riskrails 3.0.0 → 3.1.0

package/hooks/context-guard.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """Context guard: keep long sessions short, and keep what matters across compaction.
 
-One script, three Claude Code events:
+One script, four Claude Code events:
 
 UserPromptSubmit
     Reads the session's current context size from the transcript (the last
@@ -11,14 +11,19 @@ UserPromptSubmit
     block threshold it holds the prompt back once: sending the same prompt again
     lets it through, so the guard can be overridden but not ignored.
 
-    Both thresholds follow the one knob the profile already sets. Auto-compaction
-    fires about 33k tokens under `autoCompactWindow` (measured over 133 automatic
-    compactions: a 150 000 window compacts at 115–125k, 117k most often), and
-    Claude Code caps that window at the model's own: 200k, or 1M for a [1m] model.
-    The guard warns at 80% of that point and blocks at 120% of it, which is only
-    reached when auto-compaction is off or did not run. An 800 000 window therefore
-    means, on a 200k model, compaction near 167k and a warning from 133k; on a [1m]
-    model, compaction near 767k, a warning from 613k and a block from 920k.
+    Both thresholds follow the window compaction runs against. Auto-compaction
+    fires about 33k tokens under it (measured over 133 automatic compactions: a
+    150 000 window compacts at 115–125k, 117k most often), and Claude Code caps
+    that window at the model's own: 200k, or 1M for a [1m] model. The window is
+    CLAUDE_CODE_AUTO_COMPACT_WINDOW, else settings.json's `autoCompactWindow`, else
+    the economy window in <home>/riskrails/profile.json (`context`, written by
+    `--context economy`), else the model's own; on Codex the first two, Claude Code's
+    own, are skipped. The guard warns at 80% of that
+    point. It blocks at 120% of it — only reached when auto-compaction is off or did
+    not run — and only when a window was configured: in the default mode the runtime
+    compacts on its own and the guard never holds a prompt back. An 800 000 window
+    therefore means, on a 200k model, compaction near 167k and a warning from 133k;
+    on a [1m] model, compaction near 767k, a warning from 613k and a block from 920k.
 
 PreCompact
     Writes a deterministic snapshot of the session — files edited, the latest
@@ -37,6 +42,26 @@ SessionStart
     it: the snapshot belongs to the compaction it was written for, and a startup or a
     /clear simply finds nothing to put back.
 
+    It also asks state.py for the plan drift (R36.18): `profile detect --open --json`
+    with the session id handed on. A drift opens the plan_drift decision (dialog on) or
+    prints the installer command (dialog off, or no .ai/); the account file's mtime is
+    recorded in session.json once detect has answered.
+
+    On a plain startup it also says when npm has a newer `riskrails` than the installed
+    plugin, with the update command (update_notice.py). The hook reads a one-file cache
+    and never waits for the network: a stale cache starts a detached refresh, so the
+    notice appears from the session after the one that found the release. Not repeated
+    on resume, /clear or compact.
+
+Notification
+    auth_success only (the login may have changed the plan): the same detect, which opens
+    the decision and prints nothing. The recorded mtime is left alone, so the next
+    UserPromptSubmit asks again and carries the dialog JSON.
+
+UserPromptSubmit also compares the account file's mtime (~/.claude.json, Codex's
+auth.json) with the one recorded in session.json and, when it moved, runs the drift
+check once for that mtime.
+
 Both runtimes: the script derives which one it serves from its own location, and no
 decision here depends on a payload key. The transcript-derived snapshot stays
 Claude-only — it is built from a Claude transcript and the rollout format differs —
@@ -49,6 +74,7 @@ Environment:
     AI_CONTEXT_GUARD_STATE    state directory, default ~/.claude/state/context-guard
     AI_HOOK_RUNTIME           claude|codex, for tests: normally the script's own path decides
     AI_HANDOFF_NO_PROMPT      1 keeps the user's prompt out of .ai/state/session.json
+    RISKRAILS_NO_UPDATE_CHECK non-empty turns the SessionStart update notice off (CI does too)
 """
 import hashlib
 import json
@@ -71,7 +97,7 @@ FILES_KEPT = 40
 STATUS_LINES = 40
 EDIT_TOOLS = {"Edit", "Write", "MultiEdit", "NotebookEdit"}
 
