@dashclaw/cli 0.4.0 → 0.6.0

package/lib/codex/install.js

@@ -3,11 +3,13 @@
 // `dashclaw install codex` — provisions DashClaw governance into Codex CLI.
 //
 // What it does, idempotently:
-//   1. Copies the Python governance hooks (pretool, posttool, stop) and the
-//      vendored `dashclaw_agent_intel` module into ~/.codex/hooks/dashclaw/.
+//   1. Copies the Python governance hooks (pretool, posttool, stop, session
+//      digest) and the vendored `dashclaw_agent_intel` module into
+//      ~/.codex/hooks/dashclaw/.
 //   2. Merges a managed block into ~/.codex/config.toml that registers:
 //        - the DashClaw MCP server (stdio)
-//        - PreToolUse / PostToolUse / Stop hooks pointing at the copied scripts
+//        - PreToolUse / PostToolUse / Stop / SessionStart hooks pointing at
+//          the copied scripts
 //        - approval_policy = "on-request" so Codex surfaces require_approval
 //          decisions from DashClaw guard
 //   3. Drops a managed block into <project>/AGENTS.md (or creates the file)
@@ -57,6 +59,12 @@ const HOOK_FILES = [
   'dashclaw_pretool.py',
   'dashclaw_posttool.py',
   'dashclaw_stop.py',
+  // dashclaw_stop.py imports this for Code Sessions ingest; without it the
+  // import fails inside a try/except and ingest silently no-ops (v2.7 fix).
+  'dashclaw_code_session_reporter.py',
+  // SessionStart digest (v3.7 item 6) — wired once codex-cli 0.139.0's
+  // SessionStart hook event was confirmed to fire (see PLUGIN_PARITY.md).
+  'dashclaw_session_digest.py',
 ];
 const HOOK_INTEL_DIR = 'dashclaw_agent_intel';
 
@@ -184,6 +192,7 @@ export function buildConfigTomlBlock({
   const pre = join(hooksDir, 'dashclaw_pretool.py');
   const post = join(hooksDir, 'dashclaw_posttool.py');
   const stop = join(hooksDir, 'dashclaw_stop.py');
+  const sessionStart = join(hooksDir, 'dashclaw_session_digest.py');
 
   const lines = [
     MANAGED_START,
@@ -215,19 +224,31 @@ export function buildConfigTomlBlock({
     'matcher = "Bash|Edit|Write|MultiEdit"',
     '[[hooks.PreToolUse.hooks]]',
     'type = "command"',
-    `command = ${tomlString(`${py} ${pre}`)}`,
+    // --agent-id on the hook command line mirrors the MCP server args above:
+    // the hooks' argv identity beats the machine-ambient DASHCLAW_AGENT_ID
+    // env var, so Codex tool calls are never mis-attributed to another
+    // harness (roadmap v2.2).
+    `command = ${tomlString(`${py} ${pre} --agent-id codex`)}`,
     'timeoutSec = 3600',
     '',
     '[[hooks.PostToolUse]]',
     'matcher = "Bash|Edit|Write|MultiEdit"',
     '[[hooks.PostToolUse.hooks]]',
     'type = "command"',
-    `command = ${tomlString(`${py} ${post}`)}`,
+    `command = ${tomlString(`${py} ${post} --agent-id codex`)}`,
     '',
     '[[hooks.Stop]]',
     '[[hooks.Stop.hooks]]',
     'type = "command"',
-    `command = ${tomlString(`${py} ${stop}`)}`,
+    `command = ${tomlString(`${py} ${stop} --agent-id codex`)}`,
+    '',
+    // Codex CLI 0.139.0's hook-event enum contains SessionStart alongside
+    // Pre/Post/Stop; wired once that lifecycle was verified to fire
+    // (roadmap v3.7 item 6 — see PLUGIN_PARITY.md).
+    '[[hooks.SessionStart]]',
+    '[[hooks.SessionStart.hooks]]',
+    'type = "command"',
+    `command = ${tomlString(`${py} ${sessionStart} --agent-id codex`)}`,
     MANAGED_END,
   );
 

