@delt/claude-jev-advisor 0.2.0 → 0.3.0

package/README.md

@@ -5,21 +5,21 @@ Unofficial helpers for [Claude Code](https://claude.com/claude-code), installed
 What is sent to TypeSafe's Jev API (`api.typesafe.ai`):
 
 - `context`: your last three requests (typed by you, or sent through a channel or from another Claude Code session), each cut to its first 1,000 characters, and Claude's last reply, cut to its first and last 1,500 characters.
-- `rm`: only for a delete it would otherwise ask about, and only when the target is a file this session made or a folder git ignores. It sends the path, the `rm` command and its description, up to three tool calls of this session that name the target (each cut to 600 characters), and for a folder up to ten of its file names.
+- `rm`: only for a delete it would otherwise ask about, and only when the target is a file this session made or a folder git ignores. It sends the path, the delete command and its description, up to three tool calls of this session that name the target (each cut to 600 characters), and for a folder up to ten of its file names.
 
 Not affiliated with Anthropic or TypeSafe.
 
 | Helper | What it does | Systems |
 |---|---|---|
 | `context` | At the end of each turn, suggests `/compact` or `/clear` when the conversation is large and the work has reached a stopping point. Shown at the end of Claude Code's bottom row. | Any |
-| `rm` | Asks before a Bash `rm` deletes real files. Lets temp files through and refuses an `rm` whose targets it cannot work out. Jev can lift the ask for a test file this session made or a folder git ignores. | Windows |
+| `rm` | Asks before a Bash or PowerShell command deletes real files (`rm`, `Remove-Item`, `del`, `rd`, also inside `sh -c`, `powershell -Command` or `cmd /c`). Lets temp files through and refuses a delete whose targets it cannot work out. Jev can lift the ask for a test file this session made or a folder git ignores. | Windows |
 
 ## Requirements
 
 - Node.js 18 or later
 - Claude Code (the bottom-row display uses Claude Code mods, an early-access feature that may change between releases)
 - A TypeSafe API key for the `context` helper and for the Jev check of the `rm` helper, in `TYPESAFE_API_KEY` or in a key file (`--key-file`). Without a key, `rm` asks about every real file.
-- Windows for the `rm` helper. On other systems `install` skips it and says why.
+- Windows for the `rm` helper. On other systems `install` skips it and says why. It reads PowerShell commands with Windows PowerShell, which comes with Windows, or with PowerShell 7 when `pwsh` is on `PATH`, the same one Claude Code uses. It was checked with Windows PowerShell 5.1; PowerShell 7 was not tested.
 
 ## Install
 
@@ -35,7 +35,9 @@ claude-jev-advisor install
 
 When the context helper is installed and no key is found, `install` asks for your TypeSafe API key. What you type is hidden. It checks the key with one small Jev call and saves it to `~/.claude/claude-jev-advisor/jev-key.env`. Press Enter to skip; `claude-jev-advisor key` asks again later. Instead of typing it, you can set `TYPESAFE_API_KEY`, or pass `--key-file <path>` to a file holding a line `TYPESAFE_API_KEY=...` (then only that path is saved). The key is never printed or logged. On Windows that file is protected by your user folder's permissions only.
 
-Before it changes `~/.claude/settings.json`, `install` copies it to `~/.claude/backups/settings.json.<YYYY-MM-DD-HHmmss>-before-claude-jev-advisor`. If a backup from the same second already exists, it adds `-2`, `-3` and so on instead of overwriting it. It then adds or replaces only this package's entries. Running it again changes nothing.
+Before it changes `~/.claude/settings.json`, `install` copies it to `~/.claude/backups/settings.json.<YYYY-MM-DD-HHmmss>-before-claude-jev-advisor`. If a backup from the same second already exists, it adds `-2`, `-3` and so on instead of overwriting it. It then adds or replaces only this package's entries. Running it again with the same version changes nothing.
+
+After upgrading from 0.2 or earlier, run `claude-jev-advisor install rm` again so that the rm hook also covers the PowerShell tool. Until you do, `status` shows `Bash only`.
 
