@dashclaw/cli 0.5.0 → 0.6.1

package/README.md

@@ -48,7 +48,7 @@ npx dashclaw up --yes               # non-interactive, accept all defaults
 npx dashclaw up --no-browser        # skip opening /setup in the browser
 npx dashclaw up --db docker         # force Docker Postgres
 npx dashclaw up --db embedded       # force embedded Postgres (~40 MB download)
-npx dashclaw up --db <url>          # use an existing postgresql:// connection string
+npx dashclaw up --db url            # bring your own Postgres — prompts for a postgresql:// connection string
 npx dashclaw up --dir <path>        # install to a custom directory (default: ~/.dashclaw)
 npx dashclaw up --port <n>          # bind to a custom port (default: 3000)
 npx dashclaw up --source-dir <path> # use a local repo checkout instead of the published tarball
@@ -91,10 +91,10 @@ Provision DashClaw governance into Claude Code without cloning the repo.
 ```bash
 dashclaw install claude                          # prompts for endpoint + API key
 dashclaw install claude --endpoint <url> --key <oc_live_...>
-dashclaw install claude --trial                  # browser signup on a hosted instance, paste the key
+dashclaw install claude --trial                  # browser signup on hosted.dashclaw.io, paste the key
 ```
 
-Flow: preflight (`/api/health` + an authenticated read — nothing is written until it passes), hooks downloaded from your instance's `/downloads/dashclaw-claude-code-hooks.zip` (or copied from a repo checkout), `python3`/`python` resolved automatically, managed hook entries merged into `~/.claude/settings.json` (`.dashclaw-bak` backup, replace-on-reinstall), credentials written to `~/.dashclaw/claude-hooks/.env` (mode 600 — no secret lands in settings.json). Installs in **observe mode**; flip to enforce by setting `DASHCLAW_HOOK_MODE=enforce` in that `.env`. For `--trial`, set `DASHCLAW_HOSTED_URL` (or `--endpoint`) to the hosted instance if it isn't prompted.
+Flow: preflight (`/api/health` + an authenticated read — nothing is written until it passes), hooks downloaded from your instance's `/downloads/dashclaw-claude-code-hooks.zip` (or copied from a repo checkout), `python3`/`python` resolved automatically, managed hook entries merged into `~/.claude/settings.json` (`.dashclaw-bak` backup, replace-on-reinstall), credentials written to `~/.dashclaw/claude-hooks/.env` (mode 600 — no secret lands in settings.json). Installs in **observe mode**; flip to enforce by setting `DASHCLAW_HOOK_MODE=enforce` in that `.env`. `--trial` defaults to the public trial at `https://hosted.dashclaw.io`; point it at your own hosted instance with `--endpoint <url>` (or `DASHCLAW_HOSTED_URL`).
 
 ### `dashclaw cost`
 

package/bin/dashclaw.js

@@ -110,7 +110,8 @@ ${bold('Usage:')}
     --allow-redactions                   Write files that contain redacted secret patterns
     --overwrite                          Clobber existing .NEW side-by-side files
   dashclaw install claude [--trial]      Provision DashClaw governance into Claude Code
-    --endpoint <url>                     Your DashClaw instance URL (or DASHCLAW_BASE_URL)
+    --endpoint <url>                     Your DashClaw instance URL (or DASHCLAW_BASE_URL;
+                                         --trial defaults to https://hosted.dashclaw.io)
     --key <key>                          API key (or DASHCLAW_API_KEY; --trial prompts via browser signup)
     --agent-id <id>                      Agent id for governed actions (default: claude-code)
   dashclaw install codex                 Provision DashClaw governance into Codex CLI

package/lib/claude/install.js

@@ -52,6 +52,11 @@ const HOOKS_BUNDLE_PATH = '/downloads/dashclaw-claude-code-hooks.zip';
 
 export const DEFAULT_AGENT_ID = 'claude-code';
 
