wendkeep 0.65.0 → 0.66.0

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.66.0] — 2026-07-29
+
+### Added
+
+- **O workspace privado Integrations passa a ter um kernel canônico para Claude Code e Codex.**
+  Catálogo/projeção de hooks, envelope e provider, filtros de conteúdo, normalização de uso,
+  parsers de transcript e identidade de sessão/turno agora vivem em módulos puros sob
+  `packages/integrations/src/`, sem filesystem, ambiente global, Vault ou registry no import.
+- **O tarball instalado prova a fronteira completa fora do checkout.** O teste executa `init` e
+  um hook `session-ensure` em consumidor temporário, valida estado persistido e as projeções
+  Claude/Codex contra o kernel empacotado, e confirma que Integrations permanece interno à
+  única publicação `wendkeep`.
+
+### Changed
+
+- **As fachadas históricas agora injetam efeitos no kernel de Integrations.** Taxonomia e hooks
+  preservam assinaturas e identidade dos exports enquanto stdin/stdout, `process.env`, leitura de
+  transcripts, acesso ao Vault e ao registry continuam nas bordas; paths, schemas, configs e
+  sessões existentes não exigem migração.
+- **Os workspaces privados deixaram de vazar por deep imports do wildcard raiz.** A allowlist de
+  exports mantém `wendkeep/harness`, `wendkeep/vault` e os caminhos históricos publicados, mas
+  bloqueia `packages/*`, inclusive variantes percent-encoded; MCP e Integrations seguem como
+  adapters irmãos sem dependência direta.
+
+### Fixed
+
+- **A reconexão de sessão por transcript agora respeita o provider.** Uma entrada do registry de
+  outro host é ignorada sem substituir uma identidade canônica válida já inspecionada.
+- **A suíte integral mantém determinismo sob carga de I/O no Windows.** O runner limita a duas as
+  files executadas em paralelo, preservando a concorrência multiprocesso dentro dos testes de
+  CAS/locks e todos os asserts, sem falsos vermelhos causados por starvation entre suítes.
+
 ## [0.65.0] — 2026-07-29
 
 ### Added

package/README.en.md

@@ -17,14 +17,24 @@
 
 The runtime is being separated into six physical boundaries — `cli`, `harness`, `vault`, `mcp`,
 `integrations`, and `pi` — without fragmenting installation. The private `cli`, `harness`,
-`vault`, and `mcp` workspaces now canonically own the executable runtime, Operating Profiles/the
-sensor engine, safe binding/the Shared Project Memory v2 kernel, and the MCP configuration kernel,
-respectively. The root package exposes Harness and Vault through `wendkeep/harness` and
-`wendkeep/vault`; CLI and MCP remain private surfaces, reached only through the binaries and the
-configuration effects of `init`. Historical imports keep working through compatibility facades
+`vault`, `mcp`, and `integrations` workspaces now canonically own the executable runtime,
+Operating Profiles/the sensor engine, safe binding/the Shared Project Memory v2 kernel, the MCP
+configuration kernel, and pure Claude/Codex integration rules, respectively. The root package
+exposes Harness and Vault through `wendkeep/harness` and `wendkeep/vault`; CLI, MCP, and
+Integrations remain private surfaces, reached only through the binaries, the configuration effects
+of `init`, and historical facades. Historical imports keep working through compatibility facades
 and no session data needs migration;
 see the [modular architecture](docs/en/architecture.md).
 
+In the **0.66 Integrations Kernel** phase, `packages/integrations/src/` becomes the canonical
+authority for the hook catalog and projection, the envelope/provider, transcript content and usage
+filters and parsers, and session identity. These rules are pure: stdin/stdout, environment,
+filesystem, Vault, and registry effects remain in the historical facades. MCP and Integrations are
+sibling adapters with no dependency between them, and the direction remains
+`cli/mcp/integrations/pi → Harness → Vault`. Hooks, sessions, paths, configuration, and schemas
+remain equivalent; the private `@wendkeep/integrations` workspace stays inside the single
+published `wendkeep` package, with no public `wendkeep/integrations` subpath. Pi is the next phase.
+
 In the **0.65 MCP Configuration Kernel** phase, `packages/mcp/src/config.mjs` becomes the
 canonical authority for the MCPVault entry, catalog-described server selection, and `.mcp.json`
 merging. `src/taxonomy.mjs` supplies descriptors while `src/init.mjs` retains only filesystem