-DEFAULT_WINDOW = 800000            # profiles/max.json; capped per model below
+ECONOMY_WINDOW = 800000            # profiles/max.json riskrails.economy; Codex economy uses it too
 MODEL_WINDOW, MODEL_WINDOW_1M = 200000, 1000000
 COMPACT_RESERVE = 33000            # auto-compaction fires this far under the window
 WARN_PCT, BLOCK_PCT = 80, 120      # of the point where auto-compaction fires
@@ -122,25 +148,59 @@ def model_window(session_id, ctx):
     return MODEL_WINDOW
 
 
+def profile_context():
+    """profile.json's `context` ({mode, window}) in this runtime's home; {} when absent."""
+    home = config_dir()
+    if hook_runtime() == "codex":
+        home = os.environ.get("CODEX_HOME") or os.path.expanduser("~/.codex")
+    try:
+        with open(os.path.join(home, "riskrails", "profile.json"), encoding="utf-8") as fh:
+            context = json.load(fh).get("context")
+        return context if isinstance(context, dict) else {}
+    except (OSError, ValueError, AttributeError):
+        return {}
+
+
+def configured_window():
+    """The window someone set — the env var, settings.json, or the economy profile — or 0.
+    The first two are Claude Code's own and never decide for Codex, whose only source is
+    its profile.json; economy without a window of its own (a Codex profile) keeps the 800k
+    it always had."""
+    if hook_runtime() != "codex":
+        for window in (positive_int(os.environ.get("CLAUDE_CODE_AUTO_COMPACT_WINDOW")),
+                       positive_int(user_settings().get("autoCompactWindow"))):
+            if window > COMPACT_RESERVE:
+                return window
+    context = profile_context()
+    if context.get("mode") == "economy":
+        window = positive_int(context.get("window"))
+        return window if window > COMPACT_RESERVE else ECONOMY_WINDOW
+    return 0
+
+
 def compact_window(session_id, ctx):
-    """The window Claude Code compacts against: the env var wins over settings.json, and
-    Claude Code caps either at the model's window (\"capped to … by model\" in /autocompact),
-    so one 800k setting compacts a 1M session near 767k and a 200k session near 167k."""
-    window = positive_int(os.environ.get("CLAUDE_CODE_AUTO_COMPACT_WINDOW"))
-    if not window:
-        window = positive_int(user_settings().get("autoCompactWindow"))
-    window = window if window > COMPACT_RESERVE else DEFAULT_WINDOW
-    return min(window, model_window(session_id, ctx))
+    """The window the runtime compacts against: a configured one, else the model's own.
+    Claude Code caps a configured window at the model's (\"capped to … by model\" in
+    /autocompact), so one 800k setting compacts a 1M session near 767k and a 200k
+    session near 167k."""
+    model = model_window(session_id, ctx)
+    return min(configured_window() or model, model)
 
 
 def thresholds(session_id, ctx):
+    """Warn and block, in tokens; 0 is off. With no window configured the runtime
+    compacts on its own: the guard warns and blocks only when AI_CONTEXT_BLOCK_TOKENS
+    asks it to."""
     fires_at = compact_window(session_id, ctx) - COMPACT_RESERVE
+    blocks = bool(configured_window())
 
-    def one(name, pct):
+    def one(name, pct, on=True):
         raw = os.environ.get(name, "").strip()
-        return positive_int(raw) if raw.lstrip("-").isdigit() else fires_at * pct // 100
+        if raw.lstrip("-").isdigit():
+            return positive_int(raw)
+        return fires_at * pct // 100 if on else 0
 
-    return one("AI_CONTEXT_WARN_TOKENS", WARN_PCT), one("AI_CONTEXT_BLOCK_TOKENS", BLOCK_PCT)
+    return one("AI_CONTEXT_WARN_TOKENS", WARN_PCT), one("AI_CONTEXT_BLOCK_TOKENS", BLOCK_PCT, blocks)
 
 
 def state_dir():
@@ -267,9 +327,9 @@ def scan_session(path):
     return files, prompts[-PROMPTS_KEPT:], todos
 
 
-def run(cmd, cwd):
+def run(cmd, cwd, env=None):
     try:
-        out = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True, timeout=3, check=False)
+        out = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True, timeout=3, check=False, env=env)
         return out.stdout.strip() if out.returncode == 0 else ""
     except (OSError, subprocess.SubprocessError):
         return ""
@@ -366,14 +426,97 @@ def write_session(root, updates):
         pass
 
