@fml-inc/fml 0.8.0-rc.1 → 0.8.0-rc.2

package/dist/hook-handler.js

@@ -1,30 +1,263 @@
 #!/usr/bin/env node
 import {
   hookCaptureIsDisabled
-} from "./chunk-I4GZPTBM.js";
+} from "./chunk-ENW2GJNO.js";
 import {
   getActiveHookDestinationBinding
-} from "./chunk-F66IBM3Z.js";
+} from "./chunk-DZKYW327.js";
 import {
   HOOK_TARGETS,
+  SHELL_TOOL_NAMES,
   createHookInboxEntry,
   hookInboxDeliveryPayload,
   normalizeObserverHookCapture,
   persistHookInboxEntry,
   readObserverAuthToken
-} from "./chunk-DEMVOVVY.js";
+} from "./chunk-56TPYMNK.js";
 import {
+  resolveRepositoryRootFromCwd,
   resolveRepositorySlugFromCwd
-} from "./chunk-T5YVLSUC.js";
+} from "./chunk-7V7G7NVF.js";
 import {
+  FML_HOOK_CONTEXT_STATE_DIR,
   FML_HOOK_INBOX_DIR,
   FML_OBSERVER_AUTH_TOKEN_FILE,
-  FML_OBSERVER_ENDPOINT_FILE
-} from "./chunk-7DR5X7XI.js";
+  FML_OBSERVER_ENDPOINT_FILE,
+  getValidToken
+} from "./chunk-A6HAEVJX.js";
 import "./chunk-MLKGABMK.js";
 
