one-code-extension 0.5.0 → 0.6.0

package/extensions/file-tracker/replay.ts

@@ -1,22 +1,27 @@
 /**
  * Rebuild read-before-write state from a session branch (pure): which files
- * the model has read or written this conversation, so a `--resume`d session
- * does not block every edit with "has not been read in this conversation" —
- * a claim the model can see is false in its own transcript (review T9).
+ * the model has seen this conversation, so a `--resume`d session does not
+ * block every edit with "has not been read in this conversation", a claim
+ * the model can see is false in its own transcript (review T9).
  *
- * The content the model saw is not in the transcript, so a replayed file is
- * observed with its CURRENT content: an edit after resume is allowed, and a
- * change made while the session was closed is not flagged. That is Claude
- * Code's behaviour too (its read state persists across resume); the stale-edit
- * guard still catches anything that changes from this point on.
+ * The content the model saw is not in the transcript, but each read and write
+ * result records what it saw (`details.oneCodeFile`, `FileObservation`) under
+ * the absolute path the tool resolved. The replay keys on that path, never on
+ * the call's own spelling: a worktree rewrites a relative path only in the
+ * call it runs, so the transcript's `a.ts` would resolve to the main
+ * checkout's twin (round-3 review M15). A post-compaction restore records the
+ * same on its pending entry, and a changed-on-disk notice records the
+ * versions it named. The caller compares each observation with the disk: a
+ * file that still matches is read, one that changed since is stale. A result
+ * that recorded nothing (a session from before the record existed) leaves its
+ * file unread: the disk as it is now is never taken as what the model saw
+ * (round-2 review H1).
  */
 
-import { pathArgument } from "../auto-mode/paths.ts";
+import { latestCompaction } from "../lib/compaction-boundary.ts";
+import { type FileVersion, isFileVersion, readRecord } from "../lib/ledger/records.ts";
 import { shownInFull } from "./shell-reads.ts";
 
-const READ_TOOLS = new Set(["read", "notebook_edit"]);
-const WRITE_TOOLS = new Set(["edit", "write", "notebook_edit"]);
-
 interface ToolCallBlock {
 	type: "toolCall";
 	id: string;
@@ -24,63 +29,85 @@ interface ToolCallBlock {
 	arguments?: Record<string, unknown>;
 }
 
-type BranchMessage = { role?: string; content?: unknown; toolCallId?: string; isError?: boolean; timestamp?: number };
+type BranchMessage = { role?: string; content?: unknown; toolCallId?: string; toolName?: string; isError?: boolean; details?: { oneCodeFile?: unknown } };
+
+/** What a read or write result saw of its file, recorded in its details as `oneCodeFile`: a version with its size and modification time. */
+export type FileObservation = Required<FileVersion>;
+
+const isObservation = (value: unknown): value is FileObservation => isFileVersion(value) && value.size !== undefined && value.mtimeMs !== undefined;
 
 /**
- * Every tool call on the branch that names a path (`path`, `file_path` or
- * `notebook_path`, as the gates read it) and got a successful result, in
- * result order, with the result message's time.
+ * Every successful tool result on the branch that recorded what it saw of a
+ * file, in branch order: its position, the tool that ran (from its call, else
+ * the result's own `toolName`) and the observation.
  */
-export function* successfulPathCalls(entries: readonly unknown[]): Generator<{ name: string; path: string; timestamp: number | undefined }> {
-	const calls = new Map<string, { name: string; path: string }>();
-	for (const entry of entries) {
+function* fileResults(entries: readonly unknown[]): Generator<{ index: number; name: string | undefined; seen: FileObservation }> {
+	const names = new Map<string, string>();
+	for (const [index, entry] of entries.entries()) {
 		const e = entry as { type?: string; message?: BranchMessage };
 		if (e?.type !== "message" || !e.message) continue;
 		const m = e.message;
 		if (m.role === "assistant" && Array.isArray(m.content)) {
-			for (const block of m.content as ToolCallBlock[]) {
-				if (block?.type !== "toolCall" || !block.id) continue;
-				const path = pathArgument(block.arguments);
-				if (path?.trim()) calls.set(block.id, { name: block.name, path });
-			}
-		} else if (m.role === "toolResult" && m.toolCallId && !m.isError) {
-			const call = calls.get(m.toolCallId);
-			if (call) yield { ...call, timestamp: m.timestamp };
+			for (const block of m.content as ToolCallBlock[]) if (block?.type === "toolCall" && block.id) names.set(block.id, block.name);
+		} else if (m.role === "toolResult" && !m.isError) {
+			const seen = m.details?.oneCodeFile;
+			if (isObservation(seen)) yield { index, name: (m.toolCallId ? names.get(m.toolCallId) : undefined) ?? m.toolName, seen };
 		}
 	}
 }
 
