@webpresso/agent-kit 3.1.26 → 3.1.30

package/dist/esm/hooks/doctor.js

@@ -1790,6 +1790,61 @@ export function checkProjectMcpPins(cwd = process.cwd(), deps = {}) {
             : `${parsed.definitions.length} exact-pinned vp dlx server(s) validated`,
     };
 }
+/**
+ * `claude-mcp-duplicate-registration` — advisory. A machine can register the
+ * webpresso MCP server twice for the same Claude Code session: a manual
+ * `claude mcp add webpresso` entry in `~/.claude.json` (user scope or a
+ * project scope) plus the agent-kit marketplace plugin's bundled server
+ * (plugin cache under `~/.claude/plugins/`). Both spawn `wp mcp`, so affected
+ * sessions run two server processes and carry a duplicated wp_* tool list.
+ * Degrades to ok on missing/unreadable config — loud only on real duplication.
+ */
+export function checkClaudeMcpDuplicateRegistration(options = {}) {
+    const name = "claude MCP duplicate registration";
+    const home = options.home ?? homedir();
+    const exists = options.exists ?? existsSync;
+    const readFile = options.readFile ?? ((candidate) => readFileSync(candidate, "utf8"));
+    const pluginCacheDir = join(home, ".claude", "plugins", "cache", "webpresso", "agent-kit");
+    if (!exists(pluginCacheDir)) {
+        return { name, ok: true, detail: "skipped (agent-kit Claude plugin not installed)" };
+    }
+    const claudeJsonPath = join(home, ".claude.json");
+    if (!exists(claudeJsonPath)) {
+        return { name, ok: true, detail: "skipped (no ~/.claude.json)" };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFile(claudeJsonPath));
+    }
+    catch {
+        return { name, ok: true, detail: "skipped (~/.claude.json unreadable)" };
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        return { name, ok: true, detail: "skipped (~/.claude.json is not an object)" };
+    }
+    const config = parsed;
+    const manualSources = [];
+    if (config.mcpServers && "webpresso" in config.mcpServers) {
+        manualSources.push("user scope");
+    }
+    for (const [projectDir, project] of Object.entries(config.projects ?? {})) {
+        if (project?.mcpServers && "webpresso" in project.mcpServers) {
+            manualSources.push(`project scope ${projectDir}`);
+        }
+    }
+    if (manualSources.length === 0) {
+        return { name, ok: true, detail: "plugin-scoped registration only" };
+    }
+    return {
+        name,
+        ok: false,
+        advisory: true,
+        detail: `the agent-kit Claude plugin bundles the webpresso MCP server, but ~/.claude.json also ` +
+            `registers "webpresso" manually (${manualSources.join(", ")}). Affected sessions run two ` +
+            `wp mcp processes with a duplicated wp_* tool list. Remove the manual entry: ` +
+            `claude mcp remove webpresso (run inside the project directory for project-scope entries).`,
+    };
+}
 const QUOTED_TOML_STRING = /"((?:[^"\\]|\\.)*)"/gu;
 const DANGLING_SYMLINK_SCAN_DEPTH = 3;
 function collectDanglingWorktreePaths(raw, worktreesRoot, exists, alreadyReported) {
@@ -1994,6 +2049,7 @@ export async function runHooksDoctor(opts = {}) {
         checks.push(checkCodexConfigKeys());
     }
     checks.push(checkProjectMcpPins(opts.cwd));
+    checks.push(checkClaudeMcpDuplicateRegistration());
     checks.push({ advisory: true, ...checkDanglingHostPaths() });
     checks.push({ advisory: true, ...checkRootLauncherContract() });
     checks.push({ advisory: true, ...checkNativePluginRuntime() });