 The hooks also reach Claude Code sessions that are already open; the bottom-row display starts with the next new session. Turning a helper on or off applies at once, even to open sessions.
 
@@ -84,7 +86,11 @@ Judging starts at 250k because a conversation passes 100k after a request or two
 
 ## The rm helper
 
-It runs before every Bash tool call (`PreToolUse`, matcher `Bash`, 15-second timeout) and looks only at `rm`, `rmdir` and `xargs`.
+It runs before every Bash and PowerShell tool call (`PreToolUse`, matcher `Bash|PowerShell`, 15-second timeout) and looks at:
+
+- Bash: `rm`, `rmdir` and `xargs`
+- PowerShell: `Remove-Item` and its aliases `ri`, `rm`, `del`, `erase`, `rd` and `rmdir`, and `[System.IO.File]::Delete` and `[System.IO.Directory]::Delete`. PowerShell's own parser and parameter binder read the command, so aliases, shortened parameter names, positional paths and nested blocks count as PowerShell reads them. PowerShell is started only when the command holds one of these words or a shell name, and takes about 0.3 seconds.
+- shells started inside a command, up to three levels deep: `sh -c` and `bash -c`, `powershell -Command`, `pwsh -c` and `-EncodedCommand`, and `del`, `erase`, `rd` and `rmdir` in `cmd /c`
 
 | Target | Result |
 |---|---|
@@ -92,23 +98,30 @@ It runs before every Bash tool call (`PreToolUse`, matcher `Bash`, 15-second tim
 | A path with a `.superpowers` folder in it | No decision |
 | A path that does not exist | No decision |
 | A git-ignored path inside a build folder (`target`, `build`, `dist`, `out`, `node_modules`, `coverage`, `__pycache__`, `.pytest_cache`, `.gradle`, `.next`, `.nuxt`, `.turbo`, `.cache`, `bin`, `obj`) | No decision |
+| A PowerShell path on a drive that is not a file system (`Env:`, `Alias:`, `Function:`, `Variable:`, `HKCU:`, `HKLM:`, `Cert:`, `WSMan:`, `Registry::`) | No decision |
+| `Remove-Item … -WhatIf` | No decision |
+| A network path (`\\server\share\…`) | `ask`, without looking the path up |
 | Any other existing file or folder | `ask`, with the reason `실제 파일 삭제: <paths>` ("deleting real files"), unless Jev lifts it (below) |
+| A PowerShell command its parser cannot read (a syntax error, PowerShell not answering within 3 seconds, a nested PowerShell command left when the hook has spent 9 seconds reading, an answer it does not expect), or one that deletes and runs code it cannot follow (`& $name`, `Invoke-Expression`, `Start-Process` or `Set-Alias` with an argument it cannot work out, `[scriptblock]::Create`, `.Invoke()`, a `Delete()` method in a command that gets file objects from `Get-Item`, `Get-ChildItem`, `New-Item` or `-PassThru`), or makes a drive with `New-PSDrive` | `ask`, with the reason `삭제 명령을 분석하지 못함: <start of the command>` ("could not read the delete command"). Jev is not asked. |
 | A target it cannot work out | `deny`, with a hint to rewrite the command using literal paths |
 
 A target cannot be worked out when it uses:
 
