[Shahinyanm]

Reported from a real session: it started in the main checkout, moved into
.worktrees/dev4320-impl, and from then on token-pilot returned the main
checkout's version of every file read by relative path — code from another
branch, with nothing to show it. It happened on a payment code path during a
rebase.

Cause: the MCP server fixes its project root once, at start-up
(CLAUDE_PROJECT_DIR), and resolves every relative path against it. Root
auto-detection only runs for a "dangerous" root, and roots/list_changed
deliberately never re-points a session that already has one — so moving into a
worktree goes unnoticed.

Fix

• A new PreToolUse hook on token-pilot's own tools. Claude Code runs hooks in the
  session's current directory and applies updatedInput to MCP calls (both
  verified live on 2.1.281). When the session is in a different checkout from the
  server, the hook resolves relative path / paths against the checkout the
  session is in. In the server's own checkout it prints nothing. It has its own
  entry point: 23 ms per call instead of ~200 ms through the full CLI.
• Tools that look past one file — the symbol index, git history and diffs, test
  runs — still answer from the server's checkout; in a worktree session they now
  carry a note saying so. A per-worktree index is the follow-up.
• The project-root guard accepts absolute paths into other worktrees of the same
  repository, so a sibling checkout (git worktree add ../feature) can be read.
  The session's own checkout keeps its old boundary.
• fast-uri and ip-address pinned past two new production advisories.

Verified live (headless Claude Code with this build, throwaway repository):

• nested worktree: after cd .worktrees/wt, smart_read("a.ts") returns the
  worktree's file, where the installed 0.53.0 returns the main checkout's;
  project_overview arrives with the note;
• sibling worktree by absolute path: returns the file, where 0.53.0 answers
  "resolves outside project root".

Claude Code resets a Bash cd that leaves the project directory, so sibling
worktrees are reached by absolute path or --add-dir.

19 new tests; full suite 1507/1507, tsc --noEmit clean, audit clean.