 
-def state_py(root, *args):
+def prompt_count(root):
+    """session.json's count of human turns; 0 when there is none yet."""
+    try:
+        with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
+            count = json.load(fh).get("prompt_count")
+    except (OSError, ValueError, AttributeError):
+        return 0
+    return count if isinstance(count, int) and not isinstance(count, bool) else 0
+
+
+def state_py(root, *args, session=None):
     """state.py is the only thing that renders a handoff or reads the questions.
     Three seconds inside a fifteen-second hook, and an empty string on anything
-    at all going wrong: the guard fails open."""
+    at all going wrong: the guard fails open. A session id is handed on as the
+    runtime's own variable, which is what state.py binds a dialog to."""
     if not os.path.exists(STATE_PY):
         return ""
+    env = None
+    if session:
+        env = dict(os.environ, **{"CLAUDE_CODE_SESSION_ID" if hook_runtime() == "claude"
+                                  else "CODEX_THREAD_ID": session})
     return run([sys.executable or "python3", STATE_PY, "--root", root,
-                "--runtime", hook_runtime(), *args], root)
+                "--runtime", hook_runtime(), *args], root, env)
+
+
+# ------------------------------------------------------------------ plan drift
+
+def account_file():
+    """The file whose change means the account changed (R36.18)."""
+    if hook_runtime() == "codex":
+        return os.path.join(os.environ.get("CODEX_HOME") or os.path.expanduser("~/.codex"), "auth.json")
+    return os.path.join(os.environ.get("HOME") or os.path.expanduser("~"), ".claude.json")
+
+
+def account_mtime():
+    try:
+        return os.path.getmtime(account_file())
+    except OSError:
+        return None
+
+
+def recorded_mtime(root):
+    try:
+        with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
+            return json.load(fh).get("account_mtime")
+    except (OSError, ValueError, AttributeError):
+        return None
+
+
+def detect_drift(root, cwd, session, open_it=True, mtime=None):
+    """`state.py profile detect --open --json`, parsed; None unless it says drift.
+    Without .ai/ there is nowhere to open a decision: the same call, read-only.
+    `mtime`, when given, is recorded in session.json only once detect printed JSON."""
+    if root:
+        raw = state_py(root, "profile", "detect", *(("--open",) if open_it else ()), "--json", session=session)
+    elif os.path.exists(STATE_PY):
+        raw = run([sys.executable or "python3", STATE_PY, "--runtime", hook_runtime(), "profile", "detect",
+                   "--json"], cwd or os.getcwd())
+    else:
+        raw = ""
+    try:
+        found = json.loads(raw)
+    except ValueError:
+        return None
+    if root and mtime is not None and isinstance(found, dict):
+        write_session(root, {"account_mtime": mtime})
+    return found if isinstance(found, dict) and found.get("status") == "drift" else None
+
+
+def drift_notice(root, found, session):
+    """(systemMessage, additionalContext) for one drift. With a decision open
+    the context carries the dialog JSON; otherwise the terminal command."""
+    installed = (found.get("installed") or {}).get("plan") or "unknown"
+    live = (found.get("live") or {}).get("plan") or "unknown"
+    names = {"max20": "Max 20x", "max": "Max", "pro": "Pro", "team-pro": "Team Pro", "team-max": "Team Max",
+             "plus": "Plus"}
+    account = names.get(live, live)
+    installed = names.get(installed, installed)
+    decision = found.get("decision")
+    if decision and root:
+        payload = state_py(root, "decision", "show", "--id", decision, "--json", session=session)
+        if payload:
+            tool = "request_user_input" if hook_runtime() == "codex" else "AskUserQuestion"
+            return (f"RiskRails: this account is {account}; RiskRails is installed for {installed}. "
+                    "The session asks before anything else.",
+                    f"DIALOG_PENDING {decision} — call {tool} with exactly this JSON, then run the picked "
+                    f"command verbatim or 'state.py decision settle --id {decision}': {payload}")
+    command = found.get("command") or ""
+    return (f"RiskRails: this account is {account}; RiskRails is installed for {installed}.",
+            f"RiskRails: the account's plan is {account} but RiskRails is installed for {installed}, so its "
+            f"budgets do not match. Tell the user; in their own terminal, outside the agent, they run: {command}")
 
