Fix: Add incremental parsing to SystemIntegrity handler

[anutron]

Summary

Resolves performance issue where Stop hooks take 1-2 minutes to complete in long sessions.

Problem

The SystemIntegrity handler parses the entire transcript on every Stop event. In long sessions (1000+ lines), this adds 1-2 minutes of overhead per Stop event. The transcript is reparsed from line 0 every time, creating unnecessary CPU overhead that compounds as sessions grow.

Solution

This PR implements incremental parsing by tracking the last parsed line number in the integrity state:

1. Track last_parsed_line in integrity-state.json
2. Only parse new lines since the last check
3. Update state after each parse with the new last_parsed_line

Changes

change-detection.ts

• Added last_parsed_line?: number to IntegrityState interface
• Modified parseToolUseBlocks() to accept startLine parameter for incremental parsing
• Changed return type from FileChange[] to { changes: FileChange[]; lastLine: number }

SystemIntegrity.ts

• Import readIntegrityState from change-detection
• Read last_parsed_line from state before parsing
• Pass startLine to parseToolUseBlocks()
• Update state with new lastLine after parsing

Performance Impact

• Before: O(n) where n = total transcript lines
• After: O(m) where m = new lines since last check
• In 953-line session: ~950 lines saved per Stop event

This eliminates the transcript re-parsing overhead and makes Stop hooks complete much faster in long sessions.

Testing

Tested locally in long session. Stop hook performance improved significantly - no longer waiting 1-2 minutes for SystemIntegrity to complete.

Backwards Compatibility

Fully backwards compatible. If last_parsed_line is missing from state (fresh install or existing state file), it defaults to 0 and parses the entire transcript on first run.

[danielmiessler]

Thanks for this contribution! We've done a significant restructuring in the upcoming PAI v3.0 release — including a redesigned hook system (22 → ~19 hooks), a completely rewritten Algorithm (v0.5.1), and removal of the observability system. These changes supersede the fix addressed in this PR.

We really appreciate the effort you put into this and encourage you to check out v3.0 when it lands — community feedback like yours directly informed our redesign. Closing as superseded, but your contribution is valued!