#390 swamp audit record --from-hook creates a stray .swamp datastore in the process cwd instead of resolving the repo root

Description

The audit integration hook swamp audit record --from-hook resolves its target datastore from the process working directory rather than by walking up to the repository root (the directory containing .swamp.yaml). When the hook runs with a cwd that is a subdirectory of a swamp repo, swamp initializes a brand new .swamp/ datastore there — extension catalog (_extension_catalog.db), audit/, etc. — instead of recording to the repo-root datastore.

Notably, the PostToolUse hook payload on stdin already contains the correct repo root in its cwd field, but it is ignored in favor of the process cwd.

Steps to reproduce

From inside an initialized swamp repo (.swamp.yaml at the root):

mkdir -p repro-audit-subdir   # a subdir with NO .swamp.yaml
HOOK_JSON='{"session_id":"repro","hook_event_name":"PostToolUse","tool_name":"Bash","cwd":"<REPO_ROOT>","tool_input":{"command":"echo hi"},"tool_response":{"stdout":"hi","stderr":"","exitCode":0}}'
( cd repro-audit-subdir && printf '%s' "$HOOK_JSON" | swamp audit record --from-hook )
find repro-audit-subdir -name '.swamp' -o -name '_extension_catalog.db'

Result — a stray datastore is created in the subdir:

repro-audit-subdir/.swamp
repro-audit-subdir/.swamp/_extension_catalog.db
repro-audit-subdir/.swamp/_extension_catalog.db-shm
repro-audit-subdir/.swamp/_extension_catalog.db-wal
repro-audit-subdir/.swamp/audit/commands-2026-05-20.jsonl

Expected behavior

swamp audit record --from-hook (and swamp generally, when run from a subdir of a repo) should resolve the repo root by walking up to find .swamp.yaml and record into the repo-root datastore — or honor the repo root provided in the hook payload's cwd field. It should not silently create a new datastore in an arbitrary subdirectory.

Actual behavior

A new .swamp/ datastore + extension catalog + audit log is created in whatever directory the hook process happens to be in.

Real-world impact

Agent shells commonly leave their working directory in a subdirectory (e.g. a compound command ending in cd somedir). The PostToolUse audit hook then fires with that cwd and scatters .swamp/ datastores throughout the tree. In practice this:

• Fragments the audit trail across multiple unintended datastores.
• Pollutes working directories — in our case a .swamp/ was created inside a data directory that was subsequently rsync'd to remote hosts, shipping the stray datastore as part of the payload.
• Risks being accidentally committed to version control.

Environment

• swamp 20260520.085517.0-sha.a85f376a (confirmed up to date via swamp update --check)
• Linux
• Hook configured by swamp repo init in .claude/settings.local.json: PostToolUse/PostToolUseFailure → swamp audit record --from-hook