package/dist/esm/hooks/guard-switch/index.js

@@ -6,9 +6,10 @@ import { isDirectEntrypoint } from "#hooks/shared/direct-entrypoint";
 import { runHook } from "#hooks/shared/hook-bootstrap";
 import { resolveHookProjectDir } from "#hooks/shared/project-dir.js";
 import { createManagedHookExecutionContext, reportSessionMemoryHookDegradation, sessionMemoryHookStoreOptions, } from "#hooks/shared/session-memory-deadline.js";
+import { resolveHookSessionId } from "#hooks/shared/types.js";
 import { getSurfacePath, NotInGitRepoError } from "#paths/state-root.js";
 import { buildContinuityEvent, buildPromptContinuityEvents } from "#session-memory/hook-capture.js";
-import { repoHashFromRoot } from "#session-memory/repo-hash.js";
+import { computeRepoHash, repoHashFromRoot } from "#session-memory/repo-hash.js";
 import { SessionMemorySessionStore, } from "#session-memory/session.js";
 import { classifyPromptRoutingIntent, } from "#hooks/prompt-routing";
 import { setActivePromptRouting, setGuardEnabled } from "./state.js";
@@ -67,13 +68,15 @@ function capturePromptContinuity(input, projectDir, env, deps, routing) {
     const store = deps.createStore?.(dbPath, deps.storeOptions) ??
         new SessionMemorySessionStore(dbPath, deps.storeOptions);
     try {
-        const repoHash = deps.repoHash?.(projectDir) ?? repoHashFromRoot(projectDir);
+        // Match readCurrentSessionId hashing (computeRepoHash), not path-only.
+        const repoHash = deps.repoHash?.(projectDir) ?? computeRepoHash(projectDir);
         const timestamp = (deps.now?.() ?? new Date()).toISOString();
+        const sessionId = resolveHookSessionId(input, env);
         for (const event of events) {
             store.captureEvent({
                 repoHash,
                 agentId: input.agent_id ?? input.agent_type ?? "UserPromptSubmit",
-                ...(input.session_id === undefined ? {} : { sessionId: input.session_id }),
+                ...(sessionId === undefined ? {} : { sessionId }),
                 event: {
                     ...event,
                     ts: timestamp,
@@ -124,13 +127,14 @@ export function processGuardSwitchInput(inputValue, cwd, env = process.env, deps
             reason: "🛡️ Guard enabled — pretool validators active",
         };
     }
+    const routingSessionId = resolveHookSessionId(input, env);
     const routing = normalized.length === 0
         ? null
         : {
             intent: deps.classifyPromptRoutingIntent?.(normalized) ??
                 classifyPromptRoutingIntent(normalized),
             updatedAt: (deps.now?.() ?? new Date()).toISOString(),
-            ...(input.session_id === undefined ? {} : { sessionId: input.session_id }),
+            ...(routingSessionId === undefined ? {} : { sessionId: routingSessionId }),
             ...(input.turn_id === undefined ? {} : { turnId: input.turn_id }),
         };
     if (routing !== null) {

package/dist/esm/hooks/post-tool/lint-after-edit.js

@@ -5,11 +5,11 @@ import { tmpdir } from "node:os";
 import { runHook } from "#hooks/shared/hook-bootstrap";
 import { resolveHookProjectDir } from "#hooks/shared/project-dir.js";
 import { createManagedHookExecutionContext, reportSessionMemoryHookDegradation, sessionMemoryHookStoreOptions, } from "#hooks/shared/session-memory-deadline.js";
-import { getCommand, getContent, getFilePath, isBashInput, isFileEditInput, isFileReadInput, isFileWriteInput, } from "#hooks/shared/types";
+import { getCommand, getContent, getFilePath, isBashInput, isFileEditInput, isFileReadInput, isFileWriteInput, resolveHookSessionId, } from "#hooks/shared/types";
 import { isDirectEntrypoint } from "#hooks/shared/direct-entrypoint";
 import { getSurfacePath, NotInGitRepoError } from "#paths/state-root.js";
 import { buildContinuityEvent } from "#session-memory/hook-capture.js";
-import { repoHashFromRoot } from "#session-memory/repo-hash.js";
+import { computeRepoHash, repoHashFromRoot } from "#session-memory/repo-hash.js";
 import { SessionMemorySessionStore, } from "#session-memory/session.js";
 export const LINTABLE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".json", ".css"];
 export const DEFAULT_MAX_CAPTURE_BYTES = 2048;
@@ -116,7 +116,8 @@ export function capturePostToolUse(input, projectDir, env = process.env, deps =
         const store = deps.createStore?.(dbPath, deps.storeOptions) ??
             new SessionMemorySessionStore(dbPath, deps.storeOptions);
         try {
-            const repoHash = deps.repoHash?.(projectDir) ?? repoHashFromRoot(projectDir);
+            // Match readCurrentSessionId hashing (computeRepoHash), not path-only.
+            const repoHash = deps.repoHash?.(projectDir) ?? computeRepoHash(projectDir);
             const event = buildContinuityEvent({
                 eventType,
                 toolName: input.tool_name ?? "PostToolUse",
@@ -131,10 +132,11 @@ export function capturePostToolUse(input, projectDir, env = process.env, deps =
                 },
                 maxContentBytes: DEFAULT_MAX_CAPTURE_BYTES,
             });
+            const sessionId = resolveHookSessionId(input, env);
             store.captureEvent({
                 repoHash,
                 agentId: input.tool_name ?? "default",
-                ...(input.session_id === undefined ? {} : { sessionId: input.session_id }),
+                ...(sessionId === undefined ? {} : { sessionId }),
                 event: { ...event, ts: (deps.now?.() ?? new Date()).toISOString() },
             });
             return true;

