ECC/scripts/hooks
kuqili e86d3dbe02
fix: filter session-start injection by cwd/project to prevent cross-project contamination (#1054)
* fix: filter session-start injection by cwd/project to prevent cross-project contamination

The SessionStart hook previously selected the most recent session file
purely by timestamp, ignoring the current working directory. This caused
Claude to receive a previous project's session context when switching
between projects, leading to incorrect file reads and project analysis.

session-end.js already writes **Project:** and **Worktree:** header
fields into each session file. This commit adds selectMatchingSession()
which uses those fields with the following priority:

1. Exact worktree (cwd) match — most recent
2. Same project name match — most recent
3. Fallback to overall most recent (preserves backward compatibility)

No new dependencies. Gracefully falls back to original behavior when
no matching session exists.

* fix: address review feedback — eliminate duplicate I/O, add null guards, improve docstrings

- Return { session, content, matchReason } from selectMatchingSession()
  to avoid reading the same file twice (coderabbitai, greptile P2)
- Add empty array guard: return null when sessions.length === 0 (coderabbitai)
- Stop mutating input objects — no more session._matchReason (coderabbitai)
- Add null check on result before accessing properties (coderabbitai)
- Only log "selected" after confirming content is readable (cubic-dev-ai P3)
- Add full JSDoc with @param/@returns (docstring coverage)

* fix: track fallback session object to prevent session/content mismatch

When sessions[0] is unreadable, fallbackContent came from a later
session (e.g. sessions[1]) while the returned session object still
pointed to sessions[0]. This caused misleading logs and injected
content from the wrong session — the exact problem this PR fixes.

Now tracks fallbackSession alongside fallbackContent so the returned
pair is always consistent.

Addresses greptile-apps P1 review feedback.

* fix: normalize worktree paths to handle symlinks and case differences

On macOS /var is a symlink to /private/var, and on Windows paths may
differ in casing (C:\repo vs c:\repo). Use fs.realpathSync() to
resolve both sides before comparison so worktree matching is reliable
across symlinked and case-insensitive filesystems.

cwd is normalized once outside the loop to avoid repeated syscalls.

Addresses coderabbitai Major review feedback.

---------

Co-authored-by: kuqili <kuqili@tencent.com>
2026-03-31 14:05:34 -07:00
..
auto-tmux-dev.js fix: auto-start dev servers in tmux instead of blocking (#344) 2026-03-07 14:47:46 -08:00
check-console-log.js Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit 2026-02-18 07:40:12 +00:00
check-hook-enabled.js feat: deliver v1.8.0 harness reliability and parity updates 2026-03-04 14:48:06 -08:00
config-protection.js fix: fold session manager blockers into one candidate 2026-03-24 23:08:27 -04:00
cost-tracker.js feat: deliver v1.8.0 harness reliability and parity updates 2026-03-04 14:48:06 -08:00
desktop-notify.js feat(hooks): add WSL desktop notification support via PowerShell + BurntToast (#1019) 2026-03-30 03:14:49 -04:00
doc-file-warning.js fix(lint): prefix unused options parameter with underscore 2026-03-29 10:14:53 +08:00
evaluate-session.js Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit 2026-02-18 07:40:12 +00:00
governance-capture.js fix: fold session manager blockers into one candidate 2026-03-24 23:08:27 -04:00
insaits-security-monitor.py fix: narrow unicode cleanup scope 2026-03-29 21:21:18 -04:00
insaits-security-wrapper.js fix: make insaits hook opt-in 2026-03-10 20:47:09 -07:00
mcp-health-check.js fix: fold session manager blockers into one candidate 2026-03-24 23:08:27 -04:00
post-bash-build-complete.js feat: deliver v1.8.0 harness reliability and parity updates 2026-03-04 14:48:06 -08:00
post-bash-pr-created.js feat: deliver v1.8.0 harness reliability and parity updates 2026-03-04 14:48:06 -08:00
post-edit-console-warn.js Merge branch 'affaan-m:main' into main 2026-02-18 18:33:04 +05:30
post-edit-format.js fix(hooks): add Windows .cmd support with shell injection guard 2026-03-11 10:45:28 +09:00
post-edit-typecheck.js Fix stdin overflow bug in hook scripts - truncate chunks to stay within MAX_STDIN limit 2026-02-18 07:40:12 +00:00
pre-bash-commit-quality.js fix: narrow unicode cleanup scope 2026-03-29 21:21:18 -04:00
pre-bash-dev-server-block.js fix: resolve PR 371 portability regressions 2026-03-09 22:49:43 -07:00
pre-bash-git-push-reminder.js feat: deliver v1.8.0 harness reliability and parity updates 2026-03-04 14:48:06 -08:00
pre-bash-tmux-reminder.js feat: deliver v1.8.0 harness reliability and parity updates 2026-03-04 14:48:06 -08:00
pre-compact.js fix: nullish coalescing in evaluate-session config, narrow pre-compact glob, add 11 tests 2026-02-13 02:42:01 -08:00
pre-write-doc-warn.js feat: deliver v1.8.0 harness reliability and parity updates 2026-03-04 14:48:06 -08:00
quality-gate.js refactor: deduplicate config lists and unify resolveFormatterBin branches 2026-03-11 10:45:28 +09:00
run-with-flags-shell.sh fix(hooks): pass phase argument from hook ID to observe.sh (#1042) 2026-03-31 14:05:16 -07:00
run-with-flags.js fix: finish blocker lane hook and install regressions 2026-03-25 04:00:50 -04:00
session-end-marker.js fix: export run() to avoid Windows spawnSync issues (#431) 2026-03-16 13:38:47 -07:00
session-end.js fix: strip ANSI escape codes from session persistence hooks (#642) (#684) 2026-03-20 01:38:11 -07:00
session-start-bootstrap.js fix: extract inline SessionStart bootstrap to separate file (#1035) 2026-03-31 14:05:23 -07:00
session-start.js fix: filter session-start injection by cwd/project to prevent cross-project contamination (#1054) 2026-03-31 14:05:34 -07:00
suggest-compact.js fix(hooks): scrub secrets and harden hook security (#348) 2026-03-07 14:47:31 -08:00