@dashclaw/cli 0.2.0 → 0.3.1

package/lib/api.js

@@ -0,0 +1,64 @@
+/**
+ * Tiny direct-API helper for the DashClaw CLI.
+ *
+ * The CLI imports `DashClaw` from the PUBLISHED npm package, whose installed
+ * version can LAG this repo and lack newly-added SDK methods. Commands that
+ * call brand-new endpoints therefore go through this helper instead — a clean
+ * `fetch` with the `x-api-key` header against the already-resolved
+ * baseUrl/apiKey. No dependency on unreleased SDK methods.
+ *
+ * Error semantics mirror sdk/dashclaw.js `_request`: parse JSON defensively
+ * (fall back to {} on a non-JSON gateway/error body so the real status isn't
+ * lost), and throw a status-bearing Error on a non-ok response.
+ *
+ * Node 20 global `fetch` — no imports needed.
+ *
+ * @param {{ baseUrl: string, apiKey: string }} config
+ * @param {string} method
+ * @param {string} path
+ * @param {{ body?: any, query?: Record<string, any> }} [opts]
+ * @returns {Promise<any>}
+ */
+export async function apiRequest({ baseUrl, apiKey }, method, path, { body, query } = {}) {
+  let url = `${baseUrl}${path}`;
+  if (query) {
+    // Skip undefined/null values. Passing them straight into URLSearchParams
+    // serializes the literal strings "undefined"/"null", which routes treat as
+    // real filter values and match zero rows. Falsy-but-valid values (0, false,
+    // '') are preserved.
+    const qs = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) {
+      if (value !== undefined && value !== null) qs.append(key, String(value));
+    }
+    const s = qs.toString();
+    if (s) url += `?${s}`;
+  }
+
+  const res = await fetch(url, {
+    method,
+    headers: {
+      'Content-Type': 'application/json',
+      'x-api-key': apiKey,
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+
+  // Parse the body defensively. A non-JSON error body (a Vercel 502/504/413
+  // gateway page, a 429 rate-limit page) makes res.json() reject with a
+  // SyntaxError, which would propagate instead of the status-bearing error
+  // below and lose res.status. Fall back to {} so the real status is thrown.
+  let data = {};
+  try {
+    data = await res.json();
+  } catch {
+    data = {};
+  }
+
+  if (!res.ok) {
+    const err = new Error(data.error || `Request failed with status ${res.status}`);
+    err.status = res.status;
+    throw err;
+  }
+
+  return data;
+}

package/lib/code/apply.js

@@ -0,0 +1,164 @@
+// `dashclaw code apply <manifestId>` — fetch a write plan from the server
+// and apply it locally. The server emits the manifest (Phase 6) with a
+// 24h TTL. This module is the only place the CLI writes to disk for the
+// Optimal Files feature.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { _ensureInsideProject, applyMerge } from './vendored.js';
+
+const SECRET_PATTERNS = [
+  { name: 'stripe_test', re: /sk_test_[A-Za-z0-9]{8,}/g },
+  { name: 'stripe_live', re: /sk_live_[A-Za-z0-9]{8,}/g },
+  { name: 'stripe_webhook', re: /whsec_[A-Za-z0-9]{8,}/g },
+  { name: 'openai_key', re: /sk-[A-Za-z0-9]{20,}/g },
+  { name: 'anthropic_key', re: /sk-ant-[A-Za-z0-9_\-]{20,}/g },
+  { name: 'github_pat', re: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g },
+  { name: 'aws_access', re: /AKIA[0-9A-Z]{16}/g },
+  { name: 'jwt', re: /eyJ[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}/g },
+  { name: 'private_key', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+  { name: 'env_assign', re: /\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CRED|AUTH))\s*=\s*['"]?[^\s'"\n]+/g },
+];
+
+function scanForSecrets(content) {
+  let redactions = 0;
+  let out = String(content == null ? '' : content);
+  for (const p of SECRET_PATTERNS) {