package/README.md

@@ -17,14 +17,24 @@
 
 The runtime is being separated into six physical boundaries — `cli`, `harness`, `vault`, `mcp`,
 `integrations`, and `pi` — without fragmenting installation. The private `cli`, `harness`,
-`vault`, and `mcp` workspaces now canonically own the executable runtime, Operating Profiles/the
-sensor engine, safe binding/the Shared Project Memory v2 kernel, and the MCP configuration kernel,
-respectively. The root package exposes Harness and Vault through `wendkeep/harness` and
-`wendkeep/vault`; CLI and MCP remain private surfaces, reached only through the binaries and the
-configuration effects of `init`. Historical imports keep working through compatibility facades
+`vault`, `mcp`, and `integrations` workspaces now canonically own the executable runtime,
+Operating Profiles/the sensor engine, safe binding/the Shared Project Memory v2 kernel, the MCP
+configuration kernel, and pure Claude/Codex integration rules, respectively. The root package
+exposes Harness and Vault through `wendkeep/harness` and `wendkeep/vault`; CLI, MCP, and
+Integrations remain private surfaces, reached only through the binaries, the configuration effects
+of `init`, and historical facades. Historical imports keep working through compatibility facades
 and no session data needs migration;
 see the [modular architecture](docs/en/architecture.md).
 
+In the **0.66 Integrations Kernel** phase, `packages/integrations/src/` becomes the canonical
+authority for the hook catalog and projection, the envelope/provider, transcript content and usage
+filters and parsers, and session identity. These rules are pure: stdin/stdout, environment,
+filesystem, Vault, and registry effects remain in the historical facades. MCP and Integrations are
+sibling adapters with no dependency between them, and the direction remains
+`cli/mcp/integrations/pi → Harness → Vault`. Hooks, sessions, paths, configuration, and schemas
+remain equivalent; the private `@wendkeep/integrations` workspace stays inside the single
+published `wendkeep` package, with no public `wendkeep/integrations` subpath. Pi is the next phase.
+
 In the **0.65 MCP Configuration Kernel** phase, `packages/mcp/src/config.mjs` becomes the
 canonical authority for the MCPVault entry, catalog-described server selection, and `.mcp.json`
 merging. `src/taxonomy.mjs` supplies descriptors while `src/init.mjs` retains only filesystem

package/docs/en/commands/getting-started.md

@@ -78,6 +78,14 @@ When MCP is enabled, `init` preserves existing properties and servers in `.mcp.j
 and the reconciled proposal is written to `.mcp.json.new`. Since version 0.65, this composition is
 owned by the private MCP kernel without changing commands, flags, or the public npm surface.
 
+Pure rules that project Claude/Codex hooks and interpret envelopes, transcripts, usage, and
+identity belong to the private `@wendkeep/integrations` workspace. Historical facades retain
+stdin/stdout, environment, filesystem, Vault, and registry effects. This adds no commands or flags,
+changes neither hooks nor sessions, and requires no Vault, configuration, path, or schema migration.
+MCP and Integrations remain sibling adapters with no dependency between them, and the direction
+remains `cli/mcp/integrations/pi → Harness → Vault`. Everything stays inside the single published
+`wendkeep` package; there is no public `wendkeep/integrations` surface. Pi is the next modular phase.
+
 ## Common errors and diagnosis
 
 - Wrong vault: inspect `.wendkeep.json` and run `wendkeep doctor --vault <path>`.

package/docs/pt-BR/commands/getting-started.md

@@ -79,6 +79,14 @@ e adiciona `wendkeep-vault`. Se o JSON existente for inválido, o arquivo origin
 a byte intacto e a proposta reconciliada é gravada em `.mcp.json.new`. Desde a versão 0.65, essa
 composição pertence ao kernel MCP privado, sem alterar comandos, flags ou a superfície npm pública.
 
+As regras puras que projetam os hooks de Claude/Codex e interpretam envelopes, transcripts, uso e
+identidade pertencem ao workspace privado `@wendkeep/integrations`. As fachadas históricas mantêm
+os efeitos de stdin/stdout, ambiente, filesystem, Vault e registry. Isso não acrescenta comandos ou
+flags, não altera hooks ou sessões e não exige migração de cofre, config, paths ou schemas. MCP e
+Integrations permanecem adapters irmãos sem dependência, e a direção continua
+`cli/mcp/integrations/pi → Harness → Vault`. Tudo permanece dentro do único pacote publicado
+`wendkeep`; não existe `wendkeep/integrations` público. A próxima fase modular é Pi.
+
 ## Erros comuns e diagnóstico
 
