4(parentDir, { recursive: true });
     const content = `# TODO
 
 ## Current Session
@@ -408,43 +687,52 @@ function ensureTodoMd(cwd) {
 
 *Last updated: ${(/* @__PURE__ */ new Date()).toISOString()}*
 `;
-    writeFileSync2(todoPath, content);
+    writeFileSync3(todoPath, content);
     console.error(`Created TODO.md: ${todoPath}`);
   }
   return todoPath;
 }
 function updateTodoContinue(cwd, noteFilename, state, tokenDisplay) {
-  const todoPath = ensureTodoMd(cwd);
-  let content = readFileSync4(todoPath, "utf-8");
-  content = content.replace(/## Continue\n[\s\S]*?\n---\n+/, "");
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const stateLines = state ? state.split("\n").filter((l) => l.trim()).slice(0, 10).map((l) => `> ${l}`).join("\n") : `> Working directory: ${cwd}. Check the latest session note for details.`;
-  const continueSection = `## Continue
-
-> **Last session:** ${noteFilename.replace(".md", "")}
-> **Paused at:** ${now}
->
-${stateLines}
-
----
-
-`;
-  content = content.replace(/^\s+/, "");
-  const titleMatch = content.match(/^(# [^\n]+\n+)/);
-  if (titleMatch) {
-    content = titleMatch[1] + continueSection + content.substring(titleMatch[0].length);
-  } else {
-    content = continueSection + content;
+  ensureTodoMd(cwd);
+  const result = applyContinue({
+    rootPath: cwd,
+    authored: "auto",
+    // The hooks identify a session by its note filename; `pai pause` resolves
+    // the same string from the registry (and falls back to this filename when
+    // the registry has no session row). They must agree, because this string
+    // is the key that decides whether an authored checkpoint belongs to the
+    // current session and must be preserved.
+    sessionLine: noteFilename.replace(/\.md$/, ""),
+    cwd,
+    body: state?.trim() || void 0
+  });
+  if (result.action === "preserved") {
+    console.error(
+      "TODO.md ## Continue left intact \u2014 authored checkpoint for this session"
+    );
+    return;
   }
-  content = content.replace(/(\n---\s*)*(\n\*Last updated:.*\*\s*)+$/g, "");
-  content = content.trimEnd() + `
+  if (result.action === "failed") {
+    console.error(`TODO.md ## Continue update failed: ${result.error}`);
+    return;
+  }
+  try {
+    const todoPath = result.path;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    let content = readFileSync5(todoPath, "utf-8");
+    content = content.replace(/(\n---\s*)*(\n\*Last updated:.*\*\s*)+$/g, "");
+    content = content.trimEnd() + `
 
 ---
 
 *Last updated: ${now}*
 `;
-  writeFileSync2(todoPath, content);
-  console.error("TODO.md ## Continue section updated");
+    writeFileSync3(todoPath, content);
+  } catch {
+  }
+  console.error(
+    result.carriedForward ? "TODO.md ## Continue section updated (previous content carried forward)" : "TODO.md ## Continue section updated"
+  );
 }
 
 // src/hooks/ts/stop/stop-hook.ts
@@ -458,7 +746,7 @@ var AUTO_SAVE_INTERVAL = (() => {
   }
   return 15;
 })();
-var SESSION_STATE_DIR = join6(
+var SESSION_STATE_DIR = join7(
   process.env.HOME ?? "/tmp",
   ".config",
   "pai",
@@ -466,9 +754,9 @@ var SESSION_STATE_DIR = join6(
 );
 function readSessionState(sessionId) {
   try {
-    const stateFile = join6(SESSION_STATE_DIR, `${sessionId}.json`);
-    if (!existsSync6(stateFile)) return { humanMessageCount: 0 };
-    const raw = readFileSync5(stateFile, "utf-8");
+    const stateFile = join7(SESSION_STATE_DIR, `${sessionId}.json`);
+    if (!existsSync7(stateFile)) return { humanMessageCount: 0 };
+    const raw = readFileSync6(stateFile, "utf-8");
     const parsed = JSON.parse(raw);
     return {
       humanMessageCount: typeof parsed.humanMessageCount === "number" ? parsed.humanMessageCount : 0
@@ -479,17 +767,17 @@ function readSessionState(sessionId) {
 }
 function writeSessionState(sessionId, state) {
   try {
-    mkdirSync4(SESSION_STATE_DIR, { recursive: true });
-    const stateFile = join6(SESSION_STATE_DIR, `${sessionId}.json`);
-    writeFileSync3(stateFile, JSON.stringify(state, null, 2), "utf-8");
+    mkdirSync5(SESSION_STATE_DIR, { recursive: true });
+    const stateFile = join7(SESSION_STATE_DIR, `${sessionId}.json`);
+    writeFileSync4(stateFile, JSON.stringify(state, null, 2), "utf-8");
   } catch (e) {
     console.error(`STOP-HOOK: Could not write session state: ${e}`);
   }
 }
 function deleteSessionState(sessionId) {
   try {
-    const stateFile = join6(SESSION_STATE_DIR, `${sessionId}.json`);
-    if (existsSync6(stateFile)) {
+    const stateFile = join7(SESSION_STATE_DIR, `${sessionId}.json`);
+    if (existsSync7(stateFile)) {
       unlinkSync(stateFile);
     }
   } catch {
@@ -996,7 +1284,7 @@ STOP-HOOK TRIGGERED AT ${timestamp}`);
   }
   let transcript;
   try {
-    transcript = readFileSync5(transcriptPath, "utf-8");
+    transcript = readFileSync6(transcriptPath, "utf-8");
     debug(`Transcript loaded: ${transcript.split("\n").length} lines`);
   } catch (e) {
     console.error(`Error reading transcript: ${e}`);