harnery 0.42.0 → 0.44.0

package/dist/core/hooks/cli.js

@@ -30,7 +30,7 @@ import { assistantTextStartsWithSessionNameBlock, isSessionNameRemediationComman
 import { readHeartbeat, setAssignedNameCache, stampSessionNameReminded, stampSessionNameRequested, stampSessionNameSeen, } from "../agents/state/heartbeat-writer.js";
 import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.js";
 import { ensureLiveCoordinationHeartbeat } from "../agents/state/live-coordination-writer.js";
-import { assignName } from "../agents/state/names.js";
+import { assignName, readForkParent, readForkState, recordForkDetection, resolveName, } from "../agents/state/names.js";
 import { writePidmapRow } from "../agents/state/pidmap.js";
 import { agentsRequireGitFinalization, coordFreshnessSeconds, hostPromptContextConfig, resolveBinName, } from "../config.js";
 import { checkpointContext, completeContextRecovery, extractContextSample, markContextCompactionCompleted, prepareContextRecovery, readContextState, recordContextSample, } from "../context/index.js";
@@ -48,6 +48,7 @@ import { hookTimeoutFor } from "./adapter/wiring.js";
 import { scheduleBackupSnapshot } from "./backup-schedule.js";
 import { captureImages, detectPresence, imageJanitor, journalArchive, journalJanitor, journalRecoveryCue, playSound, recordImageArtifactsV3, resetSoundCounters, runSessionSyncExtension, soundForEvent, } from "./effects/index.js";
 import { toolInputHash, toolTargetHash } from "./events/input-hash.js";
+import { detectClaudeCodeFork } from "./fork-lineage.js";
 import { canonicalize } from "./guard-path.js";
 import { beginHookHealth, observeHookDebug, observeHookError, writeHookHealthCompletion, } from "./health.js";
 import { adapterPidFromEnv, parsePsChainLine, selectAnchorPid } from "./resolve/anchor.js";
@@ -56,6 +57,7 @@ import { resolveOwner } from "./resolve/owner.js";
 import { inspectSessionNameDisplayImmediately, scanAssistantStatusBoxPresent, scanStatusBoxPresent, scanTranscriptRuntime, } from "./resolve/transcript.js";
 import { clearHookRunMarker, writeHookRunMarker } from "./run-markers.js";
 import { sessionNamePresence } from "./session-name-presence.js";
+import { shellRmReason } from "./shell-rm.js";
 import { shellWaiterReason } from "./shell-waiter.js";
 let hookHealthState;
 let hookRunMarkerPath = null;
@@ -155,11 +157,13 @@ function logError(coordRoot, err, context) {
  * Mint or recover the hurricane-style name for this owner in-process. Returns
  * null on any failure so session.started emission never breaks adapter flow.
  */
-function assignNameInProcess(coordRoot, instanceId, kind, forkedFrom) {
+function assignNameInProcess(coordRoot, instanceId, kind, fork) {
     try {
         const name = assignName(coordRoot, instanceId, kind, {
             freshnessSecs: coordFreshnessSeconds(coordRoot),
-            ...(forkedFrom ? { forkedFrom } : {}),
+            ...(fork?.forkedFrom ? { forkedFrom: fork.forkedFrom } : {}),
+            ...(fork?.fork ? { fork: true } : {}),
+            ...(fork?.forkChecked ? { forkChecked: true } : {}),
         });
         return { name, kind };
     }
@@ -167,9 +171,60 @@ function assignNameInProcess(coordRoot, instanceId, kind, forkedFrom) {
         return null;
     }
 }
+/**
+ * Name a main session, recording fork lineage when the instance is new. Every
+ * main-session naming path goes through here: whichever hook first sees a new
+ * instance writes its history row, and lineage can only ride that first row
+ * (later detection appends a `fork.detected` row instead).
+ */
+function assignSessionNameInProcess(coordRoot, instanceId, payload, adapter) {
+    let fork;
+    try {
+        if (adapter === "claude-code" &&
+            payload?.session_id === instanceId &&
+            !resolveName(coordRoot, instanceId)) {
+            const detected = detectClaudeCodeFork({
+                coordRoot,
+                transcriptPath: payload.transcript_path,
+                sessionId: instanceId,
+                source: payload.source,
+            });
+            fork = {
+                ...(detected.forkedFrom ? { forkedFrom: detected.forkedFrom } : {}),
+                fork: detected.fork,
+                forkChecked: detected.checked,
+            };
+        }
+    }
+    catch {
+        fork = undefined;
+    }
+    return assignNameInProcess(coordRoot, instanceId, "session", fork);
+}
+/**
+ * Finish fork detection that session start could not: a CLI fork starts before
+ * its transcript exists, and a mid-flight instance may never see SessionStart.
+ * Runs once per instance; the appended `fork_checked` row stops later calls.
+ */
+function healForkLineage(coordRoot, instanceId, payload) {
+    if (!payload?.transcript_path || payload.session_id !== instanceId)
+        return;
+    const state = readForkState(coordRoot, instanceId);
+    if (!state || state.checked)
+        return;
+    const detected = detectClaudeCodeFork({
+        coordRoot,
+        transcriptPath: payload.transcript_path,
+        sessionId: instanceId,
+        knownFork: state.fork,
+    });
+    if (!detected.checked)
+        return;