-const touchesFile = (name: string) => READ_TOOLS.has(name) || WRITE_TOOLS.has(name);
-
-/** Paths (as written in the tool input) of every successful read/edit/write on the branch, in order, deduplicated. */
-export function pathsReadOnBranch(entries: readonly unknown[]): string[] {
-	const seen = new Set<string>();
-	for (const call of successfulPathCalls(entries)) if (touchesFile(call.name)) seen.add(call.path);
-	return [...seen];
+/** What the branch shows the model saw of a file, and what it was told about the file since. */
+export interface SeenFile {
+	/** The version the model last saw, as the result or restore that showed it recorded it. */
+	seen: FileObservation;
+	/** Content hashes of the changed versions a notice named after that. */
+	notified: Set<string>;
 }
 
 /**
- * Each path (as written in the tool input) a successful read/edit/write on the
- * branch touched, with the time of its last such result message: the order
- * the post-compaction file restore uses after a resume, when the modification
- * times stat'ed at those reads are gone (Claude Code uses the transcript time
- * the same way).
+ * Each file the model saw in the entries still in context (`inContextEntries`),
+ * by absolute path: the last result or post-compaction restore that showed
+ * it, and the changed versions a notice named since.
+ *
+ * In the kept turns before the latest compaction a `read` result counts, as
+ * at the compaction itself: a kept edit or write does not show the whole
+ * file, so it counts only for a file a kept read showed before it, where it
+ * records the version the edit left (the live tracker observes the file
+ * again after its own write, and the compaction keeps that). A restore counts only after the latest compaction, and there it
+ * counts whether or not a request delivered it yet. A later compaction is
+ * the only thing that drops a restore undelivered (lib/ledger/fold.ts), so
+ * one recorded since the latest is either delivered or rides the next
+ * request, and the model sees the file before it can call a tool on it; the
+ * live session counts it read from the compaction on, too. A notice counts
+ * wherever it lies after the file's last observation: it is delivered or
+ * pending, and announcing the same version again would repeat it.
  */
-export function lastTouchesOnBranch(entries: readonly unknown[]): Map<string, number> {
-	const touches = new Map<string, number>();
-	for (const call of successfulPathCalls(entries)) {
-		if (touchesFile(call.name) && call.timestamp !== undefined) touches.set(call.path, call.timestamp);
-	}
-	return touches;
+export function filesSeenOnBranch(entries: readonly unknown[]): Map<string, SeenFile> {
+	const compaction = latestCompaction(entries)?.index ?? -1;
+	const results = new Map([...fileResults(entries)].map((result) => [result.index, result]));
+	const files = new Map<string, SeenFile>();
+	const see = (seen: FileObservation) => files.set(seen.path, { seen, notified: new Set() });
+	entries.forEach((entry, index) => {
+		const result = results.get(index);
+		if (result) {
+			if (index > compaction || result.name === "read" || files.has(result.seen.path)) see(result.seen);
+			return;
+		}
+		const record = readRecord(entry as never);
+		if (record?.kind !== "pending") return;
+		if (index > compaction) for (const seen of record.data.observations ?? []) if (isObservation(seen)) see(seen);
+		for (const told of record.data.notified ?? []) files.get(told.path)?.notified.add(told.sha256);
+	});
+	return files;
 }
 