package/lib/config.js

@@ -37,17 +37,29 @@ export function clearConfigFile() {
 
 export function ask(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((res) => {
+  return new Promise((res, rej) => {
+    let answered = false;
     rl.question(question, (answer) => {
+      answered = true;
       rl.close();
       res(answer.trim());
     });
+    // stdin ending (piped input exhausted, Ctrl+D) used to leave the promise
+    // pending forever — node then drained the event loop and exited 0 as if
+    // the install had succeeded (v5.4 outsider run). Fail loudly instead.
+    rl.on('close', () => {
+      if (!answered) rej(new Error('stdin closed before the prompt was answered.'));
+    });
   });
 }
 
 export function askSecret(question) {
-  return new Promise((res) => {
+  return new Promise((res, rej) => {
     const stdin = process.stdin;
+    if (stdin.readableEnded || stdin.destroyed) {
+      rej(new Error('stdin closed before the prompt was answered.'));
+      return;
+    }
     process.stdout.write(question);
     const wasRaw = stdin.isRaw;
     if (stdin.setRawMode) stdin.setRawMode(true);
@@ -55,6 +67,13 @@ export function askSecret(question) {
     stdin.setEncoding('utf8');
 
     let input = '';
+    // Same silent-exit-0 hazard as ask(): if stdin ends before a newline,
+    // reject instead of leaving the promise pending while node exits clean.
+    const onEnd = () => {
+      stdin.removeListener('data', onData);
+      rej(new Error('stdin closed before the prompt was answered.'));
+    };
+    stdin.once('end', onEnd);
     const onData = (char) => {
       const str = String(char);
       for (const c of str) {
@@ -62,6 +81,7 @@ export function askSecret(question) {
           if (stdin.setRawMode) stdin.setRawMode(wasRaw);
           stdin.pause();
           stdin.removeListener('data', onData);
+          stdin.removeListener('end', onEnd);
           process.stdout.write('\n');
           res(input.trim());
           return;
@@ -87,6 +107,31 @@ export function askSecret(question) {
   });
 }
 
+// The CLI sends x-api-key over whatever scheme baseUrl has. Plaintext http to
+// a non-local host exposes the key to the network path — warn once per
+// process (don't refuse: LAN self-hosting over http is a supported setup).
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]', '::1', '0.0.0.0']);
+let warnedInsecureUrl = false;
+
+export function __resetInsecureUrlWarning() {
+  warnedInsecureUrl = false;
+}
+
+function warnIfInsecureBaseUrl(baseUrl) {
+  if (warnedInsecureUrl) return;
+  try {
+    const url = new URL(baseUrl);
+    if (url.protocol === 'http:' && !LOCAL_HOSTNAMES.has(url.hostname)) {
+      warnedInsecureUrl = true;
+      console.error(yellow(
+        `Warning: DashClaw base URL ${url.origin} uses plaintext http — your API key is sent unencrypted. Use https for non-local instances.`
+      ));
+    }
+  } catch {
+    // Unparseable URL — the request itself will surface the real error.
+  }
+}
+
 /**
  * Resolve config from env, then file, then interactive prompt.
  * @returns {Promise<{ baseUrl, apiKey, agentId, source } | null>}
@@ -112,6 +157,7 @@ export async function resolveConfig({ env = process.env, interactive = true } =
   }
 
   if (baseUrl && apiKey) {
+    warnIfInsecureBaseUrl(baseUrl);
     return { baseUrl, apiKey, agentId: agentId || 'cli-operator', source };
   }
 
@@ -156,5 +202,6 @@ export async function resolveConfig({ env = process.env, interactive = true } =
   }
   console.log();
 