+// The public hosted trial instance. `--trial` falls back to it when no
+// --endpoint / DASHCLAW_HOSTED_URL is given — a cold outsider following
+// QUICK-START has no way to answer a "which URL?" prompt (v5.4 outsider run).
+export const DEFAULT_HOSTED_TRIAL_URL = 'https://hosted.dashclaw.io';
+
 // ---------------------------------------------------------------------------
 // Python resolution
 // ---------------------------------------------------------------------------
@@ -182,8 +187,8 @@ async function downloadHooksBundle(endpoint, hooksDst, { fetchImpl = fetch } = {
 // ---------------------------------------------------------------------------
 
 const HOOK_EVENTS = {
-  PreToolUse: { matcher: 'Agent|Task|Bash|Edit|Write|MultiEdit|Skill|mcp__.*', script: 'dashclaw_pretool.py', timeout: 3600000 },
-  PostToolUse: { matcher: 'Agent|Task|Bash|Edit|Write|MultiEdit|mcp__.*', script: 'dashclaw_posttool.py' },
+  PreToolUse: { matcher: 'Agent|Task|Workflow|Bash|Edit|Write|MultiEdit|Skill|mcp__.*', script: 'dashclaw_pretool.py', timeout: 3600000 },
+  PostToolUse: { matcher: 'Agent|Task|Workflow|Bash|Edit|Write|MultiEdit|mcp__.*', script: 'dashclaw_posttool.py' },
   Stop: { script: 'dashclaw_stop.py' },
 };
 
@@ -192,12 +197,15 @@ export function isManagedHookEntry(entry) {
 }
 
 /** Build the managed hook entries pointing at <hooksDir> via <python>. */
-export function buildHookEntries(hooksDir, python) {
+export function buildHookEntries(hooksDir, python, agentId = DEFAULT_AGENT_ID) {
   const entries = {};
   for (const [event, spec] of Object.entries(HOOK_EVENTS)) {
     const hook = {
       type: 'command',
-      command: `${python} "${join(hooksDir, spec.script)}"`,
+      // --agent-id is the per-harness identity declaration (roadmap v2.2):
+      // argv beats the machine-ambient DASHCLAW_AGENT_ID env var, so this
+      // install keeps its identity even when another harness exports one.
+      command: `${python} "${join(hooksDir, spec.script)}" --agent-id "${agentId}"`,
       ...(spec.timeout ? { timeout: spec.timeout } : {}),
     };
     entries[event] = [{ ...(spec.matcher ? { matcher: spec.matcher } : {}), hooks: [hook] }];
@@ -209,7 +217,7 @@ export function buildHookEntries(hooksDir, python) {
  * Merge the managed hook entries into a Claude Code settings.json file:
  * previous dashclaw-managed entries are replaced, everything else preserved.
  */
-export function mergeClaudeSettings(settingsPath, hooksDir, python) {
+export function mergeClaudeSettings(settingsPath, hooksDir, python, agentId = DEFAULT_AGENT_ID) {
   let settings = {};
   if (existsSync(settingsPath)) {
     try {
@@ -221,7 +229,7 @@ export function mergeClaudeSettings(settingsPath, hooksDir, python) {
     if (!existsSync(bak)) copyFileSync(settingsPath, bak);
   }
   settings.hooks = settings.hooks || {};
-  const managed = buildHookEntries(hooksDir, python);
+  const managed = buildHookEntries(hooksDir, python, agentId);
   for (const [event, entries] of Object.entries(managed)) {
     const existing = Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [];
     settings.hooks[event] = [...existing.filter((e) => !isManagedHookEntry(e)), ...entries];
@@ -284,8 +292,13 @@ export async function installClaude({
   apiKey = apiKey || env.DASHCLAW_API_KEY || '';
 
   if (trial && !apiKey) {
-    const hostedBase = (endpoint || env.DASHCLAW_HOSTED_URL || '').replace(/\/+$/, '')
-      || (await mustPrompt(prompt, 'Hosted DashClaw URL (where you signed up / will sign up): '));
+    let hostedBase = (endpoint || env.DASHCLAW_HOSTED_URL || '').replace(/\/+$/, '');
+    if (!hostedBase) {
+      hostedBase = DEFAULT_HOSTED_TRIAL_URL;
+      logger.log('');
+      logger.log(`  Using the public hosted trial: ${DEFAULT_HOSTED_TRIAL_URL}`);
+      logger.log('  (Trying your own instance instead? Re-run with --endpoint <url>.)');
+    }
     const signupUrl = `${hostedBase.replace(/\/+$/, '')}/connect`;
     logger.log('');
     logger.log(`  Opening the trial signup page: ${signupUrl}`);
@@ -321,8 +334,8 @@ export async function installClaude({
     throw new Error('No python3 or python found on PATH. Install Python 3.10+ and re-run.');
   }
   const settingsPath = join(homeDir, '.claude', 'settings.json');
-  logger.log(`  Wiring hooks into ${settingsPath} (python: ${python})`);
-  mergeClaudeSettings(settingsPath, hooksDir, python);
+  logger.log(`  Wiring hooks into ${settingsPath} (python: ${python}, agent: ${agentId})`);
+  mergeClaudeSettings(settingsPath, hooksDir, python, agentId);
 