+    recordForkDetection(coordRoot, instanceId, detected);
+}
 /** Mid-flight sessions can emit tools before SessionStart assigns a pool name.
  * Stamp the disposable cache so Codec does not render the 8-character id. */
-function ensureSessionDisplayName(coordRoot, instanceId, sessionId, adapter) {
+function ensureSessionDisplayName(coordRoot, instanceId, sessionId, adapter, payload) {
     if (coordEnv("WORKFLOW_CHILD") === "1")
         return;
     const row = readLiveCoordinationRow(coordRoot, instanceId) ?? readHeartbeat(coordRoot, instanceId);
@@ -177,7 +232,7 @@ function ensureSessionDisplayName(coordRoot, instanceId, sessionId, adapter) {
         return;
     if (row?.name?.trim())
         return;
-    const assigned = assignNameInProcess(coordRoot, instanceId, "session");
+    const assigned = assignSessionNameInProcess(coordRoot, instanceId, payload, adapter);
     if (!assigned?.name)
         return;
     if (!readHeartbeat(coordRoot, instanceId)) {
@@ -230,21 +285,21 @@ function buildEventData(eventType, ctx) {
             // The platform label is the adapter id itself; enumerating and defaulting
             // to codex silently mislabels any adapter not in the list.
             const adapterPlatform = ctx.adapter;
-            // Recorded fork lineage is NOT detected here. On claude-code a fork
-            // never fires its own session.started — SessionStart fires under the
-            // PARENT's session id (source=resume) before the fork id is minted
-            // (verified 2026-08-05) — so detection at this point can only mislabel
-            // the resumed parent. The fork's new instance is caught by the
-            // tool.requested heal path instead. The forkedFrom plumbing below stays
-            // for adapters that DO report a parent at session start.
-            const forkedFrom = undefined;
             // Assign (or recover) name + kind in-process. Idempotent: resume
-            // returns the original name; new owner consumes a counter slot.
+            // returns the original name; new owner consumes a counter slot and,
+            // on claude-code, runs fork detection (fork-lineage.ts). Since Claude
+            // Code 2.1.283 both fork flows fire SessionStart under the FORK's own
+            // id (verified 2026-10-07), superseding the 2026-08-05 finding that a
+            // fork never started on its own id. A resumed parent keeps its existing
+            // history row, so it is never relabeled here.
             // Workflow children stay unnamed, as on the tool path: a pool name
             // would make them the addressee of mail held for that name.
             const assigned = coordEnv("WORKFLOW_CHILD") === "1"
                 ? undefined
-                : assignNameInProcess(ctx.coordRoot, ctx.instanceId, "session", forkedFrom);
+                : assignSessionNameInProcess(ctx.coordRoot, ctx.instanceId, p, ctx.adapter);
+            const forkedFrom = assigned
+                ? readForkParent(ctx.coordRoot, ctx.instanceId)?.instance_id
+                : undefined;
             // Write the adapter pid-map row so `harn agents whoami` ppid-walks find
             // this owner. Prefer the payload pid (the actual claude binary), then the
             // anchor walk (the `node` ancestor for Cursor, which has no payload pid),
@@ -309,7 +364,7 @@ function buildEventData(eventType, ctx) {
             // 8-character native id.
             if (coordEnv("WORKFLOW_CHILD") !== "1" &&
                 !readLiveCoordinationRow(ctx.coordRoot, ctx.instanceId)?.name) {
-                assignNameInProcess(ctx.coordRoot, ctx.instanceId, "session");
+                assignSessionNameInProcess(ctx.coordRoot, ctx.instanceId, p, ctx.adapter);
             }
             const prompt = p?.prompt ?? "";
             const { value, truncated } = clampString(prompt, 4000);
@@ -645,7 +700,7 @@ async function main() {
         priorCoordination?.kind !== "transient" &&
         !priorCoordination?.workflow_run_id &&
         !priorCoordination?.name?.trim()) {
-        assignNameInProcess(coordRoot, owner.instance_id, "session");
+        assignSessionNameInProcess(coordRoot, owner.instance_id, payload, adapter);
     }
     const data = buildEventData(norm.event_type, {
         coordRoot,
@@ -820,12 +875,20 @@ function recordSignal(run) {
     }
     if (norm.event_type !== "session.ended") {
         try {
-            ensureSessionDisplayName(coordRoot, owner.instance_id, sessionId, adapter);
+            ensureSessionDisplayName(coordRoot, owner.instance_id, sessionId, adapter, payload);
         }
         catch (error) {
             logError(coordRoot, error, { phase: "session-display-name" });
         }
     }
+    if (norm.event_type === "tool.requested" && adapter === "claude-code" && run.topLevelSession) {
+        try {
+            healForkLineage(coordRoot, owner.instance_id, payload);
+        }
+        catch (error) {
+            logError(coordRoot, error, { phase: "fork-lineage-heal" });
+        }
+    }
     const v3EventId = v3Result && "event" in v3Result
         ? v3Result.event.event_id
         : v3Result && "event_id" in v3Result