 // src/hooks/handler.ts
+import fs2 from "fs";
+
+// src/hooks/context.ts
+import { createHash } from "crypto";
 import fs from "fs";
+import path from "path";
+var HOOK_CONTEXT_ENDPOINT = "/v1/panopticon/hook-context";
+var HOOK_CONTEXT_TIMEOUT_MS = 2e3;
+var MAX_ADDITIONAL_CONTEXT_CHARS = 4e3;
+var MAX_PROMPT_CHARS = 2e4;
+var STATE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+var EDIT_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "apply_patch",
+  "edit",
+  "multiedit",
+  "notebookedit",
+  "write",
+  "write_file"
+]);
+var READ_TOOL_NAMES = /* @__PURE__ */ new Set(["read", "read_file"]);
+function sameDestination(left, right) {
+  return left.environment === right.environment && left.targetUrl === right.targetUrl && left.destinationIdentity === right.destinationIdentity;
+}
+function markerPath(stateDir, kind, value) {
+  const digest = createHash("sha256").update(value).digest("hex");
+  return path.join(stateDir, kind, digest);
+}
+function ensureMarkerDirectory(filePath) {
+  try {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 448 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isSubsequentUserPrompt(sessionId, eventSyncId, stateDir = FML_HOOK_CONTEXT_STATE_DIR) {
+  const filePath = markerPath(stateDir, "prompt", sessionId);
+  if (!ensureMarkerDirectory(filePath)) return false;
+  try {
+    fs.writeFileSync(filePath, eventSyncId, { flag: "wx", mode: 384 });
+    return false;
+  } catch (error) {
+    if (error.code !== "EEXIST") return false;
+    try {
+      return fs.readFileSync(filePath, "utf8") !== eventSyncId;
+    } catch {
+      return false;
+    }
+  }
+}
+function pathContextWasEmitted(sessionId, filePath, stateDir) {
+  try {
+    return fs.existsSync(
+      markerPath(stateDir, "path", `${sessionId}:${filePath}`)
+    );
+  } catch {
+    return true;
+  }
+}
+function claimPathContext(sessionId, filePath, stateDir) {
+  const claim = markerPath(stateDir, "path", `${sessionId}:${filePath}`);
+  if (!ensureMarkerDirectory(claim)) return false;
+  try {
+    fs.writeFileSync(claim, "", { flag: "wx", mode: 384 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pruneOldMarkers(directory, nowMs) {
+  if ((nowMs + process.pid) % 256 !== 0) return;
+  for (const kind of ["prompt", "path"]) {
+    const markerDirectory = path.join(directory, kind);
+    let names;
+    try {
+      names = fs.readdirSync(markerDirectory).slice(0, 1e3);
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      const filePath = path.join(markerDirectory, name);
+      try {
+        if (nowMs - fs.statSync(filePath).mtimeMs > STATE_MAX_AGE_MS) {
+          fs.rmSync(filePath, { force: true });
+        }
+      } catch {
+      }
+    }
+  }
+}
+function canonicalFilePath(filePath, cwd, repositoryRoot) {
+  const windows = [filePath, cwd, repositoryRoot].some(
+    (value) => value !== void 0 && value !== null && /^[A-Za-z]:[\\/]/.test(value)
+  );
+  const pathApi = windows ? path.win32 : path.posix;
+  const normalized = pathApi.normalize(filePath);
+  const resolved = pathApi.isAbsolute(normalized) ? normalized : cwd && pathApi.isAbsolute(cwd) ? pathApi.resolve(cwd, normalized) : normalized;
+  if (repositoryRoot && pathApi.isAbsolute(resolved)) {
+    const relative2 = pathApi.relative(
+      pathApi.normalize(repositoryRoot),
+      resolved
+    );
+    if (relative2 && relative2 !== ".." && !relative2.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(relative2)) {
+      return relative2.replace(/\\/g, "/");
+    }
+  }
+  if (!pathApi.isAbsolute(resolved)) {
+    return resolved.replace(/^[.][\\/]/, "").replace(/\\/g, "/");
+  }
+  if (!cwd || pathApi.isAbsolute(cwd) !== pathApi.isAbsolute(resolved)) {
+    return resolved.replace(/\\/g, "/");
+  }
+  const relative = pathApi.relative(pathApi.normalize(cwd), resolved);
+  if (relative && relative !== ".." && !relative.startsWith(`..${pathApi.sep}`) && !pathApi.isAbsolute(relative)) {
+    return relative.replace(/\\/g, "/");
+  }
+  return resolved.replace(/\\/g, "/");
+}
+function buildServerHookContextRequest(target2, event, stateDir = FML_HOOK_CONTEXT_STATE_DIR, repositoryRoot = null) {
+  if (target2 !== "claude" && target2 !== "codex") return null;
+  if (!event.repository) return null;
+  const markerSessionId = `${target2}:${event.sessionId}`;
+  const base = {
+    repository: event.repository,
+    sessionId: event.sessionId,
+    nowMs: event.timestampMs
+  };
+  if (event.eventType === "SessionStart") {
+    return { ...base, eventType: "SessionStart" };
+  }
+  if (event.eventType === "UserPromptSubmit" && event.userPrompt) {
+    if (!isSubsequentUserPrompt(markerSessionId, event.syncId, stateDir)) {
+      return null;
+    }
+    return {
+      ...base,
+      eventType: "UserPromptSubmit",
+      prompt: event.userPrompt.slice(0, MAX_PROMPT_CHARS)
+    };
+  }
+  if (event.eventType !== "PreToolUse" || !event.toolName) {
+    return null;
+  }
+  const toolName = event.toolName.toLowerCase();
+  const fileOperation = EDIT_TOOL_NAMES.has(toolName) ? "edit" : READ_TOOL_NAMES.has(toolName) || SHELL_TOOL_NAMES.has(toolName) ? "read" : null;
+  if (!fileOperation) return null;
+  if (!event.filePath) return null;
+  const filePath = canonicalFilePath(event.filePath, event.cwd, repositoryRoot);
+  if (pathContextWasEmitted(
+    markerSessionId,
+    `${event.repository}:${filePath}`,
+    stateDir
+  )) {
+    return null;
+  }
+  return { ...base, eventType: "PreToolUse", filePath, fileOperation };
+}
+function hookOutput(request, additionalContext) {
+  return {
+    hookSpecificOutput: {
+      hookEventName: request.eventType,
+      additionalContext
+    }
+  };
+}
+async function requestServerHookContext(target2, event, destination, opts = {}) {
+  const deadlineSignal = AbortSignal.timeout(
+    opts.timeoutMs ?? HOOK_CONTEXT_TIMEOUT_MS
+  );
+  const stateDir = opts.stateDir ?? FML_HOOK_CONTEXT_STATE_DIR;
+  pruneOldMarkers(stateDir, Date.now());
+  const repositoryRoot = event.eventType === "PreToolUse" && event.cwd ? (opts.resolveRepositoryRoot ?? ((cwd) => resolveRepositoryRootFromCwd(cwd, 250)))(event.cwd) : null;