package/dist/esm/hooks/precompact/index.js

@@ -6,9 +6,10 @@ import { isDirectEntrypoint } from "#hooks/shared/direct-entrypoint";
 import { runHook } from "#hooks/shared/hook-bootstrap";
 import { resolveHookProjectDir } from "#hooks/shared/project-dir.js";
 import { createManagedHookExecutionContext, reportSessionMemoryHookDegradation, sessionMemoryHookStoreOptions, } from "#hooks/shared/session-memory-deadline.js";
+import { resolveHookSessionId } from "#hooks/shared/types.js";
 import { getSurfacePath, NotInGitRepoError } from "#paths/state-root.js";
 import { buildContinuityEvent } from "#session-memory/hook-capture.js";
-import { repoHashFromRoot } from "#session-memory/repo-hash.js";
+import { computeRepoHash, repoHashFromRoot } from "#session-memory/repo-hash.js";
 import { SessionMemorySessionStore, } from "#session-memory/session.js";
 export const DEFAULT_MAX_SNAPSHOT_BYTES = 32 * 1024;
 export const DEFAULT_MAX_EVENT_BYTES = 2 * 1024;
@@ -61,14 +62,15 @@ export function buildOutput(inputValue, cwd, env, deps = {}) {
     try {
         const input = normalizeInput(inputValue);
         const projectDir = resolveHookProjectDir(input, cwd, env);
-        const repoHash = deps.repoHash?.(projectDir) ?? repoHashFromRoot(projectDir);
+        // Match readCurrentSessionId hashing (computeRepoHash), not path-only.
+        const repoHash = deps.repoHash?.(projectDir) ?? computeRepoHash(projectDir);
         const dbPath = deps.dbPath ?? resolveSessionMemoryDbPath(projectDir, env);
         mkdirSync(dirname(dbPath), { recursive: true });
         const store = deps.createStore?.(dbPath, deps.storeOptions) ??
             new SessionMemorySessionStore(dbPath, deps.storeOptions);
         try {
             const agentId = input.agent_id ?? input.agent_type ?? "default";
-            const sessionId = input.session_id;
+            const sessionId = resolveHookSessionId(input, env);
             const timestamp = (deps.now?.() ?? new Date()).toISOString();
             const boundary = buildContinuityEvent({
                 eventType: "compaction_boundary",

package/dist/esm/hooks/pretool-guard/validators/forbidden-commands.js

@@ -371,7 +371,7 @@ function findWpAuditRedirect(command) {
     for (const variant of getCommandVariants(command)) {
         const kind = WP_AUDIT_RE.exec(variant)?.[1];
         if (kind === "guardrails") {
-            return `"${variant}" denied — use the MCP batch audit tool: mcp__webpresso__wp_audits(preset="guardrails"). Returns aggregate structured, summary-first results.`;
+            return `"${variant}" denied — use the webpresso MCP batch audit tool: wp_audits(preset="guardrails"). Returns aggregate structured, summary-first results.`;
         }
         if (!kind || !AUDIT_KIND_SET.has(kind))
             continue;
@@ -381,11 +381,11 @@ function findWpAuditRedirect(command) {
             knownKinds.push(kind);
     }
     if (knownKinds.length > 1) {
-        return `Multiple wp audit commands denied — use the MCP batch audit tool: mcp__webpresso__wp_audits(kinds=[${knownKinds.map((kind) => `"${kind}"`).join(", ")}]). Returns aggregate structured, summary-first results.`;
+        return `Multiple wp audit commands denied — use the webpresso MCP batch audit tool: wp_audits(kinds=[${knownKinds.map((kind) => `"${kind}"`).join(", ")}]). Returns aggregate structured, summary-first results.`;
     }
     const kind = knownKinds[0];
     if (kind && firstKnownVariant) {
-        return `"${firstKnownVariant}" denied — use the MCP audit tool: mcp__webpresso__wp_audit(kind="${kind}"). Returns structured, summary-first results.`;
+        return `"${firstKnownVariant}" denied — use the webpresso MCP audit tool: wp_audit(kind="${kind}"). Returns structured, summary-first results.`;
     }
     return undefined;
 }
@@ -402,7 +402,7 @@ function findScriptRouteRedirect(command, routes) {
             process.stderr.write(`[forbidden-commands] guard.scriptRoutes["${script}"] -> "${kind}" is not a known audit kind; ignoring\n`);
             continue;
         }
-        return `"${variant}" denied — this repo routes \`${script}\` to an audit: mcp__webpresso__wp_audit(kind="${kind}").`;
+        return `"${variant}" denied — this repo routes \`${script}\` to an audit: use the webpresso MCP tool wp_audit(kind="${kind}").`;
     }
     return undefined;
 }