 
 def handoff_block(root, reason):
@@ -409,7 +552,7 @@ def task_frame(root, reason):
         tail.append(f"## Pending questions ({count}) — answer with `state.py answer …` "
                     "or fill the file")
         tail.append(prose or ids)
-    tail.append("Resume with: /ai-task --resume")
+    tail.append("Resume with: /rr-build --resume")
     if len("\n".join([head] + tail)) > HANDOFF_INJECT_MAX_CHARS and len(tail) > 1:
         tail[1] = ids                     # the questions collapse to their ids
     return head[:HANDOFF_INJECT_MAX_CHARS], "\n".join(tail)
@@ -465,6 +608,7 @@ def on_prompt(payload):
     transcript = payload.get("transcript_path")
     session = payload.get("session_id") or "unknown"
     root = ai_root(payload.get("cwd"))
+    update = None
     if task_in_flight(root):
         # The evidence that a human took a turn — what the gate's file route
         # (R13) reads back. Recorded before any early exit below.
@@ -472,7 +616,41 @@ def on_prompt(payload):
                   "last_prompt_at": stamp()}
         if not os.environ.get("AI_HANDOFF_NO_PROMPT"):
             update["last_prompt"] = (payload.get("prompt") or "")[:PROMPT_MAX_CHARS]
+    if root and (update is not None or os.path.isfile(os.path.join(root, ".ai", "state", "decision.json"))):
+        # R36.13: the human turn dialog-gate.py's Stop counter resets on.
+        update = dict(update or {}, prompt_count=prompt_count(root) + 1)
+    if update is not None:
         write_session(root, update)
+    doc = prompt_warning(payload, session, transcript)
+    if (doc or {}).get("decision") != "block":
+        doc = with_drift(doc, root, payload, session)
+    if doc:
+        emit(doc)
+    sys.exit(0)
+
+
+def with_drift(doc, root, payload, session):
+    """R36.18: when the account file's mtime is not the one recorded, ask for the
+    drift again and put what it says into the prompt's output. Unchanged mtime,
+    no .ai/ or no account file: `doc` as it was."""
+    mtime = account_mtime()
+    if not root or mtime is None or mtime == recorded_mtime(root):
+        return doc
+    found = detect_drift(root, payload.get("cwd"), session, mtime=mtime)
+    if not found:
+        return doc
+    message, context = drift_notice(root, found, session)
+    doc = dict(doc or {})
+    out = dict(doc.get("hookSpecificOutput") or {}, hookEventName="UserPromptSubmit")
+    out["additionalContext"] = "\n\n".join(p for p in (context, out.get("additionalContext")) if p)
+    doc["hookSpecificOutput"] = out
+    doc["systemMessage"] = "\n".join(p for p in (message, doc.get("systemMessage")) if p)
+    return doc
+
+
+def prompt_warning(payload, session, transcript):
+    """The context-size warning or block for this prompt, as the hook's output
+    document, or None."""
     ctx = current_context(transcript) if transcript else None
     marker = state_path(session, "json")
     try:
@@ -489,7 +667,7 @@ def on_prompt(payload):
     if ctx is None or (not warn or ctx < warn) and (not block or ctx < block):
         if state:
             os.remove(marker)       # back under the threshold, e.g. after a compaction
-        sys.exit(0)
+        return None
 
     k = round(ctx / 1000)
     if block and ctx >= block:
@@ -497,20 +675,20 @@ def on_prompt(payload):
         if state.get("blocked") != digest:
             state["blocked"] = digest
             save()
-            emit({"decision": "block", "reason": (
+            return ({"decision": "block", "reason": (
                 f"Context is {k}k tokens, past the {block // 1000}k limit: every turn re-reads all of it. "
                 "Run /compact (or /clear if this is a new task) and send the prompt again. "
                 "To go ahead anyway, send the same prompt once more.")})
         state.pop("blocked")
         save()
-        sys.exit(0)             # the same prompt a second time: the user has decided
+        return None            # the same prompt a second time: the user has decided
 
     band = ctx // 10000
     if band <= state.get("band", -1):
-        sys.exit(0)
+        return None
     state["band"] = band
     save()
-    emit({
+    return ({
         "systemMessage": f"Context is {k}k tokens (warning from {warn // 1000}k). "
                          "/compact keeps the thread, /clear starts a new task.",
         "hookSpecificOutput": {
@@ -561,8 +739,26 @@ def take_snapshot(session, transcript):
     return text
 
