[tadasant]

Summary

• Resolve Claude Cowork upload identity from local-agent-mode session sidecars instead of host Claude Code CLI auth.
• Add Cowork identity diagnostics to the archive manifest (new identity object; manifest schema bumped to v3) while preserving normal Claude Code fallback behavior.
• Document manifest.user_id / manifest.identity semantics — including that identity is diagnostic metadata not subject to redacted privacy mode — and add resolver coverage for Source A, Source B, mismatch, cwd fallback, non-Cowork, malformed-sidecar, and missing-sidecar cases.

Verification

• npm install && npm run build && npm test in hooks/agent-transcript-capture passes locally — 130 tests across 9 files green, tsc build clean.
• dist/ confirmed in sync with src/: a fresh npm run build produces no additional diff beyond the committed compiled output.
• Resolver tests prove every documented branch: Source A primary resolution, Source B oauthAccount fallback, CLI session-ID mismatch diagnostics, Source A/B email mismatch diagnostics, cwd /outputs fallback detection, non-Cowork host fallback, negative local_* ancestor (not misdetected as Cowork), missing-sidecar fallback to cowork-<accountUuid-prefix>, malformed/unparseable sidecars never failing capture, missing oauthAccount diagnostic, and account/organization UUID path-mismatch diagnostics.
• Self-review completed with git diff --check clean.
• Fresh-eyes subagent review completed; feedback addressed — removed an out-of-scope stop_hook_active early-exit (unrelated to identity, risked skipping the final capture when a separate blocking Stop hook is present), documented that manifest.identity is not subject to redacted mode, clarified the stricter Cowork path-matching vs detectAgent's substring check, and added the malformed-sidecar / missing-oauthAccount / UUID-mismatch tests above.

Logic-only change (no UI surface). Proof of behavior is the resolver test suite enumerated above, which exercises each identity-resolution and diagnostics branch directly.