package/dist/esm/hooks/pretool-guard/validators/mcp-redirect.d.ts

@@ -1,6 +1,5 @@
 import type { CommandCategory } from "./forbidden-commands.js";
 export interface MCPRedirectConfig {
-    serverName?: string;
     toolPrefix?: string;
 }
 export interface MCPRedirectContext {

package/dist/esm/hooks/pretool-guard/validators/mcp-redirect.js

@@ -1,5 +1,4 @@
 import { isMcpReady } from "#hooks/shared/mcp-sentinel";
-const DEFAULT_SERVER_NAME = "webpresso";
 const DEFAULT_TOOL_PREFIX = "wp_";
 let cachedDefaultMcpReady;
 export function resetMcpReadyCache() {
@@ -22,7 +21,6 @@ export function resolveMcpReady(value) {
 }
 export function resolveMcpConfig(mcp) {
     return {
-        serverName: mcp?.serverName?.trim() || DEFAULT_SERVER_NAME,
         toolPrefix: mcp?.toolPrefix?.trim() || DEFAULT_TOOL_PREFIX,
     };
 }
@@ -50,10 +48,15 @@ export function buildRedirectMessage(ctx) {
     if (!resolveMcpReady(ctx.mcpReady)) {
         return `"${ctx.command}" denied — MCP not ready. Use: ${fallbackHint}`;
     }
-    const { serverName, toolPrefix } = resolveMcpConfig(ctx.mcp);
-    const toolMatchers = toolSuffixesForCategory(ctx.category).map((suffix) => `mcp__${serverName}__${toolPrefix}${suffix}(...)`);
+    // Suffix-only tool names: hosts register the webpresso MCP server under
+    // different prefixes (manual `mcp__webpresso__*` vs plugin-scoped
+    // `mcp__plugin_agent-kit_webpresso__*`), so a hardcoded full name resolves in
+    // some sessions and dangles in others. The `wp_<suffix>` identity is stable
+    // across every registration shape.
+    const { toolPrefix } = resolveMcpConfig(ctx.mcp);
+    const toolMatchers = toolSuffixesForCategory(ctx.category).map((suffix) => `${toolPrefix}${suffix}(...)`);
     return [
-        `"${ctx.command}" denied — use wp MCP tool:`,
+        `"${ctx.command}" denied — use the webpresso MCP tool:`,
         ...toolMatchers.map((matcher) => `  ${matcher}`),
         "Returns structured, summary-first results. Raw output is clipped; overflow may include a log path for deeper investigation.",
         `Fallback if MCP unavailable: ${fallbackHint}`,