+  const request = buildServerHookContextRequest(
+    target2,
+    event,
+    stateDir,
+    repositoryRoot
+  );
+  if (!request) return {};
+  try {
+    const token = await getValidToken({
+      env: destination.environment,
+      signal: deadlineSignal
+    });
+    if (!token) return {};
+    const currentDestination = getActiveHookDestinationBinding();
+    if (!currentDestination || !sameDestination(destination, currentDestination)) {
+      return {};
+    }
+    const response = await (opts.fetch ?? fetch)(
+      `${destination.targetUrl.replace(/\/+$/, "")}${HOOK_CONTEXT_ENDPOINT}`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: token.startsWith("Bearer ") ? token : `Bearer ${token}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(request),
+        signal: deadlineSignal
+      }
+    );
+    if (!response.ok) return {};
+    const body = await response.json();
+    if (!body || typeof body !== "object" || Array.isArray(body)) return {};
+    const additionalContext = body.additionalContext;
+    if (request.eventType === "PreToolUse" && request.filePath && additionalContext === null) {
+      claimPathContext(
+        `${target2}:${request.sessionId}`,
+        `${request.repository}:${request.filePath}`,
+        stateDir
+      );
+      return {};
+    }
+    if (typeof additionalContext !== "string" || additionalContext.length === 0 || additionalContext.length > MAX_ADDITIONAL_CONTEXT_CHARS) {
+      return {};
+    }
+    if (request.eventType === "PreToolUse" && request.filePath && !claimPathContext(
+      `${target2}:${request.sessionId}`,
+      `${request.repository}:${request.filePath}`,
+      stateDir
+    )) {
+      return {};
+    }
+    return hookOutput(request, additionalContext);
+  } catch {
+    return {};
+  }
+}
+
+// src/hooks/handler.ts
 var MAX_HOOK_STDIN_BYTES = 4 * 1024 * 1024;
 var HOOK_REQUEST_TIMEOUT_MS = 500;
 var HOOK_STDIN_TIMEOUT_MS = 5e3;
@@ -34,7 +267,7 @@ function parseHookTarget(value) {
 }
 function observerEndpoint(endpointFile) {
   try {
-    const parsed = JSON.parse(fs.readFileSync(endpointFile, "utf8"));
+    const parsed = JSON.parse(fs2.readFileSync(endpointFile, "utf8"));
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return null;
     }
@@ -97,23 +330,25 @@ async function readBoundedInput(input, timeoutMs) {
     input.resume();
   });
 }
-async function runHookHandler(target2, opts = {}) {
+async function processHookHandler(target2, opts, includeContext) {
   const input = opts.input ?? process.stdin;
   const bytes = await readBoundedInput(
     input,
     opts.inputTimeoutMs ?? HOOK_STDIN_TIMEOUT_MS
   );
-  if (!bytes || bytes.byteLength === 0) return false;
+  if (!bytes || bytes.byteLength === 0) return { captured: false, output: {} };
   let payload;
   try {
     payload = JSON.parse(bytes.toString("utf8"));
   } catch {
-    return false;
+    return { captured: false, output: {} };
   }
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return false;
+    return { captured: false, output: {} };
+  }
+  if (hookCaptureIsDisabled(opts.captureDisabledFile)) {
+    return { captured: false, output: {} };
   }
-  if (hookCaptureIsDisabled(opts.captureDisabledFile)) return false;
   const cwd = opts.cwd ?? process.cwd();
   const hookRequest = {
     target: target2,
@@ -134,8 +369,8 @@ async function runHookHandler(target2, opts = {}) {
   const inboxDir = opts.inboxDir ?? FML_HOOK_INBOX_DIR;
   let inboxEntry;
   let persisted = false;
+  let destination = null;
   if (event) {
-    let destination = null;
     try {
       destination = getActiveHookDestinationBinding();
     } catch {
@@ -151,40 +386,55 @@ async function runHookHandler(target2, opts = {}) {
     } catch {
     }
   }
+  const contextPromise = includeContext && event && destination ? opts.requestContext ? opts.requestContext(target2, event, destination) : requestServerHookContext(target2, event, destination, {
+    ...opts.contextFetch ? { fetch: opts.contextFetch } : {},
+    ...opts.contextTimeoutMs === void 0 ? {} : { timeoutMs: opts.contextTimeoutMs },
+    ...opts.contextStateDir ? { stateDir: opts.contextStateDir } : {}
+  }) : Promise.resolve({});
   const endpoint = observerEndpoint(
     opts.endpointFile ?? FML_OBSERVER_ENDPOINT_FILE
   );
   const authToken = readObserverAuthToken(
     opts.authTokenFile ?? FML_OBSERVER_AUTH_TOKEN_FILE
   );
-  if (!endpoint || !authToken) return persisted;
-  const host = endpoint.host === "::1" ? "[::1]" : endpoint.host;
-  const fetchRequest = opts.fetch ?? fetch;
-  try {
-    const response = await fetchRequest(
-      `http://${host}:${endpoint.port}/hooks`,
-      {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${authToken}`,
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(
-          inboxEntry ? hookInboxDeliveryPayload(inboxEntry) : hookRequest
-        ),
-        signal: AbortSignal.timeout(opts.timeoutMs ?? HOOK_REQUEST_TIMEOUT_MS)
-      }
-    );
-    await response.arrayBuffer();
-    return response.ok || persisted;
-  } catch {
-    return persisted;
-  }
+  const deliveryPromise = (async () => {
+    if (!endpoint || !authToken) return persisted;
+    const host = endpoint.host === "::1" ? "[::1]" : endpoint.host;
+    const fetchRequest = opts.fetch ?? fetch;
+    try {
+      const response = await fetchRequest(
+        `http://${host}:${endpoint.port}/hooks`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${authToken}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(
+            inboxEntry ? hookInboxDeliveryPayload(inboxEntry) : hookRequest
+          ),
+          signal: AbortSignal.timeout(
+            opts.timeoutMs ?? HOOK_REQUEST_TIMEOUT_MS
+          )
+        }
+      );
+      await response.arrayBuffer();
+      return response.ok || persisted;
+    } catch {
+      return persisted;
+    }
+  })();
+  const [captured, output2] = await Promise.all([
+    deliveryPromise,
+    contextPromise.catch(() => ({}))
+  ]);
+  return { captured, output: output2 };
+}
+async function runHookHandlerForOutput(target2, opts = {}) {
+  return (await processHookHandler(target2, opts, true)).output;
 }
 
