Preserve unresolved FoxGuard findings across Claude Code compaction

[Darkroom4364]

What problem does this solve?

FoxGuard’s Claude Code PostToolUse hook scans each supported edited file from disk and returns findings as immediate feedback. Claude Code runs the plugin’s SessionStart hook after compaction, so the static secure-coding preamble returns, but individual unresolved findings are neither persisted nor restored. If an affected file is not edited again, Claude may no longer see an earlier finding in its active context.

This is a continuity gap, not a scanner-correctness claim: the next supported edit still receives a fresh scan. The current hook also remains detect-after-write feedback, not a final enforcement gate.

What does the solution look like?

• Keep a session-scoped local record of unresolved findings from supported Write, Edit, MultiEdit, and NotebookEdit scans.
• Persist only minimal metadata needed for an actionable reminder: relative file path, rule ID, severity, line, and a stable fingerprint. Never persist code snippets, finding descriptions containing source values, secrets, full file contents, transcripts, or credentials.
• Store state outside the checked-out repository and independently of FoxGuard suppression baselines.
• Replace prior entries for a file after every successful scan; a clean re-scan removes that file’s entries.
• On SessionStart with source: compact, emit a concise, bounded unresolved-finding summary back into Claude’s context. Preserve the static secure-coding preamble.
• Missing/corrupt state, invalid hook input, scanner failure, unreadable files, and unavailable dependencies must remain fail-open and must not block Claude.
• Add deterministic shell-level coverage for record, compaction rehydration, clean resolution, corrupt/missing state, output bounds, and no-snippet persistence. Add syntax validation for plugin scripts to CI if absent.
• Document that this restores awareness only; full/diff scans plus pre-commit or CI remain the final coverage layer.