 - Cofre errado: confira `.wendkeep.json` e rode `wendkeep doctor --vault <path>`.

package/hooks/obsidian-common.mjs

@@ -7,6 +7,26 @@ import { resolveProjectVault } from '../src/project-vault.mjs';
 import {
   assertVaultPathSafe, mkdirVaultPath, writeVaultFileAtomic,
 } from './vault-path-safety.mjs';
+import {
+  salvageTruncatedJson,
+  parseHookInput,
+  stringifyHookOutput,
+  detectProvider as detectProviderFromEnvironment,
+  providerMeta as providerMetaFromProvider,
+  extractHookPrompt,
+} from '../packages/integrations/src/hook-envelope.mjs';
+import {
+  isBootstrapPrompt,
+  redactSecrets,
+} from '../packages/integrations/src/prompt-content.mjs';
+import { transcriptsMatch } from '../packages/integrations/src/session-identity.mjs';
+export {
+  salvageTruncatedJson,
+  extractHookPrompt,
+  isBootstrapPrompt,
+  redactSecrets,
+  transcriptsMatch,
+};
 
 // Deprecated export kept for consumers that imported it before 0.39.0. Automatic
 // hooks never use this fallback: an unbound project fails closed.
@@ -27,56 +47,12 @@ export const VAULT_COMPLEMENT_RULES = [
   'Atualize `SHARED_MEMORY.md` somente quando a síntese mudar estado ativo que outro agente precise saber.',
 ];
 
-// Codex on Windows serializes the Stop payload with `last_assistant_message` cut mid-string
-// and never closed when the assistant text carries non-ASCII (openai/codex#23784). That field
-// is LAST in codex-rs's StopCommandInput, so everything wendkeep consumes — session_id,
-// turn_id, transcript_path, cwd — sits in the intact prefix.
-//
-// One pass, tracking quotes/escapes/depth, remembering the offset of the last top-level comma
-// that was NOT inside a string. Re-closing there yields the well-formed prefix. Deliberately
-// NOT a decreasing brute-force parse: this runs on every turn and the payload can be tens of
-// KB. The truncated field is dropped, never reconstructed — half an assistant message is
-// invented data, and it is the one field we do not need.
-export function salvageTruncatedJson(raw) {
-  const text = String(raw || '');
-  if (text[0] !== '{') return null;
-  let inString = false;
-  let escaped = false;
-  let depth = 0;
-  let lastBoundary = -1;
-  for (let i = 0; i < text.length; i += 1) {
-    const ch = text[i];
-    if (escaped) { escaped = false; continue; }
-    if (ch === '\\') { if (inString) escaped = true; continue; }
-    if (ch === '"') { inString = !inString; continue; }
-    if (inString) continue;
-    if (ch === '{' || ch === '[') depth += 1;
-    else if (ch === '}' || ch === ']') depth -= 1;
-    else if (ch === ',' && depth === 1) lastBoundary = i;
-  }
-  if (lastBoundary === -1) return null;
-  try {
-    const parsed = JSON.parse(`${text.slice(0, lastBoundary)}}`);
-    return parsed && typeof parsed === 'object' ? parsed : null;
-  } catch { return null; }
-}
-
 export function readHookInput() {
-  const raw = readFileSync(0, 'utf-8').trim();
-  if (!raw) return {};
-  try {
-    return JSON.parse(raw);
-  } catch (error) {
-    const salvaged = salvageTruncatedJson(raw);
-    // `_wk` prefix: the object is the harness payload merged with our own metadata, and a
-    // silent key collision here would be worse than the ugly prefix.
-    if (salvaged) return { ...salvaged, _wkSalvaged: true };
-    throw error;
-  }
+  return parseHookInput(readFileSync(0, 'utf-8'));
 }
 
 export function writeHookOutput(payload = {}) {
-  process.stdout.write(JSON.stringify(payload));
+  process.stdout.write(stringifyHookOutput(payload));
 }
 
