`hook session-start` silently spawns a background daemon and writes into the repo

[JordanCoin]

Version: 4.4.2 (Homebrew) · macOS

Summary

codemap hook session-start is described in --help as "Show project context". It also starts a long-lived watch daemon and creates .codemap/projects/<hash>/ in the working tree. Neither is mentioned, and --help presents --watch as the way to run the daemon.

Repro

In a clean throwaway git repo, run each command and check for new processes and new files:

cmd='codemap .'                     -> daemon_spawned=NO   .codemap_entries=0
cmd='codemap handoff -no-save .'    -> daemon_spawned=NO   .codemap_entries=0
cmd='codemap blast-radius --text .' -> daemon_spawned=NO   .codemap_entries=0
cmd='codemap hook session-start'    -> daemon_spawned=YES  .codemap_entries=6

Only hook session-start does it.

Expected

Either the daemon is documented as part of this subcommand, or the subcommand only prints context. A command whose stated job is to show something shouldn't leave a process running and files on disk.

Related: the already-running check looks racy

One repo I checked had 4 concurrent daemons for the same project — three spawned within 2 seconds of each other, plus a 5-day-old orphan from a previous session. That suggests the "is one already running?" check has a TOCTOU window, and that nothing reaps daemons whose session ended.

Suggested fix

1. Document the side effects in --help for hook session-start, or move the spawn behind an explicit flag.
2. Guard the spawn with a lock file / atomic create rather than a check-then-spawn.
3. Reap or time out daemons whose originating session is gone; consider a codemap watch stop --all.