package/dist/esm/hooks/pretool-guard/validators/worktree-discipline.d.ts

@@ -17,13 +17,15 @@ import type { ToolInput, ValidationResult } from "#hooks/shared/types";
  *  effective cwd elsewhere (e.g. CI)        → ALLOW (rule scoped to local ~/repos primaries)
  * ```
  *
- * The "effective cwd" is the tool's ambient `input.cwd`, lowered only by a
- * success-gated cwd chain that directly governs the forbidden git op, e.g.
- * `cd <worktree> && git commit` or `(cd <worktree> && git commit)`, then by
- * EVERY `git -C <dir>` flag on the matched invocation (git applies them
- * cumulatively). Unsupported cwd-changing control flow, option-bearing `cd`,
- * `cd -`, or unresolvable `cd`/`-C` targets fail closed because they could hide
- * a primary-checkout mutation. Prefer `git -C <worktree> ...` or running the
+ * The "effective cwd" is the tool's ambient `input.cwd`, lowered by a
+ * success-gated `&&` chain that governs the forbidden git op, e.g.
+ * `cd <worktree> && git commit`, `cd <worktree> && ./bin/wp … && git commit`,
+ * or `(cd <worktree> && git commit)`, then by EVERY `git -C <dir>` flag on the
+ * matched invocation (git applies them cumulatively). Intermediate non-cwd
+ * commands after a proven `cd` leave the chain cwd unchanged. Unsupported
+ * control flow (`;` / `|` / braces), option-bearing `cd`, `cd -`, or
+ * unresolvable `cd`/`-C` targets fail closed because they could hide a
+ * primary-checkout mutation. Prefer `git -C <worktree> ...` or running the
  * command with the tool cwd already set to the worktree.
  *
  * Known best-effort limits (acceptable for an agent guard with a documented

package/dist/esm/hooks/pretool-guard/validators/worktree-discipline.js

@@ -25,13 +25,15 @@ const VALIDATOR_NAME = "worktree-discipline";
  *  effective cwd elsewhere (e.g. CI)        → ALLOW (rule scoped to local ~/repos primaries)
  * ```
  *
- * The "effective cwd" is the tool's ambient `input.cwd`, lowered only by a
- * success-gated cwd chain that directly governs the forbidden git op, e.g.
- * `cd <worktree> && git commit` or `(cd <worktree> && git commit)`, then by
- * EVERY `git -C <dir>` flag on the matched invocation (git applies them
- * cumulatively). Unsupported cwd-changing control flow, option-bearing `cd`,
- * `cd -`, or unresolvable `cd`/`-C` targets fail closed because they could hide
- * a primary-checkout mutation. Prefer `git -C <worktree> ...` or running the
+ * The "effective cwd" is the tool's ambient `input.cwd`, lowered by a
+ * success-gated `&&` chain that governs the forbidden git op, e.g.
+ * `cd <worktree> && git commit`, `cd <worktree> && ./bin/wp … && git commit`,
+ * or `(cd <worktree> && git commit)`, then by EVERY `git -C <dir>` flag on the
+ * matched invocation (git applies them cumulatively). Intermediate non-cwd
+ * commands after a proven `cd` leave the chain cwd unchanged. Unsupported
+ * control flow (`;` / `|` / braces), option-bearing `cd`, `cd -`, or
+ * unresolvable `cd`/`-C` targets fail closed because they could hide a
+ * primary-checkout mutation. Prefer `git -C <worktree> ...` or running the
  * command with the tool cwd already set to the worktree.
  *
  * Known best-effort limits (acceptable for an agent guard with a documented
@@ -634,12 +636,13 @@ const DIR_TOKEN = String.raw `(?:"[^"]+"|'[^']+'|[^\s;&|(){}]+)`;
 const QUOTED_ARG = String.raw `(?:"[^"]+"|'[^']+'|\S+)`;
 const CD_TARGET = String.raw `(?:--\s+)?(${DIR_TOKEN}|-)`;
 const CD_LEADER = String.raw `(?:[A-Za-z_]\w*=\S*\s+)*(?:command\s+|builtin\s+)?(?:cd|pushd)\s+`;
-// A success-gated cwd chain that directly governs the forbidden git op. We only
-// trust cwd changes in this shape; `;`, `||`, skipped/failed `cd`, quoted spoof
-// text, and other unsupported shell control flow fail closed instead.
+// Pure cd/pushd segment that updates the success-gated cwd (optional leading env /
+// command|builtin wrapper). Trailing whitespace is allowed; nothing else.
+const PURE_CD_SEGMENT = new RegExp(String.raw `^\s*${CD_LEADER}${CD_TARGET}\s*$`, "u");
+// Legacy pure trailing-cd chain (also used for subshell-local `(cd X && git …)`).
 const CD_CHAIN = new RegExp(String.raw `(?:^|[;&|(){}]\s*)?((?:\s*${CD_LEADER}${CD_TARGET}\s*&&)+)\s*$`, "u");
 const CD_IN_CHAIN = new RegExp(String.raw `(?:^|&&)\s*${CD_LEADER}${CD_TARGET}\s*(?=&&)`, "gu");
-const CWD_WORD = new RegExp(String.raw `(?:^|[;{}()&|]\s*|\s+)(?:[A-Za-z_]\w*=\S*\s+)*(?:command\s+|builtin\s+)?(?:cd|pushd)\b`, "gu");
+const CWD_WORD = new RegExp(String.raw `(?:^|[;{}()&|]\s*|\s+)(?:[A-Za-z_]\w*=\S*\s+)*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)\b`, "gu");
 const DASH_C = new RegExp(String.raw `-C\s+(${DIR_TOKEN})`, "gu");
 function isInsideSingleOrDoubleQuotes(command, index) {
     let quote = null;
@@ -667,6 +670,27 @@ function hasUnquotedCwdCommand(command) {
     }
     return false;
 }
+/** True when unquoted `;` `|` `{` `}` appear (breaks a pure `&&` agent chain). */
+function hasUnquotedUnsafeAndChainControl(command) {
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (ch !== ";" && ch !== "|" && ch !== "{" && ch !== "}" && ch !== "\n")
+            continue;
+        if (!isInsideSingleOrDoubleQuotes(command, i))
+            return true;
+    }
+    return false;
+}
+function hasUnquotedParen(command) {
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (ch !== "(" && ch !== ")")
+            continue;
+        if (!isInsideSingleOrDoubleQuotes(command, i))
+            return true;
+    }
+    return false;
+}
 /** Apply one dir token to `cwd`, or signal ambiguity if it cannot be statically resolved. */
 function applyDir(token, cwd) {
     if (!token)
@@ -683,11 +707,85 @@ function isTrustedCwdChainStart(commandPrefix, chainStart) {
     const before = commandPrefix.slice(0, chainStart).trimEnd();
     return before.endsWith("&&") || before.endsWith("(") || before.endsWith("{");
 }
-function applySuccessGatedCwdChain(commandPrefix, baseCwd) {
+/**
+ * Split a pure `&&` command prefix into segments. Returns null when the prefix
+ * uses `;` / `|` / braces / newlines we refuse to model.
+ */
+function splitSuccessGatedAndSegments(commandPrefix) {
+    if (!commandPrefix.trim())
+        return [];
+    if (hasUnquotedUnsafeAndChainControl(commandPrefix))
+        return null;
+    const segments = [];
+    let current = "";
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < commandPrefix.length; i += 1) {
+        const ch = commandPrefix[i] ?? "";
+        if (escaped) {
+            current += ch;
+            escaped = false;
+            continue;
+        }
+        if (quote !== "'" && ch === "\\") {
+            escaped = true;
+            current += ch;
+            continue;
+        }
+        if ((ch === '"' || ch === "'") && (quote === null || quote === ch)) {
+            quote = quote === ch ? null : ch;
+            current += ch;
+            continue;
+        }
+        if (!quote && ch === "&" && commandPrefix[i + 1] === "&") {
+            if (current.trim())
+                segments.push(current);
+            current = "";
+            i += 1;
+            continue;
+        }
+        current += ch;
+    }
+    if (quote || escaped)
+        return null;
+    if (current.trim())
+        segments.push(current);
+    return segments;
+}
+/**
+ * Walk pure `&&` segments: resolvable cd/pushd updates cwd; other segments must
+ * not smuggle unquoted cwd changes. Enables
+ * `cd <managed-worktree> && ./bin/wp … && git commit`.
+ */
+function applyAndSegmentCwdChain(commandPrefix, baseCwd) {
+    const segments = splitSuccessGatedAndSegments(commandPrefix);
+    if (segments === null)
+        return { ambiguous: true };
+    if (segments.length === 0)
+        return { ambiguous: false, cwd: baseCwd };
+    let cwd = baseCwd;
+    for (const segment of segments) {
+        const pureCd = PURE_CD_SEGMENT.exec(segment);
+        if (pureCd) {
+            const next = applyDir(pureCd[1], cwd);
+            if (next === "ambiguous")
+                return { ambiguous: true };
+            cwd = next.cwd;
+            continue;
+        }
+        if (hasUnquotedCwdCommand(segment))
+            return { ambiguous: true };
+    }
+    return { ambiguous: false, cwd };
+}
+/**
+ * Legacy trailing pure-cd chain (and subshell-local `(cd X && git …)` forms).
+ * Kept for paren-scoped ops; intermediate non-cd commands are handled by
+ * {@link applyAndSegmentCwdChain} when no unquoted parens are present.
+ */
+function applyLegacyTrailingCdChain(commandPrefix, baseCwd) {
     const chain = CD_CHAIN.exec(commandPrefix);
     const chainStart = chain?.index ?? commandPrefix.length;
-    // If there is any other unquoted cwd-changing syntax before this simple chain,
-    // we cannot prove the chain governs the op. Fail closed.
     if (hasUnquotedCwdCommand(commandPrefix.slice(0, chainStart)))
         return { ambiguous: true };
     if (!chain)
@@ -703,6 +801,20 @@ function applySuccessGatedCwdChain(commandPrefix, baseCwd) {
     }
     return { ambiguous: false, cwd };
 }
+/**
+ * Success-gated cwd chain for a forbidden git op's command prefix.
+ *
+ * Prefer the `&&`-segment walk when the prefix has no unquoted parentheses so
+ * agents can run tools between a managed `cd` and a mutation. When parentheses
+ * appear (subshell-local ops), fall back to the legacy trailing-cd chain so
+ * non-persistent `(cd …) && git …` stays fail-closed.
+ */
+function applySuccessGatedCwdChain(commandPrefix, baseCwd) {
+    if (!hasUnquotedParen(commandPrefix)) {
+        return applyAndSegmentCwdChain(commandPrefix, baseCwd);
+    }
+    return applyLegacyTrailingCdChain(commandPrefix, baseCwd);
+}
 /**
  * The directory the git op actually runs in: `baseCwd` lowered by the
  * success-gated cwd chain that directly governs this op, then through EVERY