 // Resolve from explicit hook payload or the nearest project-local binding. A legacy
@@ -118,17 +94,11 @@ export function warnIfDefaultVault(input = {}) {
 // Detecta o agente real que está executando o hook. Claude Code expõe
 // CLAUDECODE / CLAUDE_CODE_SESSION_ID / CLAUDE_PROJECT_DIR; Codex não.
 export function detectProvider() {
-  if (process.env.CLAUDECODE === '1' || process.env.CLAUDE_CODE_SESSION_ID || process.env.CLAUDE_PROJECT_DIR) {
-    return 'claude';
-  }
-  return 'codex';
+  return detectProviderFromEnvironment(process.env);
 }
 
 export function providerMeta(provider = detectProvider()) {
-  if (provider === 'claude') {
-    return { id: 'claude', label: 'Claude Code', tag: 'claude', source: 'claude-hook' };
-  }
-  return { id: 'codex', label: 'Codex', tag: 'codex', source: 'codex-hook' };
+  return providerMetaFromProvider(provider);
 }
 
 export function ensureDir(path) {
@@ -807,44 +777,6 @@ export function keysBate(a = '', b = '') {
   return a === b || a.startsWith(b) || b.startsWith(a);
 }
 
-export function extractHookPrompt(input = {}) {
-  const candidates = [
-    input.prompt,
-    input.user_prompt,
-    input.userPrompt,
-    input.message,
-    input.input,
-  ];
-
-  for (const candidate of candidates) {
-    if (typeof candidate === 'string' && candidate.trim()) return candidate.trim();
-  }
-
-  if (Array.isArray(input.messages)) {
-    const text = input.messages
-      .map((message) => message?.content || message?.text || '')
-      .filter((item) => typeof item === 'string' && item.trim())
-      .join('\n')
-      .trim();
-    if (text) return text;
-  }
-
-  return '';
-}
-
-export function isBootstrapPrompt(text = '') {
-  const clean = String(text || '').trim();
-  return clean.startsWith('# AGENTS.md instructions')
-    || clean.startsWith('<environment_context>')
-    || clean.startsWith('<permissions instructions>')
-    // Codex injects the available-plugins catalogue as the first userPrompt of turn 1.
-    // Anchored with startsWith on purpose: matching the bare substring would discard a
-    // legitimate prompt that merely asks about plugins.
-    || clean.startsWith('<recommended_plugins>')
-    || clean.includes('You are Codex, a coding agent')
-    || clean.startsWith('## Memory');
-}
-
 export function summarizePromptForTitle(text = '', fallback = 'session') {
   const cleaned = redactSecrets(String(text || ''))
     .replace(/\[@[^\]]+\]\([^)]+\)/g, ' ')
@@ -901,27 +833,6 @@ export function shouldReuseActiveSession(control = {}, now = new Date()) {
   return now.getTime() - startedMs <= windowMinutes * 60 * 1000;
 }
 
-function normalizeTranscript(p) {
-  return String(p || '').replace(/\\/g, '/').toLowerCase();
-}
-
-function transcriptBasename(p) {
-  const n = normalizeTranscript(p);
-  const i = n.lastIndexOf('/');
-  return i === -1 ? n : n.slice(i + 1);
-}
-
-// Mesmo transcript apesar de caixa/separador diferentes (o Claude Code emite o
-// slug do projeto ora `c--`, ora `C--`) ou prefixo de path diferente (WSL vs
-// Windows). Compara normalizado e, em último caso, pelo basename
-// (`<session_id>.jsonl`, globalmente único). Evita rupturas de sessão no restart.
-export function transcriptsMatch(a, b) {
-  if (!a || !b) return false;
-  if (normalizeTranscript(a) === normalizeTranscript(b)) return true;
-  const ba = transcriptBasename(a);
-  return !!ba && ba === transcriptBasename(b);
-}
-
 // O `transcript_path` é estável dentro de uma conversa mesmo quando o
 // SessionStart re-dispara (compactação/resume) com `session_id` novo. Achar a
 // sessão ativa do mesmo transcript evita criar placeholders `HH-MM-codex`.
@@ -940,17 +851,6 @@ export function findActiveSessionByTranscript(vaultBase, transcriptPath) {
   return best;
 }
 
