@tekmidian/pai 0.36.2 → 0.38.0

package/src/hooks/ts/lib/context-fill.ts

@@ -365,6 +365,51 @@ function listProjectTranscripts(cwd: string, projectsDir: string): string[] {
   return paths;
 }
 
+/** Placeholder model id the platform writes on synthetic assistant turns. */
+const SYNTHETIC_MODEL = "<synthetic>";
+
+/**
+ * Which family of model wrote a transcript. "claude" is the platform's own;
+ * "foreign" is any other provider routed through the same CLI (a different
+ * context window, so its compactions say nothing about ours); "unknown" is
+ * no usable model field at all.
+ */
+export type TranscriptModelFamily = "claude" | "foreign" | "unknown";
+
+export function modelFamily(model: string | null | undefined): TranscriptModelFamily {
+  if (typeof model !== "string" || model === "" || model === SYNTHETIC_MODEL) return "unknown";
+  return model.startsWith("claude-") ? "claude" : "foreign";
+}
+
+/**
+ * The family of the LAST assistant model in a transcript — scanned from the
+ * end so a long transcript costs one read and a few lines of parsing.
+ * Unreadable or model-less transcripts are "unknown", never "foreign":
+ * the callers that skip work on "foreign" must not skip it on doubt.
+ */
+export function transcriptModelFamily(path: string): TranscriptModelFamily {
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf-8");
+  } catch {
+    return "unknown";
+  }
+  const lines = raw.split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line.includes('"model"')) continue;
+    try {
+      const entry = JSON.parse(line) as { type?: string; message?: { model?: unknown } };
+      if (entry.type !== "assistant") continue;
+      const model = entry.message?.model;
+      if (typeof model === "string" && model !== SYNTHETIC_MODEL) return modelFamily(model);
+    } catch {
+      continue;
+    }
+  }
+  return "unknown";
+}
+
 /**
  * Every DISTINCT compact_boundary sample found across ALL of a project's
  * transcripts (live + archived), newest first by the event's OWN timestamp
@@ -383,6 +428,17 @@ function readCompactBoundarySamples(cwd: string, projectsDir: string): CompactBo
       continue;
     }
 
+    // The model governing each sample: the most recent assistant
+    // `message.model` seen in this file before the compact_boundary. A
+    // transcript written by a non-Claude model (a headless worker on another
+    // provider, with a different context window) compacts at a different
+    // size and must not shape THIS project's trigger — two such workers
+    // compacting at ~151k pulled a real project's trigger from ~784k to
+    // ~151k. Samples with no model seen yet are kept: older transcripts
+    // may lack the field.
+    let lastModel: string | null = null;
+    let foreignDiscards = 0;
+
     for (const line of raw.split("\n")) {
       if (!line.trim()) continue;
       let entry: {
@@ -391,23 +447,40 @@ function readCompactBoundarySamples(cwd: string, projectsDir: string): CompactBo
         timestamp?: string;
         uuid?: string;
         compactMetadata?: { preTokens?: number };
+        message?: { model?: unknown };
       };
       try {
         entry = JSON.parse(line);
       } catch {
         continue;
       }
+      if (entry.type === "assistant") {
+        const model = entry.message?.model;
+        if (typeof model === "string" && model !== SYNTHETIC_MODEL) lastModel = model;
+        continue;
+      }
       if (entry.type !== "system" || entry.subtype !== "compact_boundary") continue;
       const preTokens = entry.compactMetadata?.preTokens;
       if (typeof preTokens !== "number" || !Number.isFinite(preTokens)) continue;
       const timestampMs = entry.timestamp ? Date.parse(entry.timestamp) : NaN;
       if (!Number.isFinite(timestampMs)) continue;
+      if (modelFamily(lastModel) === "foreign") {
+        foreignDiscards++;
+        continue;
+      }
 
       const key = entry.uuid ?? `${timestampMs}:${preTokens}`;
       if (!byKey.has(key)) {
         byKey.set(key, { preTokens, timestampMs, timestamp: entry.timestamp!, uuid: entry.uuid });
       }
     }
+
+    if (foreignDiscards > 0) {
+      console.error(
+        `[context-fill] ignored ${foreignDiscards} compaction sample(s) from a ` +
+        `non-Claude transcript (model=${lastModel}): ${path}`
+      );
+    }
   }
 
   return [...byKey.values()].sort((a, b) => b.timestampMs - a.timestampMs);

