# Fix: Plan Auto-Approval Bug for Cross-Directory Sessions

> When an appfix session navigates to a new directory (not under originproject), auto-approval stops working because _iscwdunderorigin() returns False.

- Skill: `tools-only/fix-plan-auto-approval-bug-for-cross-directory-sessions` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add tools-only/fix-plan-auto-approval-bug-for-cross-directory-sessions`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/fix-plan-auto-approval-bug-for-cross-directory-sessions/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tools-only (https://skillmd.com/u/tools-only)
- Updated: 2026-09-29
- Page: https://skillmd.com/skills/tools-only/fix-plan-auto-approval-bug-for-cross-directory-sessions

---

# Fix: Plan Auto-Approval Bug for Cross-Directory Sessions

## Bug Summary
When an appfix session navigates to a new directory (not under origin_project), auto-approval stops working because `_is_cwd_under_origin()` returns False.

## Root Cause
`_is_cwd_under_origin()` only checks if cwd is under origin_project. It doesn't consider that the SAME SESSION should be trusted regardless of directory.

## The Minimal Fix (3 changes in 1 file)

### File: `config/hooks/_common.py`

**Change 1**: Add `session_id` parameter to `_is_cwd_under_origin()` (lines 221-248)
- If session_id matches user_state's session_id, return True (trust same session)
- Otherwise fall back to existing directory check

**Change 2**: Add `session_id` parameter to functions that call `_is_cwd_under_origin()`:
- `is_appfix_active(cwd, session_id="")` - line 251
- `is_mobileappfix_active(cwd, session_id="")` - line 285
- `is_godo_active(cwd, session_id="")` - line 318
- `is_autonomous_mode_active(cwd, session_id="")` - line 352
- `get_autonomous_state(cwd, session_id="")` - line 451

**Change 3**: Update hook callers to pass session_id:
- `pretooluse-auto-approve.py` - extract session_id from input_data, pass to functions
- `permissionrequest-auto-approve.py` - same pattern

## Why This Is Safe
- Session matching is cryptographically strong (session IDs are unique)
- Only the same session can use its own state across directories
- Different sessions still get the directory check (safety preserved)

## Test Plan
1. Start appfix in project A
2. Navigate to unrelated directory /tmp/test-dir
3. Verify auto-approval still works (session_id matches)
4. Start new session in project B
5. Verify project A's state doesn't affect project B (session_id mismatch)