@@ -1281,6 +1344,12 @@ async function handleToolRequested(run) {
         emitDeny(adapter, waiterReason);
         return 0;
     }
+    const rmReason = shellRmReason(payload?.tool_name, payload?.tool_input, resolveBinName(coordRoot));
+    if (rmReason) {
+        const { emitDeny } = await import("./adapter/output.js");
+        emitDeny(adapter, rmReason);
+        return 0;
+    }
     // G-guard for ALL adapters. Claude Code previously ran this via a
     // pre-tool-use bash adapter (which called `agent-coord verdict --rule=claim`);
     // that adapter is now deleted, so agent-hook owns the deny for every adapter.
@@ -1869,12 +1938,16 @@ async function emitUserPromptSubmitSystemMessage(coordRoot, instanceId, sessionI
         return false;
     const behavior = adapterBehavior(adapter);
     const { renderPromptContext } = await import("../agents/render/prompt-context.js");
+    let peerMessageIds = [];
     let additionalContext = renderPromptContext({
         coordRoot,
         instanceId,
         sessionId,
         sessionNameNudge: true,
         ...behavior.promptContextNudges,
+        onInboxPrepared: (ids) => {
+            peerMessageIds = ids;
+        },
     }).trim();
     const fileLinkContext = behavior.fileLinkContext?.(coordRoot, workspaceCwd) ?? "";
     if (fileLinkContext) {
@@ -1889,7 +1962,12 @@ async function emitUserPromptSubmitSystemMessage(coordRoot, instanceId, sessionI
     if (!additionalContext)
         return false;
     const { emitContext } = await import("./adapter/output.js");
-    return emitContext(adapter, "UserPromptSubmit", additionalContext);
+    const emitted = emitContext(adapter, "UserPromptSubmit", additionalContext);
+    if (emitted) {
+        const { acknowledgeEmittedPeerInbox } = await import("../inbox/peer-messages.js");
+        await acknowledgeEmittedPeerInbox(coordRoot, instanceId, peerMessageIds);
+    }
+    return emitted;
 }
 async function emitSubagentStartContext(coordRoot, instanceId, sessionId, data, adapter) {
     // Look up the subagent's assigned name (just-written by the in-process name
@@ -1905,19 +1983,26 @@ async function emitSubagentStartContext(coordRoot, instanceId, sessionId, data,
     // is around. Reuse prompt-context (which dedups against the per-owner hash);
     // first call will always emit.
     let combined = message;
+    let peerMessageIds = [];
     const { renderPromptContext } = await import("../agents/render/prompt-context.js");
     const context = renderPromptContext({
         coordRoot,
         instanceId,
         sessionId,
         agentName: subagentName,
+        onInboxPrepared: (ids) => {
+            peerMessageIds = ids;
+        },
     }).trim();
     if (context)
         combined = `${message}\n\n${context}`;
     // Use SubagentStart event-name in CC's hookSpecificOutput shape; cursor's
     // flat `additional_context` works the same way.
     const { emitContext } = await import("./adapter/output.js");
-    emitContext(adapter, "SubagentStart", combined);
+    if (emitContext(adapter, "SubagentStart", combined)) {
+        const { acknowledgeEmittedPeerInbox } = await import("../inbox/peer-messages.js");
+        await acknowledgeEmittedPeerInbox(coordRoot, instanceId, peerMessageIds);
+    }
 }
 function adapterPlatform(adapter) {
     return adapter;
@@ -1926,6 +2011,7 @@ async function emitSessionStartSystemMessage(coordRoot, instanceId, sessionId, e
     const behavior = adapterBehavior(adapter);
     const workflowChild = coordEnv("WORKFLOW_CHILD") === "1";
     let additionalContext = "";
+    let peerMessageIds = [];
     // Opportunistic reconciliation makes normal session starts a failsafe for
     // archive, idle, cascade, and host lifecycle observations. It also runs the
     // stale cache sweep through the shared ADR 0077 composition.
@@ -1944,6 +2030,9 @@ async function emitSessionStartSystemMessage(coordRoot, instanceId, sessionId, e
             sessionId,
             agentName: agentName || undefined,
             platformLabel: behavior.sessionStartPlatformLabel,
+            onInboxPrepared: (ids) => {
+                peerMessageIds = ids;
+            },
         }).trim();
     }
     // Effect (journal-maintaining adapters): merge the journal recovery cue into
@@ -1972,11 +2061,19 @@ async function emitSessionStartSystemMessage(coordRoot, instanceId, sessionId, e
         }
     }
     const { emitContext } = await import("./adapter/output.js");
-    return emitContext(adapter, "SessionStart", additionalContext);
+    const emitted = emitContext(adapter, "SessionStart", additionalContext);
+    if (emitted) {
+        const { acknowledgeEmittedPeerInbox } = await import("../inbox/peer-messages.js");
+        await acknowledgeEmittedPeerInbox(coordRoot, instanceId, peerMessageIds);
+    }
+    return emitted;
 }
 function completeRecoveryInjection(coordRoot, instanceId, sessionId, recovery) {
-    completeContextRecovery(coordRoot, { sessionId, instanceId });
-    void recovery;
+    completeContextRecovery(coordRoot, {
+        sessionId,
+        instanceId,
+        checkpoint: recovery.checkpoint,
+    });
 }
 main()
     .then(async (code) => {