+    out = out.replace(p.re, (_match, captured) => {
+      redactions++;
+      if (p.name === 'env_assign' && captured) return `${captured}=<REDACTED:${p.name}>`;
+      return `<REDACTED:${p.name}>`;
+    });
+  }
+  return { status: redactions === 0 ? 'passed' : 'redacted', redactions, redacted: out };
+}
+
+async function fetchManifest(baseUrl, apiKey, manifestId, { fetchImpl = fetch }) {
+  const url = baseUrl.replace(/\/+$/, '') + '/api/code-sessions/manifests/' + encodeURIComponent(manifestId);
+  const res = await fetchImpl(url, {
+    headers: { 'x-api-key': apiKey },
+  });
+  let body = null;
+  try { body = await res.json(); } catch { /* null */ }
+  return { status: res.status, ok: res.ok, body };
+}
+
+export async function runApply({
+  baseUrl,
+  apiKey,
+  manifestId,
+  dest,
+  yes = false,
+  allowRedactions = false,
+  allowOverwriteSideBySide = false,
+  fetchImpl = fetch,
+  logger = console,
+}) {
+  if (!manifestId) throw new Error('runApply: manifestId is required');
+  if (!dest) throw new Error('runApply: --dest=<dir> is required');
+  if (!baseUrl || !apiKey) throw new Error('runApply: baseUrl and apiKey are required');
+
+  const destAbs = path.resolve(dest);
+  try { fs.mkdirSync(destAbs, { recursive: true }); }
+  catch (err) { throw new Error('Could not create destination ' + destAbs + ': ' + err.message); }
+
+  const { status, ok, body } = await fetchManifest(baseUrl, apiKey, manifestId, { fetchImpl });
+  if (!ok) throw new Error('Failed to load manifest: HTTP ' + status + (body?.error ? ' — ' + body.error : ''));
+  const plan = Array.isArray(body?.plan) ? body.plan : Array.isArray(body?.plan?.results) ? body.plan.results : null;
+  if (!plan) throw new Error('Manifest payload missing plan');
+
+  const results = [];
+  for (const entry of plan) {
+    const target = entry.path;
+    if (!target) {
+      results.push({ path: '(unknown)', status: 'invalid_entry' });
+      continue;
+    }
+    const abs = _ensureInsideProject(destAbs, target);
+    if (!abs) {
+      results.push({ path: target, status: 'unsafe_path' });
+      logger.warn(`  ${target} -> unsafe_path (refused)`);
+      continue;
+    }
+    const content = entry.content;
+    if (typeof content !== 'string') {
+      results.push({ path: target, status: 'no_content' });
+      continue;
+    }
+    const scan = scanForSecrets(content);
+    if (scan.status === 'redacted' && !allowRedactions) {
+      results.push({ path: target, status: 'redacted', redactions: scan.redactions });
+      logger.warn(`  ${target} -> ${scan.redactions} secret pattern(s) detected, refused (use --allow-redactions)`);
+      continue;
+    }
+    const mode = entry.mode || 'create';
+
+    try {
+      if (mode === 'merge') {
+        if (!fs.existsSync(abs)) {
+          fs.mkdirSync(path.dirname(abs), { recursive: true });
+          fs.writeFileSync(abs, scan.redacted, 'utf8');
+          results.push({ path: target, status: 'created', bytes: Buffer.byteLength(scan.redacted, 'utf8') });
+          logger.info(`  ${target} -> created`);
+          continue;
+        }
+        const existing = fs.readFileSync(abs, 'utf8');
+        const merged = applyMerge(existing, scan.redacted, {
+          acceptedHeadings: entry.acceptedHeadings || [],
+          acceptedBullets: entry.acceptedBullets || [],
+        });
+        fs.writeFileSync(abs, merged.merged, 'utf8');
+        results.push({ path: target, status: 'merged', additions: merged.additions });
+        logger.info(`  ${target} -> merged`);
+      } else if (mode === 'side_by_side') {
+        const sideAbs = entry.absolutePath
+          ? path.resolve(entry.absolutePath)
+          : sideBySidePath(abs);