-- shell variables, other than literal assignments in the same command and `TEMP`, `TMP`, `TMPDIR`, `HOME`, `USERPROFILE` and `PWD`
-- command substitution
-- `xargs` feeding `rm`
+- in Bash, shell variables other than literal assignments in the same command and `TEMP`, `TMP`, `TMPDIR`, `HOME`, `USERPROFILE` and `PWD`; in PowerShell, variables other than one plain top-level assignment in the same command (a variable written any other way, such as `+=`, a loop, a function parameter, `Set-Variable`, `$script:`, `-OutVariable`, or its name handed to a command as text, is unknown), `$env:TEMP`, `$env:TMP`, `$env:TMPDIR`, `$env:HOME`, `$env:USERPROFILE`, `$HOME` and `$PWD` (unless the command assigns it); in `cmd`, variables other than `%TEMP%`, `%TMP%`, `%USERPROFILE%` and `%CD%`
+- command substitution, or in PowerShell any expression such as `(Join-Path …)`, `$(…)` or `@splat`
+- `xargs` feeding `rm` or a shell that deletes, PowerShell pipeline input feeding `Remove-Item` (`Get-ChildItem … | Remove-Item`), or a shell given no script of its own, which reads one from a pipe, a heredoc or a here-string (`… | bash`, `bash <<EOF`, `powershell -`), in a command that holds a delete word
 - brace expansion
 - a wildcard in a folder name
-- a `cd` to such a path earlier in the command
+- a `cd`, `pushd`, `Set-Location` or `Push-Location` to such a path earlier in the command, a `popd` or `Pop-Location`, or a location change inside a PowerShell block; in PowerShell also a relative path inside a loop, a function or a script block when the command changes location anywhere
+- a PowerShell drive other than a drive letter and the non-file drives above, such as one made with `New-PSDrive`
+- a nested shell whose script is not fixed text and holds a delete word, or shells nested more than three deep that delete
+- in `cmd`, a delete on a line that uses `if`, `else`, `for`, `call`, `start` or unquoted parentheses, or starts a command with a name it cannot read: write plain `del` or `rd` lines instead, with names that hold parentheses in double quotes
 
 It does not see deletions made any other way:
 
-- through the PowerShell tool (`Remove-Item` and its aliases). On Windows with Git Bash installed, Claude Code turns this tool on by default for claude.ai and Console accounts and uses PowerShell as its main shell, so many deletions go through it.
-- through a nested shell: `sh -c`, `bash -c`, `powershell -Command`, `pwsh -c`, `cmd /c del`
-- with other commands or programs, such as `find -delete`, `git clean` or a script that deletes files
+- in PowerShell, `Remove-ItemProperty`, `Clear-RecycleBin`, an object's `Delete()` in a command that gets no file objects, COM file objects (`Scripting.FileSystemObject`'s `DeleteFile` and `DeleteFolder`), provider methods such as `$ExecutionContext.InvokeProvider.Item.Remove`, and code that builds a command's name or text from pieces while it runs (`[char]` codes, joined strings); the reader is not a sandbox
+- script files: `powershell -File`, `pwsh script.ps1`, `bash script.sh`, a `.bat` file
+- other commands or programs, such as `find -delete`, `git clean`, or Node or Python code that deletes files
 
 What its decisions do depends on Claude Code's permission mode:
 
@@ -124,7 +137,7 @@ The facts are checked by code; Jev only judges what the target is for. Jev is as
 
 | Target | Checked first | Jev is asked |
 |---|---|---|
-| A file or folder this session made | Not tracked by git; the first call of this session that names it created it: a Write that made a new file, or a shell command whose `>` redirect, `touch`, `mkdir` or `curl -o` makes it (deletes do not count, and a Read, an Edit or any other shell command first means it was already there); made after the session started; for a folder, every file inside too, and at most 50 files | Is it a throwaway made only to try something out? |
+| A file or folder this session made | Not tracked by git; the first call of this session that names it created it: a Write that made a new file, or a shell command whose `>` redirect, `touch`, `mkdir` or `curl -o` makes it (deletes do not count, and a Read, an Edit or any other shell command first means it was already there; PowerShell's `New-Item`, `Set-Content` and `Out-File` are not recognized yet, so a file made with them keeps the ask); a folder holding a git repository never counts; made after the session started; for a folder, every file inside too, and at most 50 files | Is it a throwaway made only to try something out? |
 | A folder git ignores, outside the build folders above | It is a folder (a single ignored file such as `.env` still asks) | Is it generated output or a cache that is made again? |
 