package/dist/core/hooks/fork-lineage.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Claude Code fork detection: decide whether a new main-session instance is a
+ * branch of another session, and which one.
+ *
+ * Two shapes exist as of Claude Code 2.1.283 (verified 2026-10-07):
+ *
+ *   - CLI `--resume <id> --fork-session` fires SessionStart under the FORK's id
+ *     with `source: "fork"`, before its transcript exists, and names no parent.
+ *     The transcript later holds the parent's message uuids with every row's
+ *     `sessionId` rewritten, so the parent is found by uuid containment
+ *     (`detectForkParent`) once the transcript is on disk.
+ *   - The desktop app's "Fork from here" copies the parent's rows into the
+ *     fork's transcript with their original `sessionId`, so inherited rows
+ *     name the parent directly (`detectInheritedSessionParent`).
+ *
+ * Inherited rows alone do not prove a fork: a continuation of a finished
+ * session can carry them too. The parent's liveness separates the two. A
+ * parent with an unended generation is still running (or resumable) and owns
+ * its name, task, and claims, so the new instance is a fork. A finished
+ * parent makes it a continuation, which keeps the generic notice.
+ *
+ * Everything here fails open: an unreadable transcript or an unknown layout
+ * yields "not a fork", never an error.
+ */
+export interface ForkDetection {
+    fork: boolean;
+    forkedFrom?: string;
+    /** Detection had the evidence it needs; the tool-path heal can skip it. */
+    checked: boolean;
+}
+export declare function detectClaudeCodeFork(input: {
+    coordRoot: string;
+    transcriptPath: string | undefined;
+    sessionId: string;
+    source?: string;
+    /** The instance was already recorded as a fork without a parent. */
+    knownFork?: boolean;
+    isLive?: (instanceId: string) => boolean;
+}): ForkDetection;
+//# sourceMappingURL=fork-lineage.d.ts.map