package/src/hooks/ts/lib/handover-evidence.ts

@@ -0,0 +1,227 @@
+/**
+ * Evidence binding for the model-written pre-compaction handover.
+ *
+ * The handover is prose written by a model about the session. Nothing else
+ * checks its claims, and the successor session cannot: by the time it reads
+ * the handover, the transcript it describes has been compacted away. This
+ * module does the one check that is cheap and deterministic — every
+ * checkable identifier in the handover (commit hashes, versions, paths,
+ * pids, timestamps, token counts) must appear verbatim in the transcript
+ * the handover was written from. Identifiers that do not are reported as
+ * unverified. Nothing is ever dropped or rewritten: the reader gets the
+ * handover unchanged plus one footer line saying how much of it is
+ * anchored in the record.
+ *
+ * Borrowed from the evidence-binding step of graph extractors that check an
+ * LLM's output against the chunk it was given. No model is called.
+ */
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { contentToText } from "./transcript-text.js";
+
+export interface EvidenceResult {
+  /** Distinct checkable identifiers found in the handover. */
+  total: number;
+  /** Identifiers present verbatim (after normalisation) in the transcript. */
+  found: string[];
+  /** Identifiers absent from the transcript — unverified, not wrong. */
+  missing: string[];
+  /** One line for the reader, never empty. */
+  footer: string;
+}
+
+/** Minimum identifier length worth checking; shorter strings match by accident. */
+const MIN_TOKEN_LENGTH = 4;
+/** How many unverified identifiers the footer names before "+N more". */
+const FOOTER_NAMED_MISSING = 5;
+/** Length of the handover's opening used to recognise its own echo in a tool result. */
+const ECHO_HEAD_LENGTH = 80;
+
+/** Markers of text that was injected INTO the session rather than produced by it. */
+const INJECTED_MARKERS = [
+  "HANDOVER FROM THE PREVIOUS SESSION",
+  "MODEL-WRITTEN HANDOVER",
+  "SESSION STATE RECOVERED AFTER COMPACTION",
+];
+
+/** Tools whose input would contain the handover itself when it targets the handover file. */
+const HANDOVER_WRITERS = new Set(["Write", "Edit", "NotebookEdit"]);
+
+/**
+ * Identifier classes, in priority order. Each pattern yields either its
+ * whole match or capture group 1 when present. Kept deliberately literal:
+ * an identifier is something a reader could grep for.
+ */
+const TOKEN_PATTERNS: RegExp[] = [
+  // git hashes: 7-40 hex chars with at least one letter (a plain number is not a hash)
+  /\b(?=[0-9a-f]*[a-f])[0-9a-f]{7,40}\b/g,
+  // package@version
+  /(?:@[\w.-]+\/)?[\w.-]+@\d+\.\d+\.\d+(?:-[\w.]+)?/g,
+  // semver
+  /\bv?\d+\.\d+\.\d+(?:-[\w.]+)?\b/g,
+  // absolute paths (two or more segments)
+  /(?:^|[\s(`'"])(\/[\w.-]+(?:\/[\w.-]+)+)/gm,
+  // relative paths with a slash and an extension
+  /(?:^|[\s(`'"])((?:~\/|\.\.?\/)?[\w.-]+(?:\/[\w.-]+)+\.[a-z0-9]{1,5})\b/gm,
+  // process ids
+  /\bpid\s*[:=#]?\s*(\d{3,7})\b/gi,
+  // ISO dates and timestamps
+  /\b\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?Z?)?\b/g,
+  // numbers with units — digits only are kept
+  /\b(\d[\d,]*)\s*(?:tokens?|ms|MB|GB)\b/g,
+];
+
+/** Strip thousands separators so "784,000" and "784000" compare equal. */
+function normalise(text: string): string {
+  return text.replace(/(\d),(?=\d{3}\b)/g, "$1");
+}
+
+function stripSystemReminders(text: string): string {
+  return text.replace(/<system-reminder>[\s\S]*?<\/system-reminder>/g, "");
+}
+
+/** Every distinct checkable identifier in a handover, in order of first appearance. */
+export function extractCheckableTokens(markdown: string): string[] {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const pattern of TOKEN_PATTERNS) {
+    pattern.lastIndex = 0;
+    for (const match of markdown.matchAll(pattern)) {
+      const raw = (match[1] ?? match[0]).trim();
+      const token = normalise(raw);
+      if (token.length < MIN_TOKEN_LENGTH || seen.has(token)) continue;
+      seen.add(token);
+      out.push(token);
+    }
+  }
+  return out;
+}
+
+interface TranscriptEntry {
+  type?: string;
+  message?: { content?: unknown };
+}
+
+interface ContentPart {
+  type?: string;
+  text?: string;
+  name?: string;
+  input?: { file_path?: unknown } & Record<string, unknown>;
