#4009 Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo

What happens

The agent audit hook that swamp repo init --tool claude writes records nothing in two common setups.

1. PowerShell on Windows. The hook in .claude/settings.local.json matches "matcher": "Bash". On Windows, Claude Code also has a PowerShell tool. Swamp commands run through it never reach swamp audit record --from-hook, so they're missing from swamp audit.

2. Sessions started above the swamp repo. Claude Code reads project settings, including hooks, only from the directory the session was started in. With several swamp repos in one git repo (for example repo/swamp/<name>/, each with its own .swamp.yaml), a session started at the git root and working in swamp/<name>/ never loads that repo's hook. I checked one such checkout: of more than 30 swamp repos, only three had any commands-*.jsonl, and only for days when a session was started inside that repo.

Expected

Every swamp command an agent runs is recorded in the repo it ran in.

Suggestions

• Match Bash|PowerShell (and normalize the PowerShell payload) in the Claude hook that init, upgrade and mergeAuditHooks write.
• Offer a user-level install, for example swamp audit install --user, which adds the hook to ~/.claude/settings.json. audit record --from-hook already finds the repo from the payload's cwd and drops rows outside an initialized repo, so one global hook would cover every repo without writing .swamp/ anywhere new.
• Have swamp doctor audit warn when the hook can't fire for the usual way a repo is opened, such as a parent directory that is itself a git root.

Environment

swamp 20261022.021804.0-sha.983e2929, Windows 11, Claude Code with Bash and PowerShell tools.