 /**
- * The paths (as written in the tool input) that a successful `read` in the
- * kept turns returned: those files are in context already, so the
- * post-compaction restore skips them.
+ * The files (absolute, as their results recorded them) that a successful
+ * `read` in the kept turns returned: those files are in context already, so
+ * the post-compaction restore skips them.
  */
 export function keptReadPaths(kept: readonly unknown[]): string[] {
-	return [...successfulPathCalls(kept)].filter((call) => call.name === "read").map((call) => call.path);
+	return [...fileResults(kept)].filter((result) => result.name === "read").map((result) => result.seen.path);
 }
 
 /**

package/extensions/file-tracker/restore.ts

@@ -33,22 +33,25 @@ export function restoreCandidates(touched: ReadonlyMap<string, number>, skip: (p
 /** What reading a candidate again gave: its text as the read tool returns it, or nothing (gone, unreadable, an image). */
 export type RestoredRead = { path: string; text: string | undefined };
 
+/** One `<system-reminder>` block of a restore; `restores` names the file whose contents it puts back in context. */
+export type RestoreBlock = { text: string; restores?: string };
+
 /**
- * The reminder texts (one per `<system-reminder>` block) for the reads, in
- * order: two blocks for a file within the per-file cap, one note for a larger
- * one, nothing for a file that could not be read. A file's blocks are kept only
- * while the running total stays within the overall cap. `restored` lists the
- * files whose contents went back into context.
+ * The reminder blocks for the reads, in order: two blocks for a file within
+ * the per-file cap (the result block `restores` it), one note for a larger
+ * one, nothing for a file that could not be read. A file's blocks are kept
+ * only while the running total stays within the overall cap. `restored` lists
+ * the files whose contents went back into context.
  */
-export function restoreBlocks(reads: RestoredRead[], estimateTokens: (text: string) => number): { blocks: string[]; restored: string[] } {
-	const blocks: string[] = [];
+export function restoreBlocks(reads: RestoredRead[], estimateTokens: (text: string) => number): { blocks: RestoreBlock[]; restored: string[] } {
+	const blocks: RestoreBlock[] = [];
 	const restored: string[] = [];
 	let total = 0;
 	for (const { path, text } of reads) {
 		if (text === undefined) continue;
 		const fits = estimateTokens(text) <= RESTORE_FILE_MAX_TOKENS;
-		const fileBlocks = fits ? [readCallBlock(path), readResultBlock(text)] : [tooLargeNote(path)];
-		const tokens = fileBlocks.reduce((sum, block) => sum + estimateTokens(block), 0);
+		const fileBlocks: RestoreBlock[] = fits ? [{ text: readCallBlock(path) }, { text: readResultBlock(text), restores: path }] : [{ text: tooLargeNote(path) }];
+		const tokens = fileBlocks.reduce((sum, block) => sum + estimateTokens(block.text), 0);
 		if (total + tokens > RESTORE_TOTAL_MAX_TOKENS) continue;
 		total += tokens;
 		blocks.push(...fileBlocks);

package/extensions/file-tracker/tracker.ts

@@ -23,6 +23,8 @@ export interface TrackedFile {
 	 */
 	oversized: boolean;
 	at: number;
+	/** Seen, but changed on disk since (a resumed read whose file moved on): stale until read again. */
+	changed?: boolean;
 }
 
 /** What a stat says about a file on disk; equal stamps mean "no need to re-read". */
@@ -73,6 +75,16 @@ export class FileTracker {
 		}
 	}
 
+	/**
+	 * Record a file the model saw in a form that is gone: it changed on disk
+	 * since, and its old content is not kept. It counts as read, but stale.
+	 */
+	observeChanged(path: string, at: number): void {
+		this.notified.delete(path);
+		this.stamps.delete(path);
+		this.files.set(path, { content: "", oversized: false, at, changed: true });
+	}
+
 	forget(path: string): void {
 		this.files.delete(path);
 		this.notified.delete(path);
@@ -113,7 +125,7 @@ export class FileTracker {
 	/** The content last seen, or undefined when untracked or tracked without content (oversized). */
 	lastSeen(path: string): string | undefined {
 		const known = this.files.get(path);
-		return known && !known.oversized ? known.content : undefined;
+		return known && !known.oversized && !known.changed ? known.content : undefined;
 	}
 
