fix(session-log): walk ancestor PIDs to resolve correct session log (#598)

* fix(session-log): walk ancestor PIDs to find Claude Code session metadata

When plannotator is invoked from a slash command's `!` bang, the direct
parent process is an intermediate bash shell spawned by the Bash tool —
not Claude Code itself. The old resolveSessionLogByPpid() only checked
process.ppid, so it always missed the session metadata file and fell back
to mtime-based selection, which picks the wrong log when multiple sessions
exist for the same project.

New resolution ladder (four tiers):
1. Ancestor-PID walk: call `ps -o ppid=` repeatedly from process.ppid up
   to 8 hops, checking ~/.claude/sessions/<pid>.json at each hop.
   Deterministic — no guessing, matches exact session every time.
2. Cwd-scan: read every ~/.claude/sessions/*.json, filter by cwd, pick
   most recent startedAt. Handles cases where ps is unavailable.
3. CWD slug mtime (legacy): existing behavior, fragile with multiple
   sessions.
4. Ancestor directory walk: handles cd-deeper-into-subdirectory cases.

Adds getAncestorPids (injectable getParent for testing), resolveSessionLogByAncestorPids,
and resolveSessionLogByCwdScan. Exports SessionMetadata and accepts
projectsDirOverride on findSessionLogsForCwd for test isolation.

17 new tests cover: edge cases for getAncestorPids (cycles, maxHops,
self-loops), resolveSessionLogByAncestorPids (finds correct session among
multiple, skips missing logs, falls back when no metadata matches), and
resolveSessionLogByCwdScan (picks newest startedAt, ignores mismatched
cwd, handles missing sessions dir).

Closes #458

* refactor(session-log): simplify resolver and findSessionLogs for clarity

* fix(session-log): add Windows support to ancestor-PID resolver

Tier 1 used `ps`, which doesn't exist on Windows. Multiple Claude Code
sessions in the same repo remained broken on Windows because tier 2
(cwd scan) can't disambiguate when both sessions share the same cwd.

- Replace per-hop `ps` calls with a single process-table snapshot (`ps`
  on Unix, PowerShell Get-CimInstance on Windows), cached across the
  walk. One spawn instead of up to eight; faster on both platforms.
- Export pure-function parsers (parseProcessTablePs,
  parseProcessTableCsv) so the Windows path is unit-testable without
  a Windows runner.
- Normalize cwd comparison in resolveSessionLogByCwdScan: Windows is
  case-insensitive and processes may report drive letters in either
  case, so fold slashes and lowercase before comparing.

Windows viability confirmed empirically: ~/.claude/sessions/<pid>.json
exists with the expected schema on Windows 11 + Claude Code 2.1.116.

For provenance purposes, this commit was AI assisted.

---------

Co-authored-by: Michael Ramos <mdramos8@gmail.com>

Author: elithompson

apps/hook/server/index.ts

@@ -81,7 +81,14 @@ import { hostnameOrFallback } from "@plannotator/shared/project";
 import { planDenyFeedback } from "@plannotator/shared/feedback-templates";
 import { readImprovementHook } from "@plannotator/shared/improvement-hooks";
 import { AGENT_CONFIG, type Origin } from "@plannotator/shared/agents";
-import { findSessionLogsForCwd, resolveSessionLogByPpid, findSessionLogsByAncestorWalk, getLastRenderedMessage, type RenderedMessage } from "./session-log";
+import {
+  findSessionLogsByAncestorWalk,
+  findSessionLogsForCwd,
+  getLastRenderedMessage,
+  resolveSessionLogByAncestorPids,
+  resolveSessionLogByCwdScan,
+  type RenderedMessage,
+} from "./session-log";
 import { findCodexRolloutByThreadId, getLastCodexMessage } from "./codex-session";
 import { findCopilotPlanContent, findCopilotSessionForCwd, getLastCopilotMessage } from "./copilot-session";
 import {
@@ -652,12 +659,18 @@ if (args[0] === "sessions") {
     // Claude Code path: resolve session log
     //
     // Strategy (most precise → least precise):
-    // 1. PPID session metadata: ~/.claude/sessions/<ppid>.json gives us the
-    //    exact sessionId and original cwd. Deterministic, O(1), no scanning.
-    // 2. CWD slug match: existing behavior — works when the shell CWD hasn't
-    //    changed from the session's project directory.
-    // 3. Ancestor walk: walk up the directory tree trying parent slugs. Handles
-    //    the common case where the user `cd`'d deeper into a subdirectory.
+    // 1. Ancestor-PID session metadata: walk up the process tree checking
+    //    ~/.claude/sessions/<pid>.json at each hop. When invoked from a slash
+    //    command's `!` bang, the direct parent is a bash subshell — Claude's
+    //    session file is a few hops up. Deterministic when it matches.
+    // 2. Cwd-scan of session metadata: read every ~/.claude/sessions/*.json,
+    //    filter by cwd, pick the most recent startedAt. Better than mtime
+    //    guessing because it uses session-level metadata.
+    // 3. CWD slug match (mtime-based): legacy behavior — picks the most
+    //    recently modified jsonl in the project dir. Fragile when multiple
+    //    sessions exist for the same project.
+    // 4. Ancestor directory walk: handles the case where the user `cd`'d
+    //    deeper into a subdirectory after session start.
 
     if (process.env.PLANNOTATOR_DEBUG) {
       console.error(`[DEBUG] Project root: ${projectRoot}`);
@@ -677,15 +690,19 @@ if (args[0] === "sessions") {
       }
     }
 
-    // 1. Try PPID-based session metadata (most reliable)
-    const ppidLog = resolveSessionLogByPpid();
-    tryLogCandidates("PPID session metadata", () => ppidLog ? [ppidLog] : []);
+    // 1. Walk ancestor PIDs for a matching session metadata file
+    const ancestorLog = resolveSessionLogByAncestorPids();
+    tryLogCandidates("Ancestor PID session metadata", () => ancestorLog ? [ancestorLog] : []);
+
+    // 2. Scan all session metadata files for one whose cwd matches
+    const cwdScanLog = resolveSessionLogByCwdScan({ cwd: projectRoot });
+    tryLogCandidates("Cwd-scan session metadata", () => cwdScanLog ? [cwdScanLog] : []);
 
-    // 2. Fall back to CWD slug match
-    tryLogCandidates("CWD slug match", () => findSessionLogsForCwd(projectRoot));
+    // 3. Fall back to CWD slug match (mtime-based)
+    tryLogCandidates("CWD slug match (mtime)", () => findSessionLogsForCwd(projectRoot));
 
-    // 3. Fall back to ancestor directory walk
-    tryLogCandidates("Ancestor walk", () => findSessionLogsByAncestorWalk(projectRoot));
+    // 4. Fall back to ancestor directory walk
+    tryLogCandidates("Directory ancestor walk", () => findSessionLogsByAncestorWalk(projectRoot));
   }
 
   if (!lastMessage) {