 
+def update_notice_for(payload):
+    """The npm update notice for a startup, as (systemMessage, additionalContext); fails open."""
+    if payload.get("source") not in (None, "", "startup"):
+        return "", ""
+    try:
+        sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+        import update_notice  # pylint: disable=import-outside-toplevel
+        runtime = hook_runtime()
+        home = config_dir()
+        if runtime == "codex":
+            home = os.environ.get("CODEX_HOME") or os.path.expanduser("~/.codex")
+        plugin_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+        return update_notice.notice(runtime, home, plugin_root, time.time())
+    except Exception:  # pylint: disable=broad-except
+        return "", ""
+
+
 def on_session_start(payload):
     session = payload.get("session_id") or "unknown"
+    drift_session = payload.get("session_id") or None
     model = payload.get("model")
     if isinstance(model, str) and model:
         with open(state_path(session, "model"), "w", encoding="utf-8") as fh:
@@ -580,11 +776,19 @@ def on_session_start(payload):
     snapshot = take_snapshot(session, payload.get("transcript_path"))
     if snapshot:
         head = snapshot          # it already carries handoff.md verbatim, at its head
-    text = "\n\n".join(part for part in (head, tail) if part)
+    # R36.18: a drift between the installed plan and the account's, asked about first.
+    mtime = account_mtime()
+    found = detect_drift(root, payload.get("cwd"), drift_session, mtime=mtime)
+    message, notice = drift_notice(root, found, session) if found else ("", "")
+    update, update_context = update_notice_for(payload)
+    message = "\n".join(part for part in (message, update) if part)
+    text = "\n\n".join(part for part in (notice, head, tail, update_context) if part)
     if not text:
         sys.exit(0)
-    print(json.dumps({"hookSpecificOutput": {
-        "hookEventName": "SessionStart", "additionalContext": text}}))
+    doc = {"hookSpecificOutput": {"hookEventName": "SessionStart", "additionalContext": text}}
+    if message:
+        doc = dict({"systemMessage": message}, **doc)
+    print(json.dumps(doc))
     sys.stdout.flush()
     if snapshot:
         try:
@@ -596,11 +800,23 @@ def on_session_start(payload):
     sys.exit(0)
 
 
+def on_notification(payload):
+    """auth_success (Claude): the login may have changed the plan. Only opens the
+    decision and prints nothing; account_mtime is left as it was, so the next
+    prompt asks again and carries the JSON (R36.18)."""
+    if payload.get("notification_type") not in (None, "auth_success"):
+        sys.exit(0)
+    root = ai_root(payload.get("cwd"))
+    if root:
+        detect_drift(root, payload.get("cwd"), payload.get("session_id") or None)
+    sys.exit(0)
+
+
 def main():
     try:
         payload = json.load(sys.stdin)
         handler = {"UserPromptSubmit": on_prompt, "PreCompact": on_precompact,
-                   "SessionStart": on_session_start}.get(payload.get("hook_event_name"))
+                   "SessionStart": on_session_start, "Notification": on_notification}.get(payload.get("hook_event_name"))
         if handler:
             handler(payload)
     except Exception:  # pylint: disable=broad-exception-caught  # fail open: the guard never blocks work by crashing