 	get tracked(): string[] {
@@ -130,6 +142,7 @@ export class FileTracker {
 		if (currentContent === undefined) return "absent";
 		const known = this.files.get(path);
 		if (!known) return "unread";
+		if (known.changed) return "stale";
 		// Oversized files are tracked without content; treat them as fresh rather
 		// than blocking edits we cannot reason about.
 		if (known.oversized) return "fresh";

package/extensions/hooks/index.ts

@@ -26,11 +26,17 @@
  * never as a message of its own: PreToolUse context is queued as a one-shot on
  * the reminder channel, so it lands INSIDE the tool result it belongs to,
  * persisted, at no extra turn; PostToolUse context is appended to the result
- * the same way; prompt/session/compaction context is returned from
- * `before_agent_start` as a custom message right AFTER the user's prompt. Until
+ * the same way; prompt, session and compaction context is a one-shot too,
+ * persisted as a `one-code:pending` entry when the hook answers, so it rides
+ * the next request whatever opens it (a prompt, a notification, the
+ * continuation after a mid-turn compaction) and counts as delivered only when
+ * that request's reply stays on the branch (lib/ledger/fold.ts). Until
  * 2026-09-05 each was a custom steer (one extra LLM turn per hook per tool,
  * pi draining one steer per call) and prompt context landed BEFORE the prompt
- * (STEERING-REVIEW-2026-09-05 M6).
+ * (STEERING-REVIEW-2026-09-05 M6); until 2026-10-21 prompt, session and
+ * compaction context was a `before_agent_start` message, taken off its queue
+ * before the request went out and held until a run started (round 3,
+ * R3-M14).
  *
  * Subagents: the tool hooks also run for a child's tool calls, through the
  * bridge published on `SUBAGENT_HOOK_CHANNEL` (subagent-bridge.ts): the child
@@ -38,6 +44,7 @@
  * (settings, consent, logging) and a payload naming the child.
  */
 
+import { randomUUID } from "node:crypto";
 import { contentText } from "@earendil-works/pi-ai";
 import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { RunOutcomeLatch } from "../lib/interrupt.ts";
@@ -60,14 +67,12 @@ import {
 } from "./protocol.ts";
 import { type HookCommand, type HooksSource, loadHookSettings } from "./settings.ts";
 import { persistIfLarge, sessionResultsDir } from "../lib/persisted-output.ts";
-import { REMINDER_CHANNEL, wrapReminder } from "../lib/reminders.ts";
+import { REMINDER_CHANNEL, type ReminderPayload, wrapReminder } from "../lib/reminders.ts";
 import { type ChildHookCall, type ChildHookResult, type HookBridge, SUBAGENT_HOOK_CHANNEL, type SubagentHookPayload } from "./subagent-bridge.ts";
 import { projectHooksApproved } from "./trust.ts";
-import { QueuedDelivery } from "../lib/queued-delivery.ts";
+import { PromptContextRouter } from "./prompt-context.ts";
 import { SKILL_INVOCATION_TYPE, type SkillInvocationDetails } from "../skill/invoke.ts";
-import { isNotificationDetails } from "../lib/notifications.ts";
 import { consentDialog } from "../lib/consent-dialogs.ts";
-import { isUserRun } from "../lib/prompt-options.ts";
 import { followWorkCwd } from "../lib/worktree-channel.ts";
 
 /** Claude Code's `hook_additional_context` attachment text (utils/messages.ts). */
@@ -84,11 +89,13 @@ export function hookContextText(event: CcHookEvent, text: string): string {
  * convention) and the model gets a preview plus the path — nothing is cut away.
  */
 const HOOK_MODEL_TEXT_CAP = 20_000;
-// A monotonic counter, not Date.now(), so two hooks finishing in the same
-// millisecond do not persist to the same file and clobber each other (review M2).
-let hookPersistSeq = 0;
+// A random id, never a counter: the results directory is shared by every
+// session of the project, and a counter restarts with each process and each
+// /reload, so a later hook overwrote a file an earlier transcript points to
+// (design.md section 14). Two hooks finishing in the same millisecond still get
+// two files (review M2).
 function capHookText(text: string, ctx: HookDispatchCtx, label: string): string {
-	return persistIfLarge(text, { dir: sessionResultsDir(ctx), id: `hook-${label}-${hookPersistSeq++}`, maxBytes: HOOK_MODEL_TEXT_CAP });
+	return persistIfLarge(text, { dir: sessionResultsDir(ctx), id: `hook-${label}-${randomUUID()}`, maxBytes: HOOK_MODEL_TEXT_CAP });
 }
 