package/dist/esm/hooks/sessionstart/index.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { Database } from "#db/sqlite.js";
+import { SessionMemorySessionStore } from "#session-memory/session.js";
 export declare const MAX_BYTES: number;
 export declare const TRUNCATION_NOTICE = "\n\n[truncated: file exceeded 200KB limit]";
 export declare const RESUME_MAX_EVENT_BYTES: number;
@@ -10,10 +11,19 @@ type StartInput = Record<string, unknown>;
 type EnvLike = Record<string, string | undefined>;
 export interface SessionStartDeps {
     readonly createDatabase?: (dbPath: string) => Pick<Database, "prepare" | "close">;
+    readonly createStore?: (dbPath: string) => Pick<SessionMemorySessionStore, "captureEvent" | "close">;
     readonly dbPath?: string;
     readonly repoHash?: (projectDir: string) => string;
+    readonly now?: () => Date;
+    readonly onStorageError?: (error: unknown) => void;
 }
 export declare function resolveSessionMemoryDbPath(projectDir: string, env: EnvLike): string;
+/**
+ * Seed session-memory with a real host session id so `wp session-info` works
+ * under Grok (and similar hosts) before any Edit/Write tool capture. Fail-open:
+ * storage errors never break SessionStart stdout.
+ */
+export declare function seedSessionIdentityCapture(input: StartInput, projectDir: string, env: EnvLike, deps?: SessionStartDeps): void;
 /**
  * Pure function: given a parsed input payload, a working directory, and
  * environment variables, produce the JSON string that the hook should write