+        const guardedSide = _ensureInsideProject(destAbs, path.relative(destAbs, sideAbs));
+        if (!guardedSide) {
+          results.push({ path: target, status: 'unsafe_path' });
+          continue;
+        }
+        fs.mkdirSync(path.dirname(guardedSide), { recursive: true });
+        if (fs.existsSync(guardedSide) && !allowOverwriteSideBySide) {
+          results.push({ path: target, status: 'side_by_side_conflict' });
+          logger.warn(`  ${target} -> side_by_side_conflict (pass --overwrite to replace)`);
+          continue;
+        }
+        fs.writeFileSync(guardedSide, scan.redacted, 'utf8');
+        results.push({ path: target, status: 'side_by_side', bytes: Buffer.byteLength(scan.redacted, 'utf8') });
+        logger.info(`  ${target} -> side_by_side`);
+      } else if (mode === 'skip') {
+        results.push({ path: target, status: 'skipped' });
+      } else {
+        // 'create' or 'overwrite'
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        const existed = fs.existsSync(abs);
+        if (existed && mode !== 'overwrite' && !yes) {
+          results.push({ path: target, status: 'refused_overwrite_without_yes' });
+          logger.warn(`  ${target} -> exists; pass --yes or rebuild manifest with mode='overwrite'`);
+          continue;
+        }
+        fs.writeFileSync(abs, scan.redacted, 'utf8');
+        results.push({ path: target, status: existed ? 'overwritten' : 'created' });
+        logger.info(`  ${target} -> ${existed ? 'overwritten' : 'created'}`);
+      }
+    } catch (err) {
+      results.push({ path: target, status: 'error', error: err.message });
+      logger.warn(`  ${target} -> error: ${err.message}`);
+    }
+  }
+  return results;
+}
+
+function sideBySidePath(abs) {
+  const dir = path.dirname(abs);
+  const base = path.basename(abs);
+  const ext = path.extname(base);
+  if (!ext) return path.join(dir, base + '.NEW');
+  return path.join(dir, base.slice(0, -ext.length) + '.NEW' + ext);
+}
+
+// Exported for the sync script + tests that want to assert the scan layer
+// stays in lock-step with app/lib/claude-code/optimal-files/secret-scan.js.
+export { scanForSecrets };

package/lib/code/codex-parser.vendored.js

@@ -0,0 +1,360 @@
+// VENDORED from app/lib/codex/parser.ts — GENERATED, do not edit by hand.
+// The CLI runs as raw Node ESM and is published without app/, so it cannot import
+// the app TypeScript source. Regenerate by compiling app/lib/codex/parser.ts.
+// See cli/lib/code/vendored.js for the same sibling-package rationale.
+
+// app/lib/codex/parser.js
+//
+// Codex CLI session JSONL parser.
+//
+// Codex writes session rollouts to `~/.codex/sessions/rollout-<ts>-<uuid>.jsonl`.
+// Each line has the shape:
+//
+//   { "timestamp": "...", "type": "session_meta"|"response_item"|...,
+//     "payload": { ... } }
+//
+// We normalize the rollout into a session object that's intentionally
+// parallel to the Claude Code parser output (app/lib/claude-code/parser.js)
+// so downstream insights, alerts, and rules engines can be reused with
+// minimal branching. The shape differs only where Codex's data model
+// fundamentally diverges from Claude's (token semantics, reasoning tokens).
+//
+// Token mapping (Codex → normalized):
+//   input_tokens            → input_tokens
+//   output_tokens           → output_tokens (excludes reasoning)
+//   cached_input_tokens     → cache_read_tokens
+//   reasoning_output_tokens → reasoning_tokens (Codex-only field)
+//   total_tokens            → recomputed at the request level for safety
+//
+// There is no Codex equivalent to Claude's `cache_creation_tokens`. We emit
+// 0 for that field on Codex sessions to keep the schema compatible.