 interface MatchedHook {
@@ -126,18 +133,12 @@ function isStopContinuation(event: unknown): boolean {
 export default function hooksExtension(pi: ExtensionAPI) {
 	const workCwd = followWorkCwd(pi.events);
 	let stopHookBlocks = 0;
-	/** Context from UserPromptSubmit / SessionStart / PostCompact hooks, delivered with the next prompt. */
-	let pendingPromptContext: Array<{ event: CcHookEvent; text: string }> = [];
-	/**
-	 * UserPromptSubmit context for messages queued mid-turn, held until pi
-	 * delivers the message (lib/queued-delivery.ts): such a message never
-	 * reaches before_agent_start.
-	 */
-	const queuedPromptContext = new QueuedDelivery<string>();
+	/** Prompt, session and compaction hook context, as a one-shot the next request carries (lib/reminders.ts). */
+	const deliverContext = (event: CcHookEvent, text: string) => pi.events.emit(REMINDER_CHANNEL, { text: hookContextText(event, text), placement: "last-append" });
+	/** UserPromptSubmit context, held until pi delivers its prompt (prompt-context.ts). */
+	const promptContext = new PromptContextRouter();
 	/** The last context seen, for bridged child calls (dispatched parent-side). */
 	let lastCtx: ExtensionContext | undefined;
-	/** True once a prompt opened a turn in this session (before_agent_start). */
-	let prompted = false;
 	/**
 	 * The in-flight SessionStart hook dispatch. It runs OFF the `session_start`
 	 * path so the editor opens immediately (a slow hook used to hold the prompt
@@ -380,12 +381,16 @@ export default function hooksExtension(pi: ExtensionAPI) {
 
 	// ---- UserPromptSubmit ---------------------------------------------------
 	pi.on("input", async (event, ctx) => {
+		// A new idle prompt means an earlier idle one was delivered or never will
+		// be (an extension after this one handled it): its context is stale. An
+		// extension's prompt (a command's sendUserMessage) counts too, or its
+		// message would take that context as its own.
+		if (!event.streamingBehavior) promptContext.dropIdle();
 		if (event.source === "extension") return undefined;
 		// Set for a message queued mid-turn (pi 0.86+ fires `input` for
 		// steer/followUp). The Stop latch is reset in before_agent_start, where a
 		// turn really starts: pi re-checks streaming after these handlers, so a
 		// queued message whose turn ended during the hook opens a new turn.
-		const queued = event.streamingBehavior;
 		const gen = sessionGen;
 		// Drain the backgrounded SessionStart dispatch before this prompt's own
 		// UserPromptSubmit context, so their order in the first turn is unchanged
@@ -400,11 +405,13 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			notify(ctx, `Prompt blocked by UserPromptSubmit hook: ${outcome.block.reason}`);
 			return { action: "handled" as const };
 		}
-		if (!outcome.additionalContext) return undefined;
-		// A queued message's context waits for pi to deliver that message
-		// (message_start below), so it rides the same request.
-		if (queued) queuedPromptContext.hold(event.text, hookContextText("UserPromptSubmit", outcome.additionalContext));
-		else pendingPromptContext.push({ event: "UserPromptSubmit", text: outcome.additionalContext });
+		// The context waits for pi to deliver this prompt (message_start below),
+		// queued mid-turn or not, so it rides the prompt's own request and never a
+		// run a notification opens first. A queued message is held without
+		// context too, so its delivery never takes an idle prompt's.
+		const text = outcome.additionalContext ? hookContextText("UserPromptSubmit", outcome.additionalContext) : undefined;
+		if (event.streamingBehavior) promptContext.holdQueued(event.text, text);
+		else if (text) promptContext.holdIdle(event.text, text);
 		return undefined;
 	});
 