 // src/hook-handler.ts
 var target = parseHookTarget(process.argv[2]);
-if (target) {
-  await runHookHandler(target).catch(() => false);
-}
-process.stdout.write("{}");
+var output = target ? await runHookHandlerForOutput(target).catch(() => ({})) : {};
+process.stdout.write(JSON.stringify(output));

package/dist/mcp/server.js

@@ -2,10 +2,10 @@
 import {
   createFmlClient,
   getAuthenticatedClient
-} from "../chunk-P3QLARXE.js";
+} from "../chunk-R45CWWZO.js";
 import {
   resolveRepoFromCwd
-} from "../chunk-T5YVLSUC.js";
+} from "../chunk-7V7G7NVF.js";
 import {
   FML_DATA_DIR,
   FML_LOG_DIR,
@@ -17,7 +17,7 @@ import {
   getValidToken,
   initSentry,
   readTokens
-} from "../chunk-7DR5X7XI.js";
+} from "../chunk-A6HAEVJX.js";
 import "../chunk-MLKGABMK.js";
 
 // src/mcp/server.ts
@@ -75,15 +75,15 @@ function registerTools(server2, environment = getActiveEnv()) {
   const registerSessionTimelineTool = () => {
     server2.tool(
       "get_session_timeline",
-      'Get chronological timeline for a coding agent session. Returns messages and/or hook events interleaved by timestamp. Use source="hooks" to see permission requests, tool approvals, etc. REQUIRES: sessionId from list_engineering_sessions.',
+      'Get chronological timeline for a coding agent session. Returns messages, hook events, and transcript-derived scanner events interleaved by timestamp. Use source="events" for the scanner event stream (thinking, tool_call, permission_mode, stop_hook_summary, ...); source="hooks" only returns live hook-capture events and is empty for scanner-only sessions. REQUIRES: sessionId from list_engineering_sessions.',
       {
         sessionId: z.string().describe("The session ID to get details for."),
         includeSystemMessages: z.boolean().optional().describe("Include system messages (default false)."),
-        source: z.enum(["messages", "hooks", "all"]).optional().describe(
-          'Filter by source: "messages" (scanner messages only), "hooks" (hook events only), "all" (both interleaved). Default "all".'
+        source: z.enum(["messages", "hooks", "events", "all"]).optional().describe(
+          'Filter by source: "messages" (scanner messages only), "hooks" (live hook-capture events only), "events" (transcript-derived scanner events), "all" (everything interleaved). Default "all".'
         ),
         eventType: z.string().optional().describe(
-          'Filter hook events by type (e.g. "PermissionRequest", "PreToolUse", "Stop"). Only applies when source includes hooks.'
+          'Filter hook/scanner events by type (hook: "PermissionRequest", "PreToolUse", "Stop"; scanner: "tool_call", "permission_mode", "stop_hook_summary"). Only applies when source includes hooks or events.'
         ),
         limit: z.number().optional().describe("Max entries to return (default 50, max 200)."),
         offset: z.number().optional().describe("Skip first N entries for pagination.")