   // 5. Credentials -------------------------------------------------------------
   const hookEnvPath = join(hooksDir, '.env');

package/lib/codex/install.js

@@ -3,11 +3,13 @@
 // `dashclaw install codex` — provisions DashClaw governance into Codex CLI.
 //
 // What it does, idempotently:
-//   1. Copies the Python governance hooks (pretool, posttool, stop) and the
-//      vendored `dashclaw_agent_intel` module into ~/.codex/hooks/dashclaw/.
+//   1. Copies the Python governance hooks (pretool, posttool, stop, session
+//      digest) and the vendored `dashclaw_agent_intel` module into
+//      ~/.codex/hooks/dashclaw/.
 //   2. Merges a managed block into ~/.codex/config.toml that registers:
 //        - the DashClaw MCP server (stdio)
-//        - PreToolUse / PostToolUse / Stop hooks pointing at the copied scripts
+//        - PreToolUse / PostToolUse / Stop / SessionStart hooks pointing at
+//          the copied scripts
 //        - approval_policy = "on-request" so Codex surfaces require_approval
 //          decisions from DashClaw guard
 //   3. Drops a managed block into <project>/AGENTS.md (or creates the file)
@@ -57,6 +59,12 @@ const HOOK_FILES = [
   'dashclaw_pretool.py',
   'dashclaw_posttool.py',
   'dashclaw_stop.py',
+  // dashclaw_stop.py imports this for Code Sessions ingest; without it the
+  // import fails inside a try/except and ingest silently no-ops (v2.7 fix).
+  'dashclaw_code_session_reporter.py',
+  // SessionStart digest (v3.7 item 6) — wired once codex-cli 0.139.0's
+  // SessionStart hook event was confirmed to fire (see PLUGIN_PARITY.md).
+  'dashclaw_session_digest.py',
 ];
 const HOOK_INTEL_DIR = 'dashclaw_agent_intel';
 
@@ -184,6 +192,7 @@ export function buildConfigTomlBlock({
   const pre = join(hooksDir, 'dashclaw_pretool.py');
   const post = join(hooksDir, 'dashclaw_posttool.py');
   const stop = join(hooksDir, 'dashclaw_stop.py');
+  const sessionStart = join(hooksDir, 'dashclaw_session_digest.py');
 
   const lines = [
     MANAGED_START,
@@ -215,19 +224,31 @@ export function buildConfigTomlBlock({
     'matcher = "Bash|Edit|Write|MultiEdit"',
     '[[hooks.PreToolUse.hooks]]',
     'type = "command"',
-    `command = ${tomlString(`${py} ${pre}`)}`,
+    // --agent-id on the hook command line mirrors the MCP server args above:
+    // the hooks' argv identity beats the machine-ambient DASHCLAW_AGENT_ID
+    // env var, so Codex tool calls are never mis-attributed to another
+    // harness (roadmap v2.2).
+    `command = ${tomlString(`${py} ${pre} --agent-id codex`)}`,
     'timeoutSec = 3600',
     '',
     '[[hooks.PostToolUse]]',
     'matcher = "Bash|Edit|Write|MultiEdit"',
     '[[hooks.PostToolUse.hooks]]',
     'type = "command"',
-    `command = ${tomlString(`${py} ${post}`)}`,
+    `command = ${tomlString(`${py} ${post} --agent-id codex`)}`,
     '',
     '[[hooks.Stop]]',
     '[[hooks.Stop.hooks]]',
     'type = "command"',
-    `command = ${tomlString(`${py} ${stop}`)}`,
+    `command = ${tomlString(`${py} ${stop} --agent-id codex`)}`,
+    '',
+    // Codex CLI 0.139.0's hook-event enum contains SessionStart alongside
+    // Pre/Post/Stop; wired once that lifecycle was verified to fire
+    // (roadmap v3.7 item 6 — see PLUGIN_PARITY.md).
+    '[[hooks.SessionStart]]',
+    '[[hooks.SessionStart.hooks]]',
+    'type = "command"',
+    `command = ${tomlString(`${py} ${sessionStart} --agent-id codex`)}`,
     MANAGED_END,
   );
 