+//
+// This parser is deliberately tolerant: malformed lines are counted in
+// `skippedLines` and never throw. It returns a partial session even when
+// the rollout was truncated mid-write.
+import fs from 'node:fs';
+import readline from 'node:readline';
+export const CODEX_PARSER_VERSION = 1;
+function safeParse(line) {
+    try {
+        return JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+}
+function previewText(value, max = 200) {
+    if (typeof value !== 'string')
+        return '';
+    return value.slice(0, max);
+}
+// Best-effort agent-kind tag for downstream branching. Always 'codex' here.
+export const CODEX_AGENT_KIND = 'codex';
+function _initState({ sourceFile, sourceMtime }) {
+    return {
+        session: {
+            agentKind: CODEX_AGENT_KIND,
+            sourceFile: sourceFile || null,
+            sourceMtime: sourceMtime || null,
+            sessionUuid: null,
+            projectSlug: null,
+            cwd: null,
+            gitBranch: null,
+            gitCommit: null,
+            gitRepoUrl: null,
+            cliVersion: null,
+            originator: null,
+            modelProvider: null,
+            modelPrimary: null,
+            startedAt: null,
+            endedAt: null,
+            parserVersion: CODEX_PARSER_VERSION,
+            // counters
+            jsonlRecords: 0,
+            responseItems: 0,
+            eventMessages: 0,
+            compactedItems: 0,
+            skippedLines: 0,
+            turnCount: 0,
+            toolCallCount: 0,
+            // token totals
+            totals: {
+                input_tokens: 0,
+                output_tokens: 0,
+                cache_read_tokens: 0,
+                cache_creation_tokens: 0, // always 0 for Codex; kept for schema parity
+                reasoning_tokens: 0,
+            },
+            // per-turn token snapshots, in arrival order
+            turns: [], // { turnId, inputTokens, outputTokens, cachedInputTokens, reasoningTokens, total, at }
+            // canonical message timeline (user + assistant + reasoning + tool_call + tool_result)
+            messages: [],
+            // tool uses across the session
+            toolUses: [],
+        },
+        seenTurnIds: new Set(),
+    };
+}
+function _handleSessionMeta(state, payload, ts) {
+    const s = state.session;
+    if (!s.sessionUuid && payload?.id)
+        s.sessionUuid = payload.id;
+    if (!s.cwd && payload?.cwd)
+        s.cwd = payload.cwd;
+    if (!s.cliVersion && payload?.cli_version)
+        s.cliVersion = payload.cli_version;
+    if (!s.originator && payload?.originator)
+        s.originator = payload.originator;
+    if (!s.modelProvider && payload?.model_provider)
+        s.modelProvider = payload.model_provider;
+    if (!s.startedAt)
+        s.startedAt = ts || payload?.timestamp || null;
+    if (payload?.git && typeof payload.git === 'object') {
+        const git = payload.git;
+        if (!s.gitBranch && git.branch)
+            s.gitBranch = git.branch;
+        if (!s.gitCommit && git.commit_hash)
+            s.gitCommit = git.commit_hash;
+        if (!s.gitRepoUrl && git.repository_url)
+            s.gitRepoUrl = git.repository_url;
+    }
+}
+function _handleResponseItem(state, payload, ts) {
+    const s = state.session;
+    s.responseItems += 1;
+    if (!payload || typeof payload !== 'object')
+        return;
+    const role = payload.role;
+    // Response items can be of several shapes:
+    //   - { role: 'user'|'assistant'|'system', content: [...] }
+    //   - { type: 'function_call', name, arguments, call_id }
+    //   - { type: 'function_call_output', call_id, output }
+    //   - { type: 'reasoning', summary: [...] }
+    if (payload.type === 'function_call' || (payload.name && payload.call_id)) {
+        s.toolCallCount += 1;
+        s.toolUses.push({
+            name: payload.name || 'unknown',
+            tool_use_id: payload.call_id || payload.id || null,
+            arguments_preview: previewText(payload.arguments, 240),
+            target: safeToolTarget(payload),
+            at: ts,
+        });
+        s.messages.push({
+            role: 'tool_call',
+            name: payload.name,
+            tool_use_id: payload.call_id || null,
+            preview: previewText(payload.arguments, 240),
+            at: ts,
+        });
+        return;
+    }
+    if (payload.type === 'function_call_output') {
+        s.messages.push({
+            role: 'tool_result',
+            tool_use_id: payload.call_id || null,
+            preview: previewText(typeof payload.output === 'string' ? payload.output : JSON.stringify(payload.output ?? ''), 240),
+            at: ts,
+        });
+        return;
+    }
+    if (payload.type === 'reasoning') {
+        // Reasoning items are first-class in Codex — we keep a stub on the
+        // timeline so downstream tools can correlate cost with thinking.