+  warnIfInsecureBaseUrl(baseUrl);
   return { baseUrl, apiKey, agentId, source: 'prompted' };
 }

package/lib/up/args.js

@@ -0,0 +1,25 @@
+const DB_MODES = ['docker', 'embedded', 'url'];
+
+export function parseUpArgs(argv) {
+  const out = { update: false, yes: false, noBrowser: false, db: null, dir: null, port: null, sourceDir: null };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--update') out.update = true;
+    else if (a === '--yes') out.yes = true;
+    else if (a === '--no-browser') out.noBrowser = true;
+    else if (a === '--db') {
+      const v = argv[++i];
+      if (!DB_MODES.includes(v)) throw new Error(`--db must be one of: ${DB_MODES.join(', ')}`);
+      out.db = v;
+    } else if (a === '--dir') out.dir = argv[++i] ?? null;
+    else if (a === '--source-dir') out.sourceDir = argv[++i] ?? null;
+    else if (a === '--port') {
+      const v = Number(argv[++i]);
+      if (!Number.isInteger(v) || v < 1 || v > 65535) throw new Error('--port must be an integer 1-65535');
+      out.port = v;
+    } else if (a.startsWith('--')) {
+      throw new Error(`Unknown flag: ${a}. Run 'dashclaw help' for usage.`);
+    }
+  }
+  return out;
+}