package/dist/core/hooks/fork-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fork-lineage.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/fork-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAC;CAClB;AAKD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;CAC1C,GAAG,aAAa,CAkChB"}

package/dist/core/hooks/fork-lineage.js

@@ -0,0 +1,62 @@
+/**
+ * Claude Code fork detection: decide whether a new main-session instance is a
+ * branch of another session, and which one.
+ *
+ * Two shapes exist as of Claude Code 2.1.283 (verified 2026-10-07):
+ *
+ *   - CLI `--resume <id> --fork-session` fires SessionStart under the FORK's id
+ *     with `source: "fork"`, before its transcript exists, and names no parent.
+ *     The transcript later holds the parent's message uuids with every row's
+ *     `sessionId` rewritten, so the parent is found by uuid containment
+ *     (`detectForkParent`) once the transcript is on disk.
+ *   - The desktop app's "Fork from here" copies the parent's rows into the
+ *     fork's transcript with their original `sessionId`, so inherited rows
+ *     name the parent directly (`detectInheritedSessionParent`).
+ *
+ * Inherited rows alone do not prove a fork: a continuation of a finished
+ * session can carry them too. The parent's liveness separates the two. A
+ * parent with an unended generation is still running (or resumable) and owns
+ * its name, task, and claims, so the new instance is a fork. A finished
+ * parent makes it a continuation, which keeps the generic notice.
+ *
+ * Everything here fails open: an unreadable transcript or an unknown layout
+ * yields "not a fork", never an error.
+ */
+import { existsSync } from "node:fs";
+import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.js";
+import { detectForkParent, detectInheritedSessionParent } from "./resolve/transcript.js";
+/** Sources after which a brand-new instance cannot hold inherited history. */
+const FRESH_SOURCES = new Set(["startup", "clear"]);
+export function detectClaudeCodeFork(input) {
+    try {
+        const declared = input.source === "fork" || input.knownFork === true;
+        const transcriptReady = !!input.transcriptPath && existsSync(input.transcriptPath);
+        const isLive = input.isLive ?? ((id) => readLiveCoordinationRow(input.coordRoot, id) !== null);
+        const inherited = transcriptReady
+            ? detectInheritedSessionParent(input.transcriptPath, input.sessionId)
+            : undefined;
+        if (inherited && inherited !== input.sessionId) {
+            if (declared || isLive(inherited)) {
+                return { fork: true, forkedFrom: inherited, checked: true };
+            }
+            return { fork: false, checked: true };
+        }
+        if (declared) {
+            if (!transcriptReady)
+                return { fork: true, checked: false };
+            const parent = detectForkParent(input.transcriptPath, input.sessionId);
+            return {
+                fork: true,
+                ...(parent && parent !== input.sessionId ? { forkedFrom: parent } : {}),
+                checked: true,
+            };
+        }
+        return {
+            fork: false,
+            checked: transcriptReady || FRESH_SOURCES.has(input.source ?? ""),
+        };
+    }
+    catch {
+        return { fork: false, checked: true };
+    }
+}