package/dist/esm/hooks/sessionstart/index.js

@@ -18,20 +18,23 @@
  * Always emits valid JSON; `additionalContext` is empty when there is no
  * `.agent/routing.md`, continuity, or update banner to surface.
  */
-import { readFileSync, statSync } from "node:fs";
+import { mkdirSync, readFileSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { performance } from "node:perf_hooks";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { renderSessionStartInstructionContext } from "#hooks/shared/instruction-surfaces";
 import { writeHookOutput } from "#hooks/shared/hook-bootstrap";
 import { rememberHookStdin } from "#hooks/logs/store.js";
 import { resolveHookProjectDir } from "#hooks/shared/project-dir.js";
+import { resolveHookSessionId } from "#hooks/shared/types.js";
 import { getSurfacePath, NotInGitRepoError } from "#paths/state-root.js";
 import { WP_AGENT_LAUNCHED_VIA_WP_ENV, WP_AGENT_LAUNCHED_VIA_WP_VALUE, } from "#runtime/agent-launch-marker.js";
 import { Database } from "#db/sqlite.js";
 import { readUpdateBanner } from "./update-banner.js";
 import { isDirectEntrypoint } from "#hooks/shared/direct-entrypoint";
-import { repoHashFromRoot } from "#session-memory/repo-hash.js";
+import { buildContinuityEvent } from "#session-memory/hook-capture.js";
+import { computeRepoHash, repoHashFromRoot } from "#session-memory/repo-hash.js";
+import { SessionMemorySessionStore } from "#session-memory/session.js";
 export const MAX_BYTES = 200 * 1024;
 export const TRUNCATION_NOTICE = "\n\n[truncated: file exceeded 200KB limit]";
 export const RESUME_MAX_EVENT_BYTES = 2 * 1024;
@@ -223,7 +226,8 @@ function buildResumeContext(input, projectDir, env, deps) {
             const rows = readRecentContinuityEvents({
                 db,
                 repoHash,
-                sessionId: optionalString(input["session_id"]),
+                // Prefer stdin session id; fall back to GROK_SESSION_ID for Grok hooks.
+                sessionId: resolveHookSessionId(input, env),
                 minPriority: parsePositiveInt(env.WP_SESSIONSTART_RESUME_MIN_PRIORITY, RESUME_MIN_PRIORITY),
                 limit: parsePositiveInt(env.WP_SESSIONSTART_RESUME_MAX_EVENTS, 16),
             });
@@ -267,6 +271,56 @@ function buildDirectLaunchWarning(input, env) {
         "</wp_launch_warning>",
     ].join("\n");
 }
+/**
+ * Seed session-memory with a real host session id so `wp session-info` works
+ * under Grok (and similar hosts) before any Edit/Write tool capture. Fail-open:
+ * storage errors never break SessionStart stdout.
+ */
+export function seedSessionIdentityCapture(input, projectDir, env, deps = {}) {
+    const sessionId = resolveHookSessionId(input, env);
+    if (!sessionId)
+        return;
+    try {
+        const dbPath = deps.dbPath ?? resolveSessionMemoryDbPath(projectDir, env);
+        mkdirSync(dirname(dbPath), { recursive: true });
+        const store = deps.createStore?.(dbPath) ?? new SessionMemorySessionStore(dbPath);
+        try {
+            // Match `readCurrentSessionId` (computeRepoHash), not path-only hashing.
+            const repoHash = deps.repoHash?.(projectDir) ?? computeRepoHash(projectDir);
+            const event = buildContinuityEvent({
+                eventType: "session_identity",
+                toolName: "SessionStart",
+                content: `Session identity: ${sessionId}`,
+                summary: "Session identity for PR disclosure",
+                // Below RESUME_MIN_PRIORITY (50): kept for `wp session-info`, not resume inject.
+                priority: 40,
+                metadata: {
+                    source: "sessionstart-hook",
+                    hookEventName: "SessionStart",
+                    sessionStartSource: sessionStartSource(input),
+                },
+            });
+            store.captureEvent({
+                repoHash,
+                agentId: "SessionStart",
+                sessionId,
+                event: {
+                    ...event,
+                    ts: (deps.now?.() ?? new Date()).toISOString(),
+                },
+            });
+        }
+        finally {
+            store.close();
+        }
+    }
+    catch (error) {
+        deps.onStorageError?.(error);
+        if (env.WP_SESSIONSTART_DEBUG === "1") {
+            process.stderr.write(`wp-sessionstart-identity: ${error.message}\n`);
+        }
+    }
+}
 /**
  * Pure function: given a parsed input payload, a working directory, and
  * environment variables, produce the JSON string that the hook should write
@@ -277,6 +331,9 @@ function buildDirectLaunchWarning(input, env) {
  */
 export function buildOutput(input, cwd, env, deps = {}) {
     const projectDir = resolveHookProjectDir(input, cwd, env);
+    // Capture before resume read so this SessionStart can seed disclosure even
+    // when no prior events exist (Grok option-3 path).
+    seedSessionIdentityCapture(input, projectDir, env, deps);
     const target = join(projectDir, ".agent", "routing.md");
     let routingMd = null;
     try {