+  content?: unknown;
+}
+
+/**
+ * Everything the session itself said, did, or was shown — minus the two
+ * places where the handover could verify against itself: the tool call
+ * that wrote the handover file, and injected blocks carried over from an
+ * earlier compaction.
+ */
+function buildHaystack(
+  transcriptPaths: string[],
+  handoverPath: string | null,
+  handoverHead: string
+): string {
+  const parts: string[] = [];
+  const resolvedHandover = handoverPath ? resolve(handoverPath) : null;
+
+  const pushUserText = (text: string): void => {
+    if (INJECTED_MARKERS.some((m) => text.includes(m))) return;
+    parts.push(stripSystemReminders(text));
+  };
+
+  for (const path of transcriptPaths) {
+    let raw: string;
+    try {
+      raw = readFileSync(path, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      let entry: TranscriptEntry;
+      try {
+        entry = JSON.parse(line) as TranscriptEntry;
+      } catch {
+        continue;
+      }
+      const content = entry.message?.content;
+      if (content === undefined) continue;
+
+      if (entry.type === "user") {
+        if (typeof content === "string") {
+          pushUserText(content);
+          continue;
+        }
+        if (!Array.isArray(content)) continue;
+        for (const part of content as ContentPart[]) {
+          if (part?.type === "text" && typeof part.text === "string") pushUserText(part.text);
+          else if (part?.type === "tool_result") {
+            const text = contentToText(part.content);
+            if (handoverHead && text.startsWith(handoverHead)) continue;
+            parts.push(text);
+          }
+        }
+      } else if (entry.type === "assistant" && Array.isArray(content)) {
+        for (const part of content as ContentPart[]) {
+          if (part?.type === "text" && typeof part.text === "string") parts.push(part.text);
+          else if (part?.type === "tool_use") {
+            const target = part.input?.file_path;
+            if (
+              resolvedHandover &&
+              HANDOVER_WRITERS.has(part.name ?? "") &&
+              typeof target === "string" &&
+              resolve(target) === resolvedHandover
+            ) {
+              continue;
+            }
+            parts.push(JSON.stringify(part.input ?? {}));
+          }
+        }
+      }
+    }
+  }
+  return normalise(parts.join("\n"));
+}
+
+function footerFor(found: string[], missing: string[]): string {
+  const total = found.length + missing.length;
+  if (total === 0) return "Evidence: no checkable identifiers";
+  let footer = `Evidence: ${found.length}/${total} identifiers found in the transcript`;
+  if (missing.length > 0) {
+    const named = missing.slice(0, FOOTER_NAMED_MISSING).join(", ");
+    const more = missing.length - FOOTER_NAMED_MISSING;
+    footer += `; unverified: ${named}${more > 0 ? ` +${more} more` : ""}`;
+  }
+  return footer;
+}
+
+/**
+ * Check a handover's identifiers against the transcript(s) it was written
+ * from. Never throws: any failure degrades to a footer that says the check
+ * was unavailable, so the handover itself is always delivered.
+ *
+ * @param handoverMarkdown  the handover text, returned to the reader unchanged
+ * @param handoverPath      where the handover was written, if it was written
+ *                          to a file — its own Write/Edit is excluded as evidence
+ * @param transcriptPaths   the session's transcript file(s)
+ */
+export function bindHandoverEvidence(
+  handoverMarkdown: string,
+  handoverPath: string | null,
+  transcriptPaths: string[]
+): EvidenceResult {
+  try {
+    const tokens = extractCheckableTokens(handoverMarkdown);
+    if (tokens.length === 0) {
+      return { total: 0, found: [], missing: [], footer: footerFor([], []) };
+    }
+    const head = handoverMarkdown.trim().slice(0, ECHO_HEAD_LENGTH);
+    const haystack = buildHaystack(transcriptPaths, handoverPath, head);
+    const found: string[] = [];
+    const missing: string[] = [];
+    for (const token of tokens) (haystack.includes(token) ? found : missing).push(token);
+    return { total: tokens.length, found, missing, footer: footerFor(found, missing) };
+  } catch {
+    return { total: 0, found: [], missing: [], footer: "Evidence: check unavailable" };
+  }
+}