 When Jev answers 0.8 or more for every target, the hook makes no decision (the last column of the table above), and a line like `[jev-advisor] Jev가 이 세션의 시험 파일로 판단해 묻지 않고 지웁니다: out.json (0.93)` is shown. Otherwise the ask stays, with Jev's answer added: `실제 파일 삭제: …\out.json · Jev: 시험용 파일일 확률 0.42`. Without a key, when Jev fails, or with `"jev": false`, every real file asks as before. A `deny` is never sent to Jev.
@@ -152,7 +165,7 @@ A key saved by `install` or `key` stays in `~/.claude/claude-jev-advisor/jev-key
 |---|---|
 | `~/.claude/claude-jev-advisor/config.json` | Switches and settings that differ from the defaults. A missing or broken file reads as the defaults. A value of the wrong type falls back to its default, so only `"enabled": false` turns a helper off. |
 | `~/.claude/claude-jev-advisor/state/<session>.json` | The last judgment of each open session, read by the display. Removed when the session ends. |
-| `~/.claude/claude-jev-advisor/log/YYYY-MM.jsonl` | One line per context judgment and per `rm` Jev check: the size or the command, what was sent to Jev (parts of your conversation), the answers and the result. Never the key. |
+| `~/.claude/claude-jev-advisor/log/YYYY-MM.jsonl` | One line per context judgment and per `rm` Jev check: the size, or the tool (`Bash` or `PowerShell`) and the command, what was sent to Jev (parts of your conversation), the answers and the result. Never the key. |
 | `~/.claude/claude-jev-advisor/statusline-before.json` | Your own status line while `--display statusline` is in use |
 | `~/.claude/claude-jev-advisor/jev-key.env` | Your TypeSafe API key, when you typed it in `install` or `key` |
 | `~/.claude/backups/settings.json.*-before-claude-jev-advisor` | Copies of `settings.json` from before each change |

package/dist/cli.js

@@ -164,7 +164,7 @@ function updateConfig(home, change) {
 // src/features.ts
 var FEATURES = ["rm", "context"];
 var HOOK_SPECS = {
-  rm: [{ event: "PreToolUse", matcher: "Bash", script: "rm-hook.js", args: [] }],
+  rm: [{ event: "PreToolUse", matcher: "Bash|PowerShell", script: "rm-hook.js", args: [] }],
   context: [
     { event: "Stop", script: "context-hook.js", args: ["stop"] },
     { event: "SessionEnd", script: "context-hook.js", args: ["session-end"] }
@@ -842,6 +842,14 @@ function rmJevLine(config, env) {
   const key = readJevKey(env, config.keyFile) ? "" : " (no key - every real file asks)";
   return `  jev: on, lifts the ask from ${config.rm.throwawayYes}${key}`;
 }
+function coversPowerShell(matcher) {
+  if (!matcher || matcher === "*") return true;
+  try {
+    return new RegExp(`^(?:${matcher})$`).test("PowerShell");
+  } catch {
+    return false;
+  }
+}
 function statusLines(home, env = process.env) {
   const lines = [`settings: ${settingsPath(home)}`, `config:   ${configPath(home)}`];
   let settings;
@@ -866,7 +874,12 @@ function statusLines(home, env = process.env) {
       }
     }
     if (feature === "context") lines.push(...contextLines(home, settings, config, env));
-    if (feature === "rm") lines.push(rmJevLine(config, env));
+    if (feature === "rm") {
+      lines.push(rmJevLine(config, env));
+      if (!commands.some((c) => coversPowerShell(c.matcher))) {
+        lines.push('  Bash only: run "claude-jev-advisor install rm" to cover PowerShell');
+      }
+    }
   }
   if (findCommands(settings, LEGACY_RM_GUARD).length) {
     lines.push('legacy rm-guard hook (~/.claude/hooks/rm-guard) is still registered - "claude-jev-advisor install rm" replaces it');