package/dist/esm/hooks/shared/types.d.ts

@@ -29,6 +29,16 @@ export type UpdatedInputEnvelope = {
  */
 export declare function normalizeHookToolInput(raw: Record<string, unknown>): ToolInput;
 export declare function parseToolInput(json: string): ToolInput;
+type EnvLike = Record<string, string | undefined>;
+/**
+ * Resolve a real host session id for session-memory capture / PR disclosure.
+ * Prefer stdin session fields (snake_case Claude/Codex or camelCase Grok), then
+ * Grok hook env `GROK_SESSION_ID` (documented for every Grok hook process).
+ */
+export declare function resolveHookSessionId(input: {
+    readonly session_id?: unknown;
+    readonly sessionId?: unknown;
+}, env?: EnvLike): string | undefined;
 export declare function isBashInput(input: ToolInput): boolean;
 export declare function isFileEditInput(input: ToolInput): boolean;
 export declare function isFileWriteInput(input: ToolInput): boolean;
@@ -72,3 +82,4 @@ export type DenyEnvelope = ClaudeCodexDenyEnvelope | GrokDualDenyEnvelope;
 export declare function buildDenyEnvelope(options: {
     readonly reason: string;
 }, env?: NodeJS.ProcessEnv): DenyEnvelope;
+export {};

package/dist/esm/hooks/shared/types.js

@@ -55,6 +55,27 @@ export function parseToolInput(json) {
     }
     return normalizeHookToolInput(parsed);
 }
+/**
+ * Resolve a real host session id for session-memory capture / PR disclosure.
+ * Prefer stdin session fields (snake_case Claude/Codex or camelCase Grok), then
+ * Grok hook env `GROK_SESSION_ID` (documented for every Grok hook process).
+ */
+export function resolveHookSessionId(input, env = process.env) {
+    const pick = (value) => {
+        if (typeof value !== "string")
+            return undefined;
+        const trimmed = value.trim();
+        return trimmed.length > 0 ? trimmed : undefined;
+    };
+    // Prefer snake_case when both present (Claude/Codex contract).
+    const fromInput = pick(input.session_id) ?? pick(input.sessionId);
+    if (fromInput)
+        return fromInput;
+    const fromEnv = env.GROK_SESSION_ID?.trim();
+    if (fromEnv)
+        return fromEnv;
+    return undefined;
+}
 export function isBashInput(input) {
     return "command" in (input.tool_input || {});
 }