+        s.messages.push({ role: 'reasoning', preview: '(reasoning)', at: ts });
+        return;
+    }
+    if (role && Array.isArray(payload.content)) {
+        s.messages.push({
+            role,
+            preview: extractTextPreview(payload.content),
+            at: ts,
+        });
+    }
+}
+function extractTextPreview(content) {
+    for (const c of content) {
+        if (!c)
+            continue;
+        if (typeof c === 'string')
+            return previewText(c);
+        const part = c;
+        if (part.type === 'input_text' && typeof part.text === 'string')
+            return previewText(part.text);
+        if (part.type === 'output_text' && typeof part.text === 'string')
+            return previewText(part.text);
+        if (part.type === 'text' && typeof part.text === 'string')
+            return previewText(part.text);
+    }
+    return '';
+}
+function safeToolTarget(p) {
+    // Codex tools include `local_shell` (command exec) and a generic `apply_patch`
+    // among many MCP tools. We try to extract a SHORT non-secret identifier.
+    try {
+        const args = typeof p.arguments === 'string'
+            ? JSON.parse(p.arguments)
+            : p.arguments;
+        if (!args || typeof args !== 'object')
+            return null;
+        if (p.name === 'local_shell' || p.name === 'shell') {
+            const cmd = typeof args.command === 'string'
+                ? args.command
+                : Array.isArray(args.command) ? args.command.join(' ') : '';
+            const head = cmd.trim().split(/\s+/)[0] || '';
+            return head ? head.slice(0, 60) : null;
+        }
+        if (typeof args.file_path === 'string')
+            return args.file_path.slice(0, 160);
+        if (typeof args.path === 'string')
+            return args.path.slice(0, 160);
+        if (typeof args.url === 'string') {
+            try {
+                return new URL(args.url).host;
+            }
+            catch {
+                return null;
+            }
+        }
+    }
+    catch { /* fall through */ }
+    return null;
+}
+function _handleEventMsg(state, payload, ts) {
+    const s = state.session;
+    s.eventMessages += 1;
+    if (!payload || typeof payload !== 'object')
+        return;
+    const type = payload.type;
+    if (type === 'token_count') {
+        // Payload shape: { type: 'token_count', info: { total_token_usage, last_token_usage, model_context_window } }
+        const last = payload.info?.last_token_usage;
+        if (last) {
+            const input = Number(last.input_tokens) || 0;
+            const output = Number(last.output_tokens) || 0;
+            const cachedInput = Number(last.cached_input_tokens) || 0;
+            const reasoning = Number(last.reasoning_output_tokens) || 0;
+            const total = Number(last.total_tokens) || (input + output + cachedInput + reasoning);
+            s.totals.input_tokens += input;
+            s.totals.output_tokens += output;
+            s.totals.cache_read_tokens += cachedInput;
+            s.totals.reasoning_tokens += reasoning;
+            // Turn snapshot — Codex emits one token_count per model turn. We use
+            // the event ordinal as a synthetic turn id since the payload doesn't
+            // carry one. The token-count event always corresponds to one turn.