package/dist/observer-server.js

@@ -6,11 +6,11 @@ import {
   observerLeaseIsOwned,
   removeObserverStateIfOwned,
   updateObserverState
-} from "./chunk-HUR2HCUG.js";
+} from "./chunk-WZLLO563.js";
 import {
   createHookSyncLoop,
   getActiveHookDestinationBinding
-} from "./chunk-F66IBM3Z.js";
+} from "./chunk-DZKYW327.js";
 import {
   OBSERVER_PROTOCOL_VERSION,
   OBSERVER_SERVICE_NAME,
@@ -25,15 +25,15 @@ import {
   parseHookInboxMetadata,
   readHookInboxStatusAsync,
   retireHookInboxEntry
-} from "./chunk-DEMVOVVY.js";
-import "./chunk-T5YVLSUC.js";
+} from "./chunk-56TPYMNK.js";
+import "./chunk-7V7G7NVF.js";
 import {
   ObserverSyncCycleAbortedError,
   runObserverSyncCycleSubprocess
-} from "./chunk-CK5MEL5J.js";
+} from "./chunk-3KISRT57.js";
 import {
   createCliRawSync
-} from "./chunk-JXSSPQ5B.js";
+} from "./chunk-YSU5CS2V.js";
 import {
   FML_OBSERVER_AUTH_TOKEN_FILE,
   FML_OBSERVER_ENDPOINT_FILE,
@@ -50,7 +50,7 @@ import {
   getSyncDestinationAuthBinding,
   getValidToken,
   observerOnlyOverrideWarning
-} from "./chunk-7DR5X7XI.js";
+} from "./chunk-A6HAEVJX.js";
 import "./chunk-MLKGABMK.js";
 
 // src/observer-server.ts
@@ -1239,7 +1239,7 @@ var hookRejectionStatus = () => ({
   ...lastRejectedReason !== void 0 ? { lastRejectedReason } : {},
   ...lastRejectedTarget !== void 0 ? { lastRejectedTarget } : {}
 });
-var packageVersion = true ? "0.8.0-rc.1+60c9b7e1" : "dev";
+var packageVersion = true ? "0.8.0-rc.2+bed6eaed" : "dev";
 var health = () => ({
   status: "ok",
   service: OBSERVER_SERVICE_NAME,

package/dist/sync-cycle.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   runObserverSyncCycle
-} from "./chunk-CK5MEL5J.js";
-import "./chunk-JXSSPQ5B.js";
-import "./chunk-7DR5X7XI.js";
+} from "./chunk-3KISRT57.js";
+import "./chunk-YSU5CS2V.js";
+import "./chunk-A6HAEVJX.js";
 import "./chunk-MLKGABMK.js";
 
 // src/sync-cycle.ts

package/dist/{token-store-R7WXEPLI.js → token-store-BT5THIAJ.js}

@@ -10,7 +10,7 @@ import {
   setSelectedOrg,
   storeServiceRefreshToken,
   writeTokens
-} from "./chunk-7DR5X7XI.js";
+} from "./chunk-A6HAEVJX.js";
 import "./chunk-MLKGABMK.js";
 export {
   SERVICE_TOKEN_LOGIN_USER_ID,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fml-inc/fml",
-  "version": "0.8.0-rc.1",
+  "version": "0.8.0-rc.2",
   "description": "FML CLI and agent tools",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -41,8 +41,8 @@
     "@types/node": "^22.0.0",
     "tsup": "^8.0.0",
     "typescript": "^5",
-    "@fml/panopticon": "0.0.0",
-    "@fml/agent-targets": "0.0.0"
+    "@fml/agent-targets": "0.0.0",
+    "@fml/panopticon": "0.0.0"
   },
   "scripts": {
     "build": "node scripts/generate-plugin-manifest.js && tsup",