package/src/hooks/ts/lib/worker-session.test.ts

@@ -0,0 +1,24 @@
+import { describe, it, expect } from "vitest";
+import { isWorkerSession } from "./worker-session.js";
+
+describe("isWorkerSession", () => {
+  it("is true only for the exact launcher mark PAI_WORKER=1", () => {
+    expect(isWorkerSession({ PAI_WORKER: "1" })).toBe(true);
+    expect(isWorkerSession({ PAI_WORKER: "true" })).toBe(false);
+    expect(isWorkerSession({ PAI_WORKER: "" })).toBe(false);
+    expect(isWorkerSession({})).toBe(false);
+  });
+
+  it("reads process.env by default", () => {
+    const prev = process.env.PAI_WORKER;
+    try {
+      process.env.PAI_WORKER = "1";
+      expect(isWorkerSession()).toBe(true);
+      delete process.env.PAI_WORKER;
+      expect(isWorkerSession()).toBe(false);
+    } finally {
+      if (prev === undefined) delete process.env.PAI_WORKER;
+      else process.env.PAI_WORKER = prev;
+    }
+  });
+});

package/src/hooks/ts/lib/worker-session.ts

@@ -0,0 +1,23 @@
+/**
+ * Worker-session detection.
+ *
+ * A disposable headless worker (a `claude -p` run started by an orchestrating
+ * session, possibly against a different model provider with a different
+ * context window) shares the project directory and the hook configuration
+ * with the real session that spawned it. Left alone, the hooks treat it as a
+ * session in its own right: they inject project context into it, create and
+ * rename a numbered session note for it, autosave it, and enqueue a
+ * model-written handover for it. Its compactions also land in the project's
+ * transcript folder, where they are indistinguishable from a real session's
+ * and drag the measured compaction trigger down (observed 2026-09-17: two
+ * workers compacting at ~151k tokens pulled a project's trigger from ~784k
+ * to ~151k, and the real session's handover fired at ~50k tokens).
+ *
+ * The launcher marks such sessions with `PAI_WORKER=1`. Every hook that does
+ * per-session bookkeeping returns immediately when this predicate is true.
+ * Deliberately NOT guarded: the security validator (a worker's shell
+ * commands must still be checked) and observability capture.
+ */
+export function isWorkerSession(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.PAI_WORKER === "1";
+}

package/src/hooks/ts/post-tool-use/sync-todo-to-md.ts

@@ -10,6 +10,7 @@
  * IMPORTANT: This hook PRESERVES user content. It only updates "Current Session".
  */
 
+import { isWorkerSession } from "../lib/worker-session.js";
 import { writeFileSync, existsSync, readFileSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import {
@@ -131,6 +132,7 @@ ${formatSessionTodos(todos)}`;
 }
 
 async function main() {
+  if (isWorkerSession()) return; // disposable worker: no per-session bookkeeping
   try {
     const chunks: Buffer[] = [];
     for await (const chunk of process.stdin) {

package/src/hooks/ts/post-tool-use/update-tab-on-action.ts

@@ -7,6 +7,7 @@
  * PAI-safe: No sensitive data, just tool descriptions
  */
 
+import { isWorkerSession } from "../lib/worker-session.js";
 import { execSync } from 'child_process';
 
 // Action tools that warrant a tab title update
@@ -122,6 +123,7 @@ function generateTitle(toolName: string, input: HookInput['tool_input']): string
 }
 
 async function main() {
+  if (isWorkerSession()) return; // disposable worker: no per-session bookkeeping
   try {
     const input = await readStdinWithTimeout();
     const data: HookInput = JSON.parse(input);

package/src/hooks/ts/pre-compact/context-compression-hook.ts

@@ -13,6 +13,7 @@
  * and work items from earlier in the session.
  */
 
+import { isWorkerSession } from "../lib/worker-session.js";
 import { existsSync, readFileSync, writeFileSync } from 'fs';
 import { basename, dirname, join } from 'path';
 import { tmpdir } from 'os';
@@ -34,6 +35,7 @@ import {
 import { getContextFill, formatContextFill } from '../lib/context-fill.js';
 import { contentToText, isNoiseFilePath, preferCwdFiles } from '../lib/transcript-text.js';
 import { readContextHandoverCache } from '../lib/context-handover-cache.js';
+import { bindHandoverEvidence } from '../lib/handover-evidence.js';
 
 interface HookInput {
   session_id: string;
@@ -515,6 +517,7 @@ function enqueueSessionSummary(payload: {
 // ---------------------------------------------------------------------------
 