+            const turnId = `t${s.turns.length + 1}`;
+            s.turns.push({
+                turnId,
+                inputTokens: input,
+                outputTokens: output,
+                cachedInputTokens: cachedInput,
+                reasoningTokens: reasoning,
+                total,
+                at: ts,
+            });
+            s.turnCount = s.turns.length;
+        }
+        return;
+    }
+    if (type === 'session_configured') {
+        if (!s.modelPrimary && payload.model)
+            s.modelPrimary = payload.model;
+        return;
+    }
+    if (type === 'agent_message') {
+        if (typeof payload.message === 'string') {
+            s.messages.push({ role: 'assistant', preview: previewText(payload.message), at: ts });
+        }
+        return;
+    }
+    if (type === 'user_message') {
+        if (typeof payload.message === 'string') {
+            s.messages.push({ role: 'user', preview: previewText(payload.message), at: ts });
+        }
+        return;
+    }
+}
+function _handleCompacted(state, payload, ts) {
+    const s = state.session;
+    s.compactedItems += 1;
+    s.messages.push({
+        role: 'system',
+        preview: '(compacted) ' + previewText(payload?.message || '', 180),
+        at: ts,
+    });
+}
+function _processLine(state, line, lineNo) {
+    if (!line || !line.trim())
+        return;
+    const rec = safeParse(line);
+    const s = state.session;
+    if (!rec || typeof rec !== 'object') {
+        s.skippedLines += 1;
+        return;
+    }
+    s.jsonlRecords += 1;
+    const ts = typeof rec.timestamp === 'string' ? rec.timestamp : null;
+    if (ts) {
+        if (!s.startedAt || ts < s.startedAt)
+            s.startedAt = ts;
+        if (!s.endedAt || ts > s.endedAt)
+            s.endedAt = ts;
+    }
+    // RolloutLine flattens `type` to the top level (serde flatten).
+    const type = rec.type;
+    const payload = rec.payload;
+    switch (type) {
+        case 'session_meta':
+            _handleSessionMeta(state, payload, ts);
+            break;
+        case 'response_item':
+            _handleResponseItem(state, payload, ts);
+            break;
+        case 'event_msg':
+            _handleEventMsg(state, payload, ts);
+            break;
+        case 'compacted':
+            _handleCompacted(state, payload, ts);
+            break;
+        case 'turn_context':
+            // No-op for now; turn_context carries the per-turn model + tool list
+            // but we don't yet use it for normalization.
+            break;
+        default:
+            // Unknown line type — counted in jsonlRecords but no further action.
+            break;
+    }
+}
+/**
+ * Parse an array of raw JSONL lines (in-memory). Returns the normalized
+ * session object. The server uses this so it never touches the filesystem.
+ */
+export function parseCodexSessionLines(lines, { sourceFile = null, sourceMtime = null } = {}) {
+    if (!Array.isArray(lines)) {
+        throw new TypeError('parseCodexSessionLines: lines must be an array of strings');
+    }
+    const state = _initState({ sourceFile, sourceMtime });
+    for (let i = 0; i < lines.length; i++) {
+        _processLine(state, lines[i], i + 1);
+    }
+    return state.session;
+}
+/**
+ * Stream-parse a Codex JSONL file from disk. Used by the CLI ingest path.
+ */
+export async function parseCodexSessionFile(filePath, { mtime } = {}) {
+    const stream = fs.createReadStream(filePath, { encoding: 'utf8' });
+    const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
+    let actualMtime = mtime;
+    if (!actualMtime) {
+        try {
+            actualMtime = fs.statSync(filePath).mtime.toISOString();
+        }
+        catch { /* keep null */ }
+    }
+    const state = _initState({ sourceFile: filePath, sourceMtime: actualMtime });
+    let lineNo = 0;
+    for await (const line of rl) {
+        _processLine(state, line, ++lineNo);
+    }
+    return state.session;
+}