@@ -414,41 +421,35 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	pi.on("message_start", async (event) => {
 		const gen = sessionGen;
 		const message = event.message;
-		const emit = (text: string) => pi.events.emit(REMINDER_CHANNEL, { text, placement: "last-append" });
+		// Pinned to its prompt: when that prompt's request fails, the next prompt's
+		// request resends it with its own context, not with this one's.
+		const emit = (text: string) => pi.events.emit(REMINDER_CHANNEL, { text, placement: "last-append", promptTimestamp: message.timestamp } satisfies ReminderPayload);
 		if (message.role === "user") {
-			if (queuedPromptContext.isEmpty) return;
-			const text = queuedPromptContext.release(contentText(message.content, ""));
+			if (promptContext.isEmpty) return;
+			// A queued message delivers as typed, so an exact match is its own; the
+			// idle prompt's message may carry its expansion instead.
+			const text = promptContext.release(contentText(message.content, ""));
 			if (text) emit(text);
 			return;
 		}
-		// A `/skill:` command the skill extension took over arrives as its hidden
-		// message, carrying the typed text. It opens the turn when the command
-		// was idle, through a sendMessage that never reaches before_agent_start,
-		// so the prompt context waiting there rides this message too.
 		if (message.role !== "custom") return;
-		// A background completion that opens the session's first turn
-		// (lib/prompt-options.ts) skips before_agent_start as well, so the
-		// SessionStart context a typed first prompt would carry rides it.
-		const opensFirstTurn = !prompted && isNotificationDetails(message.details);
-		if (message.customType !== SKILL_INVOCATION_TYPE && !opensFirstTurn) return;
-		if (opensFirstTurn) await drainSessionStart();
-		if (gen !== sessionGen) return;
+		// A background completion that opens the first turn skips
+		// before_agent_start: the SessionStart context must be pending before its
+		// request is rendered.
+		await drainSessionStart();
+		// A `/skill:` command the skill extension took over arrives as its hidden
+		// message, carrying the typed text: that prompt's context rides it.
+		if (message.customType !== SKILL_INVOCATION_TYPE || promptContext.isEmpty) return;
 		const input = (message.details as Partial<SkillInvocationDetails> | undefined)?.input;
-		const queued = typeof input === "string" ? queuedPromptContext.release(input) : undefined;
-		if (queued) emit(queued);
-		const waiting = pendingPromptContext;
-		pendingPromptContext = [];
-		for (const { event: hookEvent, text } of waiting) emit(hookContextText(hookEvent, text));
+		const queued = typeof input === "string" ? promptContext.release(input, true) : undefined;
+		if (gen === sessionGen && queued) emit(queued);
 	});
 
-	// Prompt/session/compaction hook context rides the turn it belongs to as a
-	// custom message pi appends right AFTER the user's prompt (the
-	// before_agent_start `message` return). An idle `sendMessage` from here
-	// landed it BEFORE the prompt (pi appends first, then adds the user message).
+	// The first turn waits for the backgrounded SessionStart dispatch, so its
+	// context is pending before the request is rendered.
 	pi.on("before_agent_start", async (event, ctx) => {
 		const gen = sessionGen;
 		lastCtx = ctx;
-		prompted = true;
 		// The SessionStart dispatch runs in the background from session_start; the
 		// first turn must wait for it so its additionalContext is present (and, on
 		// first run, so its approval dialog gates execution before the model runs).
@@ -461,21 +462,6 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		// continuation keeps the cap counting: a notification or scheduled run
 		// starts a fresh turn, as a prompt does.
 		if (!isStopContinuation(event)) stopHookBlocks = 0;
-		// UserPromptSubmit context belongs to the user's prompt; SessionStart and
-		// PostCompact context belong to whichever run opens next, which on pi
-		// 1.2.0 can be one a notification or scheduled fire opened. Its
-		// message_start can no longer deliver them: `prompted` is set above.
-		const userRun = isUserRun(event);
-		const texts = pendingPromptContext.filter((entry) => userRun || entry.event !== "UserPromptSubmit");
-		if (texts.length === 0) return;
-		pendingPromptContext = pendingPromptContext.filter((entry) => !texts.includes(entry));
-		return {
-			message: {
-				customType: "one-code:hook-context",
-				content: texts.map(({ event, text }) => wrapReminder(hookContextText(event, text))).join("\n"),
-				display: false,
-			},
-		};
 	});
 