package/dist/core/hooks/resolve/transcript.d.ts

@@ -92,6 +92,22 @@ export interface TranscriptRuntimeScan {
  * SessionStart).
  */
 export declare function scanTranscriptRuntime(transcriptPath: string | undefined): TranscriptRuntimeScan | undefined;
+/**
+ * Detect inherited history from row session ids: the session whose rows were
+ * copied into this transcript, or undefined when every row is this session's.
+ *
+ * Empirical basis (verified 2026-10-07, Claude Code 2.1.283): the desktop
+ * app's "Fork from here" copies the parent's rows into the fork's transcript
+ * WITHOUT rewriting their `sessionId`, so the fork's file opens with thousands
+ * of rows stamped with the parent's id. The CLI `--fork-session` path rewrites
+ * the ids instead and is covered by {@link detectForkParent}.
+ *
+ * When the history is itself several generations deep, the LAST foreign row is
+ * the nearest ancestor, so the tail is scanned first. Whether the foreign
+ * session is a fork parent or a dead predecessor (a continuation) is the
+ * caller's call. Fail-soft: never throws, undefined on any read problem.
+ */
+export declare function detectInheritedSessionParent(transcriptPath: string | undefined, sessionId: string): string | undefined;
 /**
  * Detect the parent session of a forked CC conversation from its transcript.
  *

package/dist/core/hooks/resolve/transcript.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transcript.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/resolve/transcript.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,2BAA2B,wBAAc,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQhF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAiCT;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GACvC,OAAO,CAKT;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB9F;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GAC/D,OAAO,CAIT;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IACE,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,oBAAoB,GAAG,sBAAsB,GAAG,wBAAwB,CAAC;CAClF,CAAC;AAEN;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GAC/D,4BAA4B,CAqD9B;AAgBD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAUrF;AAwDD;4CAC4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd;+EAC2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,qBAAqB,GAAG,SAAS,CA8BnC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAkDpB"}
+{"version":3,"file":"transcript.d.ts","sourceRoot":"","sources":["../../../../src/core/hooks/resolve/transcript.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,2BAA2B,wBAAc,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQhF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAiCT;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,oBAAoB,EAAE,MAAM,GAAG,SAAS,GACvC,OAAO,CAKT;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB9F;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GAC/D,OAAO,CAIT;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IACE,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,oBAAoB,GAAG,sBAAsB,GAAG,wBAAwB,CAAC;CAClF,CAAC;AAEN;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,GAC/D,4BAA4B,CAqD9B;AAgBD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAUrF;AAwDD;4CAC4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd;+EAC2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,qBAAqB,GAAG,SAAS,CA8BnC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAiBpB;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAkDpB"}

