fix(hooks): remove echo/printf/find/awk from skip list; key snapshot by command hash

Three correctness gaps addressed in the snapshot-pre-bash / track-bash-writes hook pair:

1. echo, printf, find, and awk were listed as read-only skip candidates but all
   four can write files (echo/printf via redirections, find via -exec/-delete,
   awk via getline/redirection). Remove them from the skip list so their file
   writes are captured in session-edits.log.

2. The snapshot file was keyed only by project root hash, causing a race when
   Claude Code issues multiple Bash tool calls in parallel: call B's pre-hook
   would overwrite call A's snapshot before A's post-hook ran, silently dropping
   A's file writes. Fix by including a hash of the command string in the filename
   so each concurrent call gets a distinct snapshot file.

Author: carlos-alm

.claude/hooks/snapshot-pre-bash.sh

@@ -23,18 +23,26 @@ if [ -z "$COMMAND" ]; then
   exit 0
 fi
 
-# Skip read-only commands that can never write files — reduces snapshot overhead
-# for the most common Bash calls (ls, cat, grep, git log, git status, etc.).
+# Skip commands that can NEVER write files — reduces snapshot overhead for the
+# most common read-only Bash calls.  Only include commands that have no
+# write-capable flags/modes at all.  Notably absent:
+#   - echo, printf  — write files via shell redirections (echo … > file)
+#   - find          — can write via -exec sed -i, -exec cp, -delete, etc.
+#   - awk           — can write via redirection or getline
 # sed is intentionally NOT in this list because `sed -i` modifies files in-place.
-if echo "$COMMAND" | grep -qE '^\s*(ls|cat|head|tail|grep|find|git\s+(log|status|diff|show|branch|remote|fetch|rev-parse|stash\s+list|ls-files|blame|describe|tag|config\s+--get)|gh\s+(pr|issue|repo)\s+(view|list|status)|echo|printf|pwd|which|node\s+-e|node\s+-p|npx\s+--version|wc|sort|uniq|awk)\b'; then
+if echo "$COMMAND" | grep -qE '^\s*(ls|cat|head|tail|grep|git\s+(log|status|diff|show|branch|remote|fetch|rev-parse|stash\s+list|ls-files|blame|describe|tag|config\s+--get)|gh\s+(pr|issue|repo)\s+(view|list|status)|pwd|which|node\s+-e|node\s+-p|npx\s+--version|wc|sort|uniq)\b'; then
   exit 0
 fi
 
 # Resolve the project root (worktree-aware — each worktree has its own .claude/)
 PROJECT_DIR=$(git rev-parse --show-toplevel 2>/dev/null) || PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
 
-# Key the snapshot file to the project root so parallel worktrees don't collide.
-# Use a simple hash of the path — just enough to be unique per worktree.
+# Key the snapshot file to (project root, command) so concurrent Bash calls
+# within the same session don't overwrite each other's baseline.
+# Claude Code can issue multiple Bash tool calls in parallel; using just the
+# project hash would mean call B's pre-hook overwrites call A's snapshot before
+# A's post-hook runs, silently dropping A's file writes from session-edits.log.
+# Including a hash of the command makes each concurrent call use a distinct file.
 PROJECT_HASH=$(echo "$PROJECT_DIR" | node -e "
   const crypto = require('crypto');
   let d='';
@@ -44,7 +52,16 @@ PROJECT_HASH=$(echo "$PROJECT_DIR" | node -e "
   });
 " 2>/dev/null) || PROJECT_HASH="default"
 
-SNAPSHOT_FILE="/tmp/claude-bash-snapshot-${PROJECT_HASH}.txt"
+CMD_HASH=$(echo "$COMMAND" | node -e "
+  const crypto = require('crypto');
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    process.stdout.write(crypto.createHash('sha1').update(d.trim()).digest('hex').slice(0,8));
+  });
+" 2>/dev/null) || CMD_HASH="default"
+
+SNAPSHOT_FILE="/tmp/claude-bash-snapshot-${PROJECT_HASH}-${CMD_HASH}.txt"
 
 # Capture current git status --porcelain.
 # Lines look like: "XY filename" or "XY orig -> dest" (rename).

.claude/hooks/track-bash-writes.sh

@@ -27,7 +27,10 @@ fi
 # Resolve the project root (worktree-aware — each worktree has its own .claude/)
 PROJECT_DIR=$(git rev-parse --show-toplevel 2>/dev/null) || PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
 
-# Reproduce the same project hash used by snapshot-pre-bash.sh
+# Reproduce the same snapshot path used by snapshot-pre-bash.sh.
+# The snapshot is keyed by (project root, command) so concurrent Bash calls
+# within the same session each get a distinct file — preventing parallel calls
+# from overwriting each other's baseline.
 PROJECT_HASH=$(echo "$PROJECT_DIR" | node -e "
   const crypto = require('crypto');
   let d='';
@@ -37,7 +40,16 @@ PROJECT_HASH=$(echo "$PROJECT_DIR" | node -e "
   });
 " 2>/dev/null) || PROJECT_HASH="default"
 
-SNAPSHOT_FILE="/tmp/claude-bash-snapshot-${PROJECT_HASH}.txt"
+CMD_HASH=$(echo "$COMMAND" | node -e "
+  const crypto = require('crypto');
+  let d='';
+  process.stdin.on('data',c=>d+=c);
+  process.stdin.on('end',()=>{
+    process.stdout.write(crypto.createHash('sha1').update(d.trim()).digest('hex').slice(0,8));
+  });
+" 2>/dev/null) || CMD_HASH="default"
+
+SNAPSHOT_FILE="/tmp/claude-bash-snapshot-${PROJECT_HASH}-${CMD_HASH}.txt"
 
 # If there is no snapshot (hook was not installed yet, or the pre-hook was
 # skipped for a read-only command) we have no baseline — exit cleanly.