package/lib/config.js

@@ -37,17 +37,29 @@ export function clearConfigFile() {
 
 export function ask(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((res) => {
+  return new Promise((res, rej) => {
+    let answered = false;
     rl.question(question, (answer) => {
+      answered = true;
       rl.close();
       res(answer.trim());
     });
+    // stdin ending (piped input exhausted, Ctrl+D) used to leave the promise
+    // pending forever — node then drained the event loop and exited 0 as if
+    // the install had succeeded (v5.4 outsider run). Fail loudly instead.
+    rl.on('close', () => {
+      if (!answered) rej(new Error('stdin closed before the prompt was answered.'));
+    });
   });
 }
 
 export function askSecret(question) {
-  return new Promise((res) => {
+  return new Promise((res, rej) => {
     const stdin = process.stdin;
+    if (stdin.readableEnded || stdin.destroyed) {
+      rej(new Error('stdin closed before the prompt was answered.'));
+      return;
+    }
     process.stdout.write(question);
     const wasRaw = stdin.isRaw;
     if (stdin.setRawMode) stdin.setRawMode(true);
@@ -55,6 +67,13 @@ export function askSecret(question) {
     stdin.setEncoding('utf8');
 
     let input = '';
+    // Same silent-exit-0 hazard as ask(): if stdin ends before a newline,
+    // reject instead of leaving the promise pending while node exits clean.
+    const onEnd = () => {
+      stdin.removeListener('data', onData);
+      rej(new Error('stdin closed before the prompt was answered.'));
+    };
+    stdin.once('end', onEnd);
     const onData = (char) => {
       const str = String(char);
       for (const c of str) {
@@ -62,6 +81,7 @@ export function askSecret(question) {
           if (stdin.setRawMode) stdin.setRawMode(wasRaw);
           stdin.pause();
           stdin.removeListener('data', onData);
+          stdin.removeListener('end', onEnd);
           process.stdout.write('\n');
           res(input.trim());
           return;

package/lib/up/db.js

@@ -120,11 +120,14 @@ export async function provisionDatabase({ mode, baseDir, promptFn, logger = cons
   // Only clean up on failure when WE created it (a pre-existing dir means
   // a working prior install whose data we must not delete).
   const dirPreExisted = existsSync(pgDir);
+  // Derive credentials from LOCAL_DB_URL so the local dev creds live in
+  // exactly one place rather than being duplicated as bare literals here.
+  const localDb = new URL(LOCAL_DB_URL);
   const pg = new EmbeddedPostgres({
     databaseDir: pgDir,
-    user: 'dashclaw',
-    password: 'dashclaw',
-    port: 5433,
+    user: localDb.username,
+    password: localDb.password,
+    port: Number(localDb.port),
     persistent: true,
   });
   try {

package/lib/up/fetch-app.js

@@ -16,17 +16,37 @@ const REPO = 'ucsandman/DashClaw';
  * Fetch the latest published platform version from the npm registry.
  * The `dashclaw` npm package version mirrors the platform version (unified versioning).
  *
+ * npm's version number is only trusted after verifying its git tag exists —
+ * a publish that shipped without cutting its tag would otherwise 404 every
+ * install. When the tag is missing, fall back to the latest GitHub release.
+ *
  * @param {typeof fetch} fetchImpl - injectable for tests
+ * @param {{ error: (...args: any[]) => void }} logger
  * @returns {Promise<string>} semver string e.g. '4.21.0'
  */
-export async function resolveAppVersion(fetchImpl = fetch) {
+export async function resolveAppVersion(fetchImpl = fetch, logger = console) {
   const res = await fetchImpl('https://registry.npmjs.org/dashclaw/latest');
   if (!res.ok) {
     throw new Error(`npm registry lookup failed (${res.status}) — check your network and retry.`);
   }
   const { version } = await res.json();
   if (!version) throw new Error('npm registry returned no version for dashclaw.');
-  return version;
+
+  const head = await fetchImpl(tarballUrl(version), { method: 'HEAD' });
+  if (head.ok) return version;
+
+  const rel = await fetchImpl(`https://api.github.com/repos/${REPO}/releases/latest`, {
+    headers: { accept: 'application/vnd.github+json' },
+  });
+  const tagName = rel.ok ? (await rel.json()).tag_name : null;
+  const fallback = typeof tagName === 'string' ? tagName.replace(/^v/, '') : null;
+  if (!fallback) {
+    throw new Error(
+      `Tag v${version} (npm latest) is missing on GitHub and no release fallback was found — report this at https://github.com/${REPO}/issues.`,
+    );
+  }
+  logger.error(`[warn] npm reports ${version} but tag v${version} is missing; using latest GitHub release ${fallback} instead.`);
+  return fallback;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dashclaw/cli",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "DashClaw terminal client — approve agent actions and diagnose your instance",
   "type": "module",
   "keywords": [