-export function redactSecrets(text) {
-  if (!text) return '';
-  return String(text)
-    .replace(/\b(sk-[A-Za-z0-9_-]{12,})\b/g, '[REDACTED_SECRET]')
-    .replace(/\b(whsec_[A-Za-z0-9_/-]{8,})\b/g, '[REDACTED_SECRET]')
-    .replace(/\b(gh[pousr]_[A-Za-z0-9_]{12,})\b/g, '[REDACTED_SECRET]')
-    .replace(/\b(xox[baprs]-[A-Za-z0-9-]{12,})\b/g, '[REDACTED_SECRET]')
-    .replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY)[A-Z0-9_]*)\s*[:=]\s*["']?[^"'\s]+/gi, '$1=[REDACTED_SECRET]')
-    .replace(/:\/\/([^:\s/@]+):([^@\s/]+)@/g, '://[REDACTED_SECRET]@');
-}
-
 export function truncate(text, max = 240) {
   const clean = redactSecrets(String(text || '').replace(/\s+/g, ' ').trim());
   if (clean.length <= max) return clean;

package/hooks/session-identity.mjs

@@ -1,152 +1,37 @@
 import { existsSync, readFileSync } from 'fs';
 import { basename } from 'path';
-import { detectProvider, readSessionRegistry, transcriptsMatch } from './obsidian-common.mjs';
-
-function parseLines(path) {
-  if (!path || !existsSync(path)) return [];
-  return readFileSync(path, 'utf-8').split('\n').filter(Boolean).map((line) => {
-    try { return JSON.parse(line); } catch { return null; }
-  }).filter(Boolean);
-}
+import { detectProvider, readSessionRegistry } from './obsidian-common.mjs';
+import {
+  inspectTranscriptIdentityContent,
+  resolveSessionIdentitySnapshot,
+} from '../packages/integrations/src/session-identity.mjs';
 
 export function inspectTranscriptIdentity(transcriptPath) {
-  const lines = parseLines(transcriptPath);
-  const codexMeta = lines.find((event) => event.type === 'session_meta')?.payload;
-  if (codexMeta) {
-    return {
-      transcriptProvider: 'openai',
-      provider: 'codex',
-      canonicalConversationId: codexMeta.session_id || codexMeta.id || '',
-      transcriptId: codexMeta.id || basename(transcriptPath, '.jsonl'),
-      parentConversationId: codexMeta.parent_thread_id || codexMeta.forked_from_id || '',
-    };
-  }
-  const claudeEvent = lines.find((event) => event.sessionId);
-  if (claudeEvent) {
-    return {
-      transcriptProvider: 'anthropic',
-      provider: 'claude',
-      canonicalConversationId: claudeEvent.sessionId,
-      transcriptId: basename(transcriptPath, '.jsonl'),
-      parentConversationId: '',
-    };
-  }
-  return { transcriptProvider: 'unknown', provider: 'unknown', canonicalConversationId: '', transcriptId: '', parentConversationId: '' };
-}
-
-function compatible(provider, transcriptProvider) {
-  return (provider === 'codex' && transcriptProvider === 'openai')
-    || (provider === 'claude' && transcriptProvider === 'anthropic');
-}
-
-function canonicalUuid(value = '') {
-  const id = String(value || '').trim().toLowerCase();
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(id) ? id : '';
+  const content = transcriptPath && existsSync(transcriptPath)
+    ? readFileSync(transcriptPath, 'utf-8')
+    : '';
+  return inspectTranscriptIdentityContent(content, {
+    fallbackTranscriptId: transcriptPath ? basename(transcriptPath, '.jsonl') : '',
+  });
 }
 