package/dist/core/hooks/resolve/transcript.js

@@ -318,6 +318,90 @@ const SESSION_FILE_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-
 const FORK_SCAN_MAX_BYTES = 128 * 1024 * 1024;
 /** How many message uuids to sample across the fork's copied prefix. */
 const FORK_SAMPLE_SIZE = 24;
+/** Tail window scanned for inherited rows; a fork's own rows are few when the
+ * scan runs (session start or the first tool call), so the copied history ends
+ * well inside it. */
+const INHERITED_TAIL_BYTES = 4 * 1024 * 1024;
+const INHERITED_HEAD_BYTES = 64 * 1024;
+const SESSION_ID_FIELD_RE = /"sessionId":"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})"/gi;
+/**
+ * Detect inherited history from row session ids: the session whose rows were
+ * copied into this transcript, or undefined when every row is this session's.
+ *
+ * Empirical basis (verified 2026-10-07, Claude Code 2.1.283): the desktop
+ * app's "Fork from here" copies the parent's rows into the fork's transcript
+ * WITHOUT rewriting their `sessionId`, so the fork's file opens with thousands
+ * of rows stamped with the parent's id. The CLI `--fork-session` path rewrites
+ * the ids instead and is covered by {@link detectForkParent}.
+ *
+ * When the history is itself several generations deep, the LAST foreign row is
+ * the nearest ancestor, so the tail is scanned first. Whether the foreign
+ * session is a fork parent or a dead predecessor (a continuation) is the
+ * caller's call. Fail-soft: never throws, undefined on any read problem.
+ */
+export function detectInheritedSessionParent(transcriptPath, sessionId) {
+    try {
+        const readablePath = resolveTranscriptPath(transcriptPath);
+        if (!readablePath || !sessionId)
+            return undefined;
+        const size = statSync(readablePath).size;
+        const fromTail = lastForeignSessionId(readRange(readablePath, Math.max(0, size - INHERITED_TAIL_BYTES), size), sessionId);
+        if (fromTail || size <= INHERITED_TAIL_BYTES)
+            return fromTail;
+        return lastForeignSessionId(readRange(readablePath, 0, Math.min(size, INHERITED_HEAD_BYTES)), sessionId);
+    }
+    catch {
+        return undefined;
+    }
+}
+function lastForeignSessionId(text, sessionId) {
+    if (!text)
+        return undefined;
+    const own = sessionId.toLowerCase();
+    const lines = text.split("\n");
+    for (let i = lines.length - 1; i >= 0; i--) {
+        const line = lines[i];
+        if (!line.includes('"sessionId":"'))
+            continue;
+        let foreign = false;
+        for (const m of line.matchAll(SESSION_ID_FIELD_RE)) {
+            if (m[1].toLowerCase() !== own)
+                foreign = true;
+        }
+        if (!foreign)
+            continue;
+        // Confirm on the parsed row: a nested object can carry another session's
+        // id, but only the row's own top-level field says whose row it is. A
+        // partial line at a window edge fails to parse and is skipped.
+        try {
+            const row = JSON.parse(line);
+            if (typeof row.sessionId === "string" && row.sessionId.toLowerCase() !== own) {
+                return row.sessionId;
+            }
+        }
+        catch {
+            /* torn line */
+        }
+    }
+    return undefined;
+}
+function readRange(path, start, end) {
+    try {
+        const fs = require("node:fs");
+        const fd = fs.openSync(path, "r");
+        try {
+            const buf = Buffer.alloc(Math.max(0, end - start));
+            fs.readSync(fd, buf, 0, buf.length, start);
+            return buf.toString("utf8");
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Detect the parent session of a forked CC conversation from its transcript.
  *

package/dist/core/hooks/shell-rm.d.ts

@@ -0,0 +1,2 @@
+export declare function shellRmReason(toolName: unknown, toolInput: unknown, binName: string): string | null;
+//# sourceMappingURL=shell-rm.d.ts.map

package/dist/core/hooks/shell-rm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-rm.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/shell-rm.ts"],"names":[],"mappings":"AAsFA,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,OAAO,EACjB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CAYf"}