 	// ---- SessionStart / SessionEnd -----------------------------------------
@@ -489,10 +475,8 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		});
 		// A later session_start (rapid /clear, resume) may have superseded this one
 		// while its hook ran; discard the stale result instead of pushing it into
-		// the new session's context (`pendingPromptContext` is shared and reset).
-		if (gen === sessionGen && outcome.additionalContext) {
-			pendingPromptContext.push({ event: "SessionStart", text: outcome.additionalContext });
-		}
+		// the new session's context.
+		if (gen === sessionGen && outcome.additionalContext) deliverContext("SessionStart", outcome.additionalContext);
 	};
 
 	pi.on("session_start", (event, ctx) => {
@@ -500,10 +484,8 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		sessionAbort = new AbortController();
 		lastCtx = ctx;
 		const gen = ++sessionGen;
-		pendingPromptContext = [];
-		queuedPromptContext.clear();
+		promptContext.clear();
 		sessionStartPending = undefined;
-		prompted = false;
 		stopHookBlocks = 0;
 		// Publish the child hook bridge (subagent-bridge.ts). The closures read
 		// live parent state per call, so once per session start is enough.
@@ -632,8 +614,10 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	pi.on("agent_settled", async (_event, ctx) => {
 		const gen = sessionGen;
 		// A queued message pi never delivered as typed (expanded, or taken over by
-		// an extension) keeps no context for a later, unrelated prompt.
-		queuedPromptContext.clear();
+		// an extension) keeps no context for a later, unrelated prompt; an idle
+		// prompt that opened no run of its own (one handled after this extension)
+		// keeps none either.
+		promptContext.clear();
 		// CC skips Stop when the turn ended on an API error (a blocking hook would
 		// spiral: error → block → retry → error) or on a user interrupt (its query
 		// loop returns on the abort signal before the stop-hook step). An empty latch
@@ -711,7 +695,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		};
 		const outcome = await dispatch(ctx, "PostCompact", { candidates: [trigger] }, payload);
 		if (gen !== sessionGen) return;
-		if (outcome.additionalContext) pendingPromptContext.push({ event: "PostCompact", text: outcome.additionalContext });
+		if (outcome.additionalContext) deliverContext("PostCompact", outcome.additionalContext);
 		// CC fires SessionStart(source: "compact") after compaction. Awaited inline
 		// (not backgrounded), so the current generation is still in force.
 		await dispatchSessionStart(ctx, "compact", sessionGen);