 export function resolveSessionIdentity(vaultBase, input = {}, provider = detectProvider()) {
   const transcriptPath = input.transcript_path || input.transcriptPath || '';
-  const inspected = inspectTranscriptIdentity(transcriptPath);
-  const hookId = input.session_id || input.sessionId || '';
-  const codexThreadId = canonicalUuid(input.codex_thread_id || input.codexThreadId || process.env.CODEX_THREAD_ID || '');
-
-  // Codex Desktop exposes the stable canonical conversation through
-  // CODEX_THREAD_ID even when SessionStart/UserPromptSubmit omit transcript_path.
-  // This is safer than the hook session_id (which may rotate on resume). Once the
-  // rollout materializes, require both canonical sources to agree.
-  const transcriptConversationId = canonicalUuid(inspected.canonicalConversationId);
-  if (provider === 'codex' && transcriptConversationId && codexThreadId
-    && transcriptConversationId !== codexThreadId) {
-    return {
-      state: 'deferred', provider, transcriptPath,
-      diagnostics: [`CODEX_THREAD_ID diverge do session_id do transcript (${codexThreadId} != ${transcriptConversationId})`],
-    };
-  }
-  if (provider === 'codex' && !inspected.canonicalConversationId && codexThreadId) {
-    return {
-      state: 'resolved',
-      provider,
-      canonicalConversationId: codexThreadId,
-      hookSessionId: hookId,
-      transcriptPath,
-      transcriptId: transcriptPath ? basename(transcriptPath, '.jsonl') : codexThreadId,
-      parentConversationId: '',
-      diagnostics: [],
-    };
-  }
-
-  // Claude: input.session_id já é o id canônico e estável da conversa — idêntico
-  // ao sessionId que cada linha do transcript grava. Numa sessão nova o arquivo
-  // ainda não materializou em disco quando o hook roda, então inspectTranscriptIdentity
-  // volta vazio e o gate abaixo adiaria o 1º turno inteiro (SessionStart + 1º prompt
-  // sem nota; sessão curta nunca registrada). Não adiar: usar o hookId direto.
-  // Codex NÃO entra aqui de propósito — lá o id do hook no resume é efêmero e ≠ do
-  // thread canônico, então seguimos exigindo rollout/registry (incidente 2026-07-11,
-  // contaminação cross-provider de sessão).
-  if (provider === 'claude' && hookId && !inspected.canonicalConversationId) {
-    return {
-      state: 'resolved',
-      provider,
-      canonicalConversationId: hookId,
-      hookSessionId: hookId,
-      transcriptPath,
-      transcriptId: transcriptPath ? basename(transcriptPath, '.jsonl') : hookId,
-      parentConversationId: '',
-      diagnostics: [],
-    };
-  }
-
-  // Codex on Windows can deliver a Stop payload whose transcript_path never arrives (or is
-  // lost to a truncated JSON, openai/codex#23784). The registry already knows the mapping —
-  // the lookup below just sat under this gate, unreachable in the one case it solves. The
-  // comment above says we require "rollout/registry"; the registry half was never wired.
-  // Requiring the entry's provider to match preserves the cross-provider invariant from the
-  // 2026-07-11 incident: we are not minting a canonical id, we are finding an ALREADY
-  // REGISTERED session whose key is the hook's own id. A resume with a fresh id simply
-  // misses and stays deferred.
-  if (!transcriptPath && hookId) {
-    const entry = readSessionRegistry(vaultBase).sessions?.[hookId];
-    if (entry?.transcript_path && entry.provider === provider) {
-      return {
-        state: 'resolved',
-        provider,
-        canonicalConversationId: hookId,
-        hookSessionId: hookId,
-        transcriptPath: entry.transcript_path,
-        transcriptId: entry.transcript_id || basename(entry.transcript_path, '.jsonl'),
-        parentConversationId: '',
-        diagnostics: ['transcript recuperado do SESSION_REGISTRY'],
-      };
-    }
-  }
-
-  if (!transcriptPath || !inspected.canonicalConversationId) {
-    return { state: 'deferred', provider, transcriptPath, diagnostics: ['transcript ausente ou sem identidade canônica'] };
-  }
-  if (!compatible(provider, inspected.transcriptProvider)) {
-    return { state: 'deferred', provider, transcriptPath, diagnostics: [`provider ${provider} incompatível com transcript ${inspected.transcriptProvider}`] };
-  }
-
-  const registry = readSessionRegistry(vaultBase);
-  const byTranscript = Object.entries(registry.sessions || {}).find(([, entry]) => {
-    const paths = [...(Array.isArray(entry?.transcript_paths) ? entry.transcript_paths : []), entry?.transcript_path].filter(Boolean);
-    return paths.some((path) => transcriptsMatch(path, transcriptPath));
-  });
-  const canonicalConversationId = byTranscript?.[0] || inspected.canonicalConversationId;
-  return {
-    state: 'resolved',
+  return resolveSessionIdentitySnapshot({
+    input,
     provider,
-    canonicalConversationId,
-    hookSessionId: hookId,
+    codexThreadId: process.env.CODEX_THREAD_ID || '',
     transcriptPath,
-    transcriptId: inspected.transcriptId,
-    parentConversationId: inspected.parentConversationId,
-    diagnostics: [],
-  };
+    inspected: inspectTranscriptIdentity(transcriptPath),
+    registry: readSessionRegistry(vaultBase),
+  });
 }
 
 export function resolveSessionEntry(vaultBase, input = {}, provider = detectProvider()) {
   const identity = resolveSessionIdentity(vaultBase, input, provider);
   if (identity.state !== 'resolved') return { identity, entry: null };
-  return { identity, entry: readSessionRegistry(vaultBase).sessions?.[identity.canonicalConversationId] || null };
+  return {
+    identity,
+    entry: readSessionRegistry(vaultBase).sessions?.[identity.canonicalConversationId] || null,
+  };
 }