package/hooks/dialog-gate.py

@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+"""RiskRails: the dialog's recorder and Stop reminder (R36.6, R36.13).
+
+  PostToolUse on the dialog tool (Claude AskUserQuestion, Codex
+      request_user_input): the human's answers, read from tool_response, become
+      consent-ledger lines (.ai/state/consent.jsonl) — a pick per offered
+      command chosen, or a decline. Prints nothing.
+  Stop: while a decision is open, blocks the stop with the JSON to send, at
+      most stop_blocks_max times per decision per human turn (the turn is
+      session.json's prompt_count, which context-guard.py counts); then lets
+      the turn end with a systemMessage naming the terminal way out.
+  Anything else: exit 0, silent.
+
+Never a deny, and inert unless the effective switch is on (hooks/guard/dialog.py):
+with .ai/policies/dialog.json missing or off it reads nothing more and writes
+nothing. Fails open: any error exits 0 with no output. Run as
+`python3 -I -S`: stdlib only.
+"""
+import json
+import os
+import shlex
+import sys
+
+
+def ai_root(cwd):
+    """Nearest ancestor of cwd holding a .ai/ directory, or None."""
+    d = os.path.abspath(cwd) if cwd else None
+    while d:
+        if os.path.isdir(os.path.join(d, ".ai")):
+            return d
+        parent = os.path.dirname(d)
+        d = None if parent == d else parent
+    return None
+
+
+def prompt_count(root):
+    try:
+        with open(os.path.join(root, ".ai", "state", "session.json"), encoding="utf-8") as fh:
+            count = json.load(fh).get("prompt_count")
+    except (OSError, ValueError, AttributeError):
+        return None
+    return count if isinstance(count, int) and not isinstance(count, bool) else None
+
+
+def on_stop(dialog, root, runtime, payload):
+    # Only the session and runtime that opened a decision answer it (7d2).
+    decisions = dialog.pending(dialog.bound(dialog.read_decisions(root), runtime, payload.get("session_id")),
+                               dialog.read_ledger(root))
+    policy = dialog.dialog_policy(root)
+    if not decisions or policy is None:
+        return None
+    ids = [d["id"] for d in decisions]
+    turn, session = prompt_count(root), payload.get("session_id")
+    state = shlex.quote(dialog.STATE_PY)
+    escape = ("python3 %s --root %s decision settle --id %s --pick <n>  (or: decision fallback --id %s "
+              "--why \"<why>\")" % (state, shlex.quote(root), ids[0], ids[0]))
+    # Without a turn to count by, stop_hook_active is the loop breaker.
+    if turn is None and payload.get("stop_hook_active"):
+        blocks = policy["stop_blocks_max"]
+    else:
+        blocks = sum(1 for e in dialog.read_ledger(root, types={dialog.STOP_BLOCK})
+                     if e.get("session") == session and e.get("turn") == turn and e.get("decisions") == ids)
+    if blocks >= policy["stop_blocks_max"]:
+        return {"systemMessage": "DECISION_PENDING %s is still open. Settle it in your terminal: %s"
+                                 % (" ".join(ids), escape)}
+    with dialog.ledger_lock(root):
+        dialog.ledger_append(root, {"type": dialog.STOP_BLOCK, "session": session, "turn": turn,
+                                    "decisions": ids})
+    tool = dialog.DIALOG_TOOL[runtime]
+    return {"decision": "block", "reason": (
+        "DECISION_PENDING %s — call %s with exactly this JSON, then run the picked command verbatim, "
+        "or 'state.py decision settle --id %s': %s"
+        % (" ".join(ids), tool, ids[0], json.dumps(dialog.dialog_payload(decisions, runtime), ensure_ascii=False)))}
+
+
+def main():
+    try:
+        hook_dir = os.path.dirname(os.path.abspath(__file__))
+        if hook_dir not in sys.path:
+            sys.path.insert(0, hook_dir)
+        from guard import dialog            # pylint: disable=import-outside-toplevel
+        payload = json.loads(sys.stdin.buffer.read().decode("utf-8", "replace"))
+        if not isinstance(payload, dict):
+            return 0
+        event = payload.get("hook_event_name")
+        if event not in ("PostToolUse", "Stop"):
+            return 0
+        root = ai_root(payload.get("cwd") or os.getcwd())
+        runtime = dialog.payload_runtime(payload, __file__)
+        if not root or not dialog.effective_switch(root, runtime, payload):
+            return 0
+        if event == "PostToolUse":
+            dialog.record(root, runtime, payload)
+            return 0
+        out = on_stop(dialog, root, runtime, payload)
+        if out:
+            sys.stdout.write(json.dumps(out, ensure_ascii=False))
+            sys.stdout.flush()
+    except Exception:                       # pylint: disable=broad-exception-caught
+        return 0
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/guard/common.py

@@ -165,6 +165,8 @@ _WS = " \t\n\r"
 def parse_stream(text):
     """(values, ok): every JSON value of a jq input stream, and False when a
     parse error ended it (the values before the error are kept)."""
+    if text.startswith("\ufeff"):                  # jq skips one leading UTF-8 BOM
+        text = text[1:]
     values, i, n = [], 0, len(text)
     while True:
         while i < n and text[i] in _WS:
@@ -341,7 +343,12 @@ class Payload:
             elif isinstance(ti, dict) and _plain(ti.get("command")):
                 self.command = chomp_all(_sh(ti.get("command")))
                 self.command_ok = True
+            # R36 (7d1): what binds a dialog pick to its session; empty when absent.
+            for name in ("session_id", "transcript_path", "tool_use_id"):
+                setattr(self, name, chomp_all(_sh(v.get(name))))
         else:
+            for name in ("session_id", "transcript_path", "tool_use_id"):
+                setattr(self, name, chomp_all(jq_field_r(self.values, name)[0]))
             out, ok = jq_field_r(self.values, "tool_name")
             if not ok:
                 raise Allow()