package/extensions/hooks/prompt-context.ts

@@ -0,0 +1,59 @@
+/**
+ * Which delivered message takes a UserPromptSubmit hook's context. Pure (no pi
+ * imports).
+ *
+ * A message queued mid-turn delivers as typed, so the user message with its
+ * text is its own (lib/queued-delivery.ts). A prompt typed while idle is
+ * expanded by pi after the input handlers (a prompt template, a `/skill:` no
+ * extension took), and a later handler may transform it, so its message
+ * rarely carries the typed text. It is the next prompt pi delivers, though:
+ * the first user message no queued message claims takes it.
+ *
+ * A queued message is held even when its hook added no context, so its
+ * delivery claims nothing instead of taking an idle prompt's context.
+ */
+
+import { QueuedDelivery } from "../lib/queued-delivery.ts";
+
+export class PromptContextRouter {
+	/** Context per queued message; null marks one whose hook added none. */
+	private readonly queued = new QueuedDelivery<string | null>();
+	private idle: Array<{ text: string; payload: string }> = [];
+
+	/** A message queued mid-turn, with its hook's context or none. */
+	holdQueued(text: string, payload: string | undefined): void {
+		this.queued.hold(text, payload ?? null);
+	}
+
+	/** A prompt typed while idle and its hook's context. */
+	holdIdle(text: string, payload: string): void {
+		this.idle.push({ text, payload });
+	}
+
+	/** A new idle prompt: an earlier idle one was delivered or never will be, so its context is stale. */
+	dropIdle(): void {
+		this.idle = [];
+	}
+
+	get isEmpty(): boolean {
+		return this.queued.isEmpty && this.idle.length === 0;
+	}
+
+	/**
+	 * The context for a delivered user message with this text: a queued message
+	 * typed so claims its own (none, when its hook added none); else the idle
+	 * prompt typed so; else, unless `exact`, the oldest idle prompt. Released once.
+	 */
+	release(text: string, exact = false): string | undefined {
+		const queued = this.queued.release(text);
+		if (queued !== undefined) return queued ?? undefined;
+		const at = this.idle.findIndex((entry) => entry.text === text);
+		const index = at === -1 && !exact && this.idle.length > 0 ? 0 : at;
+		return index === -1 ? undefined : this.idle.splice(index, 1)[0].payload;
+	}
+
+	clear(): void {
+		this.queued.clear();
+		this.idle = [];
+	}
+}

package/extensions/hooks/trust.ts

@@ -20,6 +20,7 @@ import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { boundConsentItems } from "../lib/consent-preview.ts";
 import { consentStorePath } from "../lib/consent-stores.ts";
+import { processState } from "../lib/process-state.ts";
 import type { HooksSource } from "./settings.ts";
 
 interface ApprovalStore {
@@ -107,8 +108,13 @@ export interface TrustDecisionDeps {
 	noPrompt?: boolean;
 }
 
-/** Process-lifetime memory of declined/approved hashes per project, so a dispatch storm asks once. */
-const sessionDecisions = new Map<string, boolean>();
+/**
+ * Process-lifetime memory of declined/approved hashes per project, so a
+ * dispatch storm asks once and a "No" holds until the process ends. Process
+ * state (lib/process-state.ts), not module scope: pi evaluates this module
+ * again at `/reload`, which asked again (lifecycle grid R3-L13).
+ */
+const sessionDecisions = () => processState("hooks:trust-decisions", () => new Map<string, boolean>());
 /** Undefined: the dispatch that opened the prompt aborted, so nobody decided. */
 const pendingPrompts = new Map<string, Promise<boolean | undefined>>();
 
@@ -127,15 +133,15 @@ export async function projectHooksApproved(
 	const configHash = hashProjectHooks(projectSources);
 	const key = `${projectRoot}:${configHash}`;
 
-	const remembered = sessionDecisions.get(key);
+	const remembered = sessionDecisions().get(key);
 	if (remembered !== undefined) return remembered;
 	if (readStoredApproval(projectRoot, deps.storePath) === configHash) {
-		sessionDecisions.set(key, true);
+		sessionDecisions().set(key, true);
 		return true;
 	}
 	if (deps.noPrompt) return false;
 	if (!deps.hasUI) {
-		sessionDecisions.set(key, false);
+		sessionDecisions().set(key, false);
 		deps.notify("Project hooks skipped: not yet approved and no UI to ask (user/managed hooks still run).");
 		return false;
 	}
@@ -150,7 +156,7 @@ export async function projectHooksApproved(
 				)) === true;
 			// An interrupted dialog is no trust decision, even if a reply raced abort.
 			if (deps.signal?.aborted) return undefined;
-			sessionDecisions.set(key, approved);
+			sessionDecisions().set(key, approved);
 			if (approved) persistApproval(projectRoot, configHash, deps.storePath);
 			else deps.notify("Project hooks disabled for this session (user/managed hooks still run).");
 			return approved;
@@ -165,6 +171,6 @@ export async function projectHooksApproved(
 
 /** Test seam. */
 export function resetTrustSessionState(): void {
-	sessionDecisions.clear();
+	sessionDecisions().clear();
 	pendingPrompts.clear();
 }