package/lib/up/db.js

@@ -0,0 +1,163 @@
+// cli/lib/up/db.js
+//
+// Database mode selection and provisioning for `dashclaw up`.
+//
+// Three modes:
+//   docker   — starts/reuses a `dashclaw-pg` Docker container (port 5433)
+//   embedded — downloads and runs embedded Postgres via embedded-postgres (~40 MB, first run)
+//   url      — prompts for a postgresql:// connection string from the user
+
+import { join } from 'node:path';
+import { existsSync, rmSync } from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
+
+// Keep this in sync with the "embedded-postgres" version in cli/package.json.
+const EMBEDDED_PG_VERSION = 'embedded-postgres@18.4.0-beta.17';
+
+export const LOCAL_DB_URL = 'postgresql://dashclaw:dashclaw@localhost:5433/dashclaw';
+
+const CONTAINER = 'dashclaw-pg';
+
+/** Returns true when the `docker` binary is available and responsive. */
+export function dockerAvailableSync() {
+  return spawnSync('docker', ['--version'], { stdio: 'ignore' }).status === 0;
+}
+
+/**
+ * Determines which database mode to use.
+ *
+ * Priority:
+ *   1. Explicit --db flag
+ *   2. Non-interactive (--yes): docker if available, otherwise embedded
+ *   3. Interactive prompt
+ *
+ * @param {object} opts
+ * @param {string|null} opts.flagDb   - explicit --db value or null
+ * @param {boolean}     opts.dockerAvailable
+ * @param {boolean}     [opts.yes]    - non-interactive mode
+ * @param {Function}    [opts.promptFn] - async (message) => string
+ * @returns {Promise<'docker'|'embedded'|'url'>}
+ */
+export async function chooseDbMode({ flagDb, dockerAvailable, yes = false, promptFn }) {
+  if (flagDb) return flagDb;
+  if (yes) return dockerAvailable ? 'docker' : 'embedded';
+
+  const lines = [
+    'Database — pick one:',
+    dockerAvailable
+      ? '  1. Docker Postgres (Docker detected)   [default]'
+      : '  1. Docker Postgres (Docker NOT detected)',
+    `  2. Embedded Postgres (no Docker needed, ~40 MB download)${dockerAvailable ? '' : '   [default]'}`,
+    '  3. I have a postgresql:// URL',
+  ];
+  const def = dockerAvailable ? '1' : '2';
+  const answer = (await promptFn(`${lines.join('\n')}\nChoice [${def}]: `)).trim() || def;
+  return { 1: 'docker', 2: 'embedded', 3: 'url' }[answer] ?? (dockerAvailable ? 'docker' : 'embedded');
+}
+
+/**
+ * Returns the docker run command that starts a local Postgres container.
+ * Mirrors the repo's docker-compose.yml: postgres:16-alpine, host port 5433,
+ * dashclaw/dashclaw/dashclaw credentials, named volume dashclaw_pgdata.
+ */
+export function dockerCommandFor() {
+  return {
+    cmd: 'docker',
+    args: [
+      'run', '-d', '--name', CONTAINER,
+      '-e', 'POSTGRES_USER=dashclaw',
+      '-e', 'POSTGRES_PASSWORD=dashclaw',
+      '-e', 'POSTGRES_DB=dashclaw',
+      '-p', '5433:5432',
+      '-v', 'dashclaw_pgdata:/var/lib/postgresql/data',
+      'postgres:16-alpine',
+    ],
+  };
+}
+
+/** Starts the dashclaw-pg container, reusing it if it already exists. */
+function dockerStartOrRun(logger) {
+  const ps = spawnSync(
+    'docker', ['ps', '-aq', '--filter', `name=^${CONTAINER}$`],
+    { encoding: 'utf8' },
+  );
+  if ((ps.stdout || '').trim()) {
+    execFileSync('docker', ['start', CONTAINER], { stdio: 'ignore' });
+  } else {
+    const { cmd, args } = dockerCommandFor();
+    execFileSync(cmd, args, { stdio: 'ignore' });
+  }
+  logger.error('[ok] Docker Postgres running (container dashclaw-pg, port 5433)');
+}
+
+/**
+ * Provisions the database according to `mode` and returns { databaseUrl, stop }.
+ *
+ * @param {object}   opts
+ * @param {'docker'|'embedded'|'url'} opts.mode
+ * @param {string}   opts.baseDir   - base dir for embedded data (e.g. ~/.dashclaw)
+ * @param {Function} [opts.promptFn] - async (message) => string (required for mode=url)
+ * @param {object}   [opts.logger]  - object with .error(); defaults to console
+ * @returns {Promise<{ databaseUrl: string, stop: () => Promise<void> }>}
+ */
+export async function provisionDatabase({ mode, baseDir, promptFn, logger = console }) {
+  if (mode === 'url') {
+    const url = (await promptFn('postgresql:// connection string: ')).trim();
+    if (!url.startsWith('postgresql://')) throw new Error('That is not a postgresql:// URL.');
+    return { databaseUrl: url, stop: async () => {} };
+  }
+
+  if (mode === 'docker') {
+    dockerStartOrRun(logger);
+    await waitForPort(5433, 30_000);
+    return { databaseUrl: LOCAL_DB_URL, stop: async () => {} };
+  }
+
+  // mode === 'embedded'
+  const { default: EmbeddedPostgres } = await import('embedded-postgres');
+  const pgDir = join(baseDir, 'pg');
+  // Record whether the data dir existed BEFORE this run.
+  // Only clean up on failure when WE created it (a pre-existing dir means
+  // a working prior install whose data we must not delete).
+  const dirPreExisted = existsSync(pgDir);
+  // Derive credentials from LOCAL_DB_URL so the local dev creds live in
+  // exactly one place rather than being duplicated as bare literals here.
+  const localDb = new URL(LOCAL_DB_URL);
+  const pg = new EmbeddedPostgres({
+    databaseDir: pgDir,
+    user: localDb.username,
+    password: localDb.password,
+    port: Number(localDb.port),
+    persistent: true,
+  });
+  try {
+    await pg.initialise();
+    await pg.start();
+  } catch (e) {
+    if (!dirPreExisted) {
+      rmSync(pgDir, { recursive: true, force: true });
+    }
+    throw new Error(
+      `Embedded Postgres (${EMBEDDED_PG_VERSION}) failed: ${e.message}. Retry with --db docker or --db url.`,
+    );
+  }
+  try { await pg.createDatabase('dashclaw'); } catch { /* already exists on resume — fine */ }
+  logger.error('[ok] Embedded Postgres running (port 5433, data in ~/.dashclaw/pg)');
+  return { databaseUrl: LOCAL_DB_URL, stop: () => pg.stop() };
+}
+
+/** Polls :port until it accepts TCP connections, or throws on timeout. */
+async function waitForPort(port, timeoutMs) {
+  const net = await import('node:net');
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const ok = await new Promise((resolve) => {
+      const s = net.connect(port, '127.0.0.1');
+      s.once('connect', () => { s.destroy(); resolve(true); });
+      s.once('error', () => resolve(false));
+    });
+    if (ok) return;
+    await new Promise((r) => setTimeout(r, 500));
+  }
+  throw new Error(`Postgres did not accept connections on :${port} within ${timeoutMs / 1000}s.`);
+}

