fix(capture): read the session id off the SessionStart hook payload

[boskodev790]

What changed

vouch capture finalize-all now resolves the current session id from the SessionStart hook payload on stdin — the same wire capture finalize already reads at SessionEnd. --session-id and VOUCH_SESSION_ID are kept as fallbacks, in that order.

Why

fixes #492. the command resolved the id from --session-id or VOUCH_SESSION_ID only, but the shipped hook is bare vouch capture finalize-all || true and nothing in the adapter or runtime ever exports VOUCH_SESSION_ID — grep finds only the cli reader and two tests that set it themselves. so sid was always "" and the sweep returned {"finalized": [], ...} on every session start.

that left the #304 backstop dead in the shipped configuration: buffers orphaned by sessions that ended without SessionEnd accumulated in .vouch/captures/ and never rolled up into pending proposals, so those sessions never reached the review queue at all.

it went unnoticed because test_adapter_settings_wires_capture_hooks asserted observe / finalize / banner but never finalize-all, and every cli test for the command passed --session-id or the env var explicitly — the shipped path was the one path never exercised. that assertion is added here.

What might break

nothing on disk: no file moves, no field changes shape, no kb.* method behaves differently (capture finalize-all is CLI + SessionStart-hook only).

the behaviour change is the intended one: on an existing .vouch/, the first session start after upgrading will sweep any stale buffers that have been sitting in captures/ — each becomes one pending proposal, so a user with orphaned buffers may see several new items in vouch review. nothing is auto-approved and the review gate is untouched. the >1h age guard still protects the current session's buffer, and precedence is unchanged for anyone already passing --session-id explicitly.

a malformed or absent stdin payload still no-ops rather than raising, preserving the hook's never-fail-the-turn contract.

VEP

not a surface change — no kb.* method, object model, on-disk layout, bundle format or audit-log shape touched. no VEP.

Tests

• make check passes locally (lint + mypy + pytest) — 1379 passed, 49 skipped; ruff clean; mypy clean across 98 source files

• New / changed behaviour has a test

• CHANGELOG.md updated under ## [Unreleased]

• test_capture_finalize_all_cmd_reads_session_from_stdin — verified failing on test without the src change

• test_capture_finalize_all_cmd_survives_malformed_stdin — pins the never-fail-the-turn contract

• test_capture_finalize_all_cmd_flag_beats_stdin — pins precedence

• test_adapter_settings_wires_capture_hooks now asserts the SessionStart finalize-all wiring

one thing i left alone deliberately: observe, finalize, ingest-codex --hook and this command now each parse a stdin payload their own way. consolidating them behind one helper seemed worth doing separately rather than inside a bug fix — happy to send that as a follow-up if you want it.

no ui surface touched, so no screenshots.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2b7bcebb-5ea0-45e0-b15f-05bc2488d0fc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}