package/dist/core/hooks/shell-rm.js

@@ -0,0 +1,105 @@
+import { basename, shellCommandFromTool, tokenize } from "./shell-tokens.js";
+/**
+ * Deny a shell `rm` and name the guarded replacement. The instructions have
+ * said "use <bin> rm instead of shell rm" since the command shipped, and
+ * agents still reached for bare rm several times a day, often on unquoted
+ * variable paths that Claude Code then stops on for a human prompt. A
+ * repeated, machine-detectable failure belongs in a gate, not more prose.
+ *
+ * This is a guardrail against the reflex, not a security boundary: it reads
+ * command positions only (so `git rm`, `docker rm`, and quoted examples pass),
+ * plus the `xargs rm`, `find -exec rm`, and `bash -c '...rm...'` shapes.
+ * HARNERY_ALLOW_RM=1 on the command is the deliberate override.
+ */
+const OVERRIDE = "HARNERY_ALLOW_RM=1";
+const SEPARATORS = new Set([";", "|", "||", "&", "&&", "(", ")", "{", "}"]);
+const KEYWORDS = new Set(["do", "if", "then", "elif", "else", "!", "while", "until", "time"]);
+const WRAPPERS = new Set(["command", "exec", "builtin", "nohup", "sudo", "doas", "env", "nice"]);
+// xargs options that consume the following token as their value.
+const XARGS_VALUE_FLAGS = new Set(["-n", "-I", "-L", "-P", "-d", "-E", "-s", "-a"]);
+function isRm(value, quoted) {
+    return !quoted && basename(value) === "rm";
+}
+function invokesRm(source, depth = 0) {
+    if (depth > 8)
+        return false;
+    const tokens = tokenize(source);
+    if (tokens.some((t) => !t.quoted && t.value === OVERRIDE))
+        return false;
+    let start = true;
+    let afterWrapper = false;
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token.operator) {
+            if (SEPARATORS.has(token.value)) {
+                start = true;
+                afterWrapper = false;
+            }
+            continue;
+        }
+        if (!start)
+            continue;
+        if (!token.quoted) {
+            if (KEYWORDS.has(token.value))
+                continue;
+            if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(token.value))
+                continue;
+            if (afterWrapper && token.value.startsWith("-"))
+                continue;
+        }
+        const name = basename(token.value);
+        if (WRAPPERS.has(name)) {
+            afterWrapper = true;
+            continue;
+        }
+        start = false;
+        afterWrapper = false;
+        if (isRm(token.value, token.quoted))
+            return true;
+        if (name === "xargs") {
+            for (let j = i + 1; j < tokens.length && !tokens[j].operator; j++) {
+                const arg = tokens[j];
+                if (arg.value.startsWith("-")) {
+                    if (XARGS_VALUE_FLAGS.has(arg.value))
+                        j++;
+                    continue;
+                }
+                if (isRm(arg.value, arg.quoted))
+                    return true;
+                break;
+            }
+        }
+        if (name === "find") {
+            for (let j = i + 1; j < tokens.length && !tokens[j].operator; j++) {
+                if (!/^-(?:exec|execdir|ok|okdir)$/.test(tokens[j].value))
+                    continue;
+                const next = tokens[j + 1];
+                if (next && !next.operator && isRm(next.value, next.quoted))
+                    return true;
+            }
+        }
+        if (["bash", "sh", "dash", "zsh", "ksh"].includes(name)) {
+            for (let j = i + 1; j < tokens.length && !tokens[j].operator; j++) {
+                if (/^-[a-z]*c[a-z]*$/.test(tokens[j].value)) {
+                    const script = tokens[j + 1];
+                    if (script && !script.operator && invokesRm(script.value, depth + 1))
+                        return true;
+                    break;
+                }
+            }
+        }
+    }
+    return false;
+}
+export function shellRmReason(toolName, toolInput, binName) {
+    const command = shellCommandFromTool(toolName, toolInput);
+    if (command === null || !invokesRm(command))
+        return null;
+    return (`Shell rm blocked: it skips the resolved-path, Git-ownership, and peer-claim checks, and an ` +
+        `unquoted variable path can expand to the wrong target. Use the guarded paths instead: ` +
+        `\`${binName} rm --root <directory> <paths...>\` previews removal of untracked files (add ` +
+        `--yes to delete, -r for a directory); \`git rm\` removes tracked source; ` +
+        `\`${binName} artifacts discard <id>\` retires managed evidence. To replace a file, overwrite ` +
+        `it in place or \`mv\` the new file over the old one, so nothing needs deleting. If none of ` +
+        `these fit, prefix the command with ${OVERRIDE}.`);
+}

package/dist/core/hooks/shell-tokens.d.ts

@@ -0,0 +1,12 @@
+/** Shared, deliberately small shell lexer for PreToolUse command guards. */
+export interface Token {
+    value: string;
+    quoted: boolean;
+    operator?: boolean;
+}
+/** Keep quoted arguments opaque, including examples and heredoc bodies. */
+export declare function tokenize(source: string): Token[];
+export declare function basename(value: string): string;
+/** The command string of a Bash-style tool call, or null for any other tool. */
+export declare function shellCommandFromTool(toolName: unknown, toolInput: unknown): string | null;
+//# sourceMappingURL=shell-tokens.d.ts.map

package/dist/core/hooks/shell-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-tokens.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/shell-tokens.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,MAAM,WAAW,KAAK;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,2EAA2E;AAC3E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,CA+DhD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAgBzF"}