package/lib/up/fetch-app.js

@@ -0,0 +1,82 @@
+// cli/lib/up/fetch-app.js
+//
+// Version resolve + tarball fetch/extract for `dashclaw up`.
+// Fetches the latest platform version from npm and downloads the corresponding
+// GitHub release tarball, extracting it into ${baseDir}/app/${version}/.
+
+import { mkdirSync, existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
+import * as tar from 'tar';
+
+const REPO = 'ucsandman/DashClaw';
+
+/**
+ * Fetch the latest published platform version from the npm registry.
+ * The `dashclaw` npm package version mirrors the platform version (unified versioning).
+ *
+ * @param {typeof fetch} fetchImpl - injectable for tests
+ * @returns {Promise<string>} semver string e.g. '4.21.0'
+ */
+export async function resolveAppVersion(fetchImpl = fetch) {
+  const res = await fetchImpl('https://registry.npmjs.org/dashclaw/latest');
+  if (!res.ok) {
+    throw new Error(`npm registry lookup failed (${res.status}) — check your network and retry.`);
+  }
+  const { version } = await res.json();
+  if (!version) throw new Error('npm registry returned no version for dashclaw.');
+  return version;
+}
+
+/**
+ * Build the GitHub codeload tarball URL for a given version tag.
+ *
+ * @param {string} version - semver string e.g. '4.21.0'
+ * @returns {string}
+ */
+export function tarballUrl(version) {
+  return `https://codeload.github.com/${REPO}/tar.gz/refs/tags/v${version}`;
+}
+
+/**
+ * Download and extract the app tarball for `version` into `${baseDir}/app/${version}`.
+ * The GitHub tarball wraps everything in a `DashClaw-<version>/` folder —
+ * strip 1 level so the app root lands directly in the target dir.
+ * Skips cleanly if the target already exists (resume case).
+ *
+ * @param {object} opts
+ * @param {string} opts.version
+ * @param {string} opts.baseDir
+ * @param {typeof fetch} opts.fetchImpl
+ * @param {{ error: (...args: any[]) => void }} opts.logger
+ * @returns {Promise<string>} absolute path to the extracted app dir
+ */
+export async function downloadAndExtract({ version, baseDir, fetchImpl = fetch, logger = console }) {
+  const target = join(baseDir, 'app', version);
+  if (existsSync(join(target, 'package.json'))) {
+    // Resume-skip: a pre-existing package.json means a prior successful extract.
+    logger.error(`[ok] App ${version} already present at ${target}`);
+    return target;
+  }
+  mkdirSync(target, { recursive: true });
+  const res = await fetchImpl(tarballUrl(version));
+  if (!res.ok || !res.body) {
+    rmSync(target, { recursive: true, force: true });
+    throw new Error(
+      `Download failed (${res.status}) for ${tarballUrl(version)} — does tag v${version} exist?`,
+    );
+  }
+  try {
+    await pipeline(Readable.fromWeb(res.body), tar.x({ cwd: target, strip: 1 }));
+    if (!existsSync(join(target, 'package.json'))) {
+      throw new Error('Extracted tarball did not contain package.json — aborting.');
+    }
+  } catch (e) {
+    rmSync(target, { recursive: true, force: true });
+    throw e;
+  }
+  // Invariant: a target dir with package.json present can only result from a
+  // successful prior extract because every failure path above removes the dir.
+  return target;
+}