trace: a commit made in the same Bash call as the edit loses the session trailer and attestation #3625

What happens

When Claude Code changes a file and commits it in the same Bash tool call, the commit gets no Chainloop-Trace-Sessions trailer. The pre-push hook then finds no traced commit, and the push gives no AI coding session attestation. The session is lost without any message.

Example of a single Bash call that loses the session:

echo "change" >> README.md && git add README.md && git commit -m "..." && git push origin my-branch

Why

Trace records the lines that a Bash call changed in the PostToolUse hook, so only after the whole call ends. The git hooks run while the call is still running:

1. commit-msg runs. HandleCommitMsgHook matches the staged files against the AI line attributions, but the attribution for this call does not exist yet. No trailer.
2. pre-push runs and sees no traced commit. No attestation.
3. The Bash call ends, and PostToolUse records the attribution for the session. It is too late for this commit.

In the run where we saw this, the commit time was 17:02:07 and the attribution recorded_at was 17:02:08. The record in .git/chainloop-trace/commits/<sha>.json has no session_ids, and the attribution stays pending.

An edit with the Edit or Write tool, followed by a separate Bash commit, works as expected, because PostToolUse of the edit runs before the commit.

Expected

A commit made inside a Bash tool call carries the session trailer when the same call changed the committed files, and the push gives an attestation.

Ideas

• In PreToolUse for Bash, mark the session as having a Bash call in progress. commit-msg could then compare the staged files with the PreToolUse snapshot and attribute the changes to that session.
• At minimum, have pre-push warn when a session recorded changes that no pushed commit carries, so the loss is visible.

Environment

Chainloop CLI 1.122.0, Claude Code in a Docker Sandbox (sbx v0.47, clone mode). The behavior does not depend on the sandbox.