 async function main() {
+  if (isWorkerSession()) return; // disposable worker: no per-session bookkeeping
   // Skip probe/health-check sessions (e.g. CodexBar ClaudeProbe)
   if (isProbeSession()) {
     process.exit(0);
@@ -714,11 +717,13 @@ async function main() {
       // -------------------------------------------------------------------
       let sourceLabel: string;
       let handoverBlock: string;
+      let handoverSummary: string | null = null;
       try {
         const cachedHandover = readContextHandoverCache(hookInput.session_id);
         const handoverIsFresh =
           cachedHandover !== null &&
           (!previousCompactionAt || new Date(cachedHandover.generatedAt) > new Date(previousCompactionAt));
+        handoverSummary = handoverIsFresh ? cachedHandover!.summary : null;
 
         sourceLabel = handoverIsFresh
           ? `model-written handover (${cachedHandover!.model}, generated ${cachedHandover!.generatedAt}, ` +
@@ -739,6 +744,18 @@ async function main() {
         handoverBlock = '';
       }
 
+      // Evidence binding: which of the handover's identifiers the transcript
+      // actually contains. One footer line, content untouched; its own
+      // failure changes nothing else about the injection.
+      if (handoverSummary !== null && typeof hookInput.transcript_path === 'string') {
+        try {
+          const evidence = bindHandoverEvidence(handoverSummary, null, [hookInput.transcript_path]);
+          handoverBlock += `\n${evidence.footer}`;
+        } catch (err) {
+          console.error(`Evidence check skipped: ${err}`);
+        }
+      }
+
       const injection = [
         '<system-reminder>',
         `SESSION STATE RECOVERED AFTER COMPACTION (${compactType}, ~${tokenDisplay} tokens)`,

package/src/hooks/ts/pre-tool-use/route-agents-to-worker.ts

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+
+/**
+ * route-agents-to-worker.ts — PreToolUse hook on the Agent tool.
+ *
+ * Denies every in-process subagent when worker providers are configured, so no
+ * worker ever runs on Anthropic. The deny reason tells the orchestrator how to
+ * delegate through `pai worker run` instead — same idea as the old
+ * route-agents-to-glm.sh, but provider-neutral and ledgered in the workers
+ * log dir.
+ *
+ * Allows (and does not touch) when:
+ *   - the tool is not the Agent tool (this hook is Agent-matched, but stay safe)
+ *   - ALLOW_ANTHROPIC_AGENTS=1 is in the environment (one-session bypass)
+ *   - workers are off or no provider is configured
+ *
+ * Every decision is appended to the routing ledger read by `pai worker log`.
+ */
+
+import { readWorkersSection } from "../../../workers/config.js";
+import { workersLogDir, ledgerPath } from "../../../workers/paths.js";
+import { appendLedger } from "../../../workers/ledger.js";
+
+interface HookInput {
+  session_id?: string;
+  cwd?: string;
+  tool_name?: string;
+  tool_input?: { description?: string; prompt?: string; subagent_type?: string } | string;
+}
+
+const ALLOW = JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow" } });
+
+function deny(reason: string): string {
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  });
+}
+
+function shortLabel(input: HookInput): string {
+  const desc =
+    typeof input.tool_input === "object" && input.tool_input !== null
+      ? input.tool_input.description ?? ""
+      : "";
+  return desc.replace(/\s+/g, " ").trim().slice(0, 60);
+}
+
+async function main(): Promise<void> {
+  let text = "";
+  try {
+    for await (const chunk of process.stdin) text += chunk;
+  } catch {
+    process.stdout.write(ALLOW);
+    return;
+  }
+  if (!text.trim()) {
+    process.stdout.write(ALLOW);
+    return;
+  }
+
+  let input: HookInput;
+  try {
+    input = JSON.parse(text) as HookInput;
+  } catch {
+    process.stdout.write(ALLOW);
+    return;
+  }
+
+  if (input.tool_name && input.tool_name !== "Agent") {
+    process.stdout.write(ALLOW);
+    return;
+  }
+
+  const label = shortLabel(input);
+  const cwd = input.cwd ?? process.cwd();
+
+  const ledger = (event: string): void => {
+    try {
+      appendLedger(ledgerPath(workersLogDir(readWorkersSection().workers)), event, {
+        cwd,
+        ...(label ? { label } : {}),
+      });
+    } catch {
+      // no config / no log dir yet — the decision below still stands
+    }
+  };
+
+  if (process.env.ALLOW_ANTHROPIC_AGENTS === "1") {
+    ledger("ALLOWED-ANTHROPIC-AGENT");
+    process.stdout.write(ALLOW);
+    return;
+  }
+
+  let workers: ReturnType<typeof readWorkersSection>["workers"];
+  try {
+    workers = readWorkersSection().workers;
+  } catch {
+    // broken workers config must not break the session
+    process.stdout.write(ALLOW);
+    return;
+  }
+  if (!workers.enabled || Object.keys(workers.providers).length === 0) {
+    process.stdout.write(ALLOW);
+    return;
+  }
+
+  ledger("DENIED-ANTHROPIC-AGENT");
+  process.stdout.write(
+    deny(
+      "Agent tool is disabled: subagents run on the configured worker provider, not Anthropic. " +
+        "Delegate with Bash instead, in the background:\n\n" +
+        `pai worker run --label "${label || "task"}" --role research -p '<full, self-contained task spec>' ` +
+        "--allowedTools 'Read,Edit,Write,Bash,Grep,Glob' --output-format json\n\n" +
+        "- Run it with run_in_background: true and always with a timeout.\n" +
+        "- Use --role spotcheck (or implement) as the task demands.\n" +
+        "- Web research: add WebSearch,WebFetch to --allowedTools.\n" +
+        "- The answer is in the `result` field of the JSON it prints. Review the diff yourself.\n" +
+        "- pai worker ps lists running workers; pai worker follow <id> shows one live.\n" +
+        "Keep only orchestration, review and synthesis in this session. " +
+        "To run subagents on Anthropic for one session: start it with ALLOW_ANTHROPIC_AGENTS=1."
+    )
+  );
+}
+
+main().catch(() => process.stdout.write(ALLOW));

package/src/hooks/ts/session-start/initialize-session.ts

@@ -20,6 +20,7 @@
  *    initialize-session.ts, load-core-context.ts, load-project-context.ts
  */
 
+import { isWorkerSession } from "../lib/worker-session.js";
 import { existsSync, statSync, readFileSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
@@ -99,6 +100,7 @@ async function testStopHook() {
 }
 
 async function main() {
+  if (isWorkerSession()) return; // disposable worker: no per-session bookkeeping
   try {
     // Check if this is a subagent session - if so, exit silently
     const claudeProjectDir = process.env.CLAUDE_PROJECT_DIR || '';

package/src/hooks/ts/session-start/load-core-context.ts

@@ -25,12 +25,14 @@
  * - Gives your AI immediate access to your complete personal context
  */
 
+import { isWorkerSession } from "../lib/worker-session.js";
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
 import { PAI_DIR, SKILLS_DIR } from '../lib/pai-paths';
 import { isProbeSession } from '../lib/project-utils';
 
 async function main() {
+  if (isWorkerSession()) return; // disposable worker: no per-session bookkeeping
   try {
     // Check if this is a subagent session - if so, exit silently
     const claudeProjectDir = process.env.CLAUDE_PROJECT_DIR || '';

package/src/hooks/ts/session-start/load-project-context.ts

@@ -16,6 +16,7 @@
  * - Sending ntfy.sh notifications
  */
 
+import { isWorkerSession } from "../lib/worker-session.js";
 import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, basename, dirname, resolve } from 'path';
 import { homedir } from 'os';
@@ -141,6 +142,7 @@ interface HookInput {
 }
 
 async function main() {
+  if (isWorkerSession()) return; // disposable worker: no per-session bookkeeping
   console.error('\nload-project-context.ts starting...');
 
   // Skip probe/health-check sessions (e.g. CodexBar ClaudeProbe)

package/src/hooks/ts/session-start/post-compact-inject.ts

@@ -16,6 +16,7 @@
  *   SessionStart(compact) → THIS HOOK reads that file → stdout → context
  */
 
+import { isWorkerSession } from "../lib/worker-session.js";
 import { readFileSync, existsSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
@@ -30,6 +31,7 @@ interface HookInput {
 }
 
 async function main() {
+  if (isWorkerSession()) return; // disposable worker: no per-session bookkeeping
   let hookInput: HookInput | null = null;
 
   try {

package/src/hooks/ts/stop/stop-hook.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import { isWorkerSession } from "../lib/worker-session.js";
 import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from 'fs';
 import { join, basename, dirname } from 'path';
 import { connect } from 'net';
@@ -704,6 +705,7 @@ function debug(msg: string): void {
 }
 
 async function main() {
+  if (isWorkerSession()) return; // disposable worker: no per-session bookkeeping
   if (isProbeSession()) {
     process.exit(0);
   }