@khalilgharbaoui/opencode-claude-code-plugin 0.34.1 → 0.35.0

package/dist/index.js

@@ -197,6 +197,9 @@ function configureLogger(input) {
 function resolvedLogFile() {
   return join(activeConfig.dir ?? DEFAULT_DIR, "plugin.log");
 }
+function describeLogFile() {
+  return { path: resolvedLogFile(), enabled: activeConfig.file && !fileLoggingDisabled };
+}
 function rotateIfNeeded(logFile) {
   try {
     const stat = statSync(logFile);
@@ -830,6 +833,135 @@ function reportUnrecognizedModel(stderr) {
   warnedUnrecognizedModels.add(model);
   log.warn(message, { model, ...floor ? { cliFloor: floor } : {} });
 }
+var HOOK_SUBTYPES = {
+  hook_started: "started",
+  hook_progress: "progress",
+  hook_response: "response"
+};
+function parseHookEvent(msg) {
+  if (msg.type !== "system") return null;
+  const phase = msg.subtype ? HOOK_SUBTYPES[msg.subtype] : void 0;
+  if (!phase) return null;
+  const raw = msg;
+  const hookName = str(raw.hook_name);
+  const hookEvent = str(raw.hook_event);
+  if (!hookName || !hookEvent) return null;
+  return {
+    phase,
+    hookId: str(raw.hook_id) ?? "unknown",
+    hookName,
+    hookEvent,
+    exitCode: num(raw.exit_code),
+    outcome: str(raw.outcome),
+    stderr: str(raw.stderr)
+  };
+}
+function isHookFailure(hook) {
+  if (hook.phase !== "response") return false;
+  if (hook.outcome === "error") return true;
+  if (hook.outcome === "cancelled" || hook.outcome === "success") return false;
+  return hook.exitCode !== void 0 && hook.exitCode !== 0;
+}
+var HOOK_STDERR_CAP = 200;
+function describeHookFailure(hook) {
+  const how = hook.exitCode !== void 0 ? `exited ${hook.exitCode}` : `reported \`${hook.outcome ?? "error"}\``;
+  const tail = hook.stderr?.trim();
+  const detail = tail ? ` It wrote to stderr: ${tail.length > HOOK_STDERR_CAP ? `${tail.slice(0, HOOK_STDERR_CAP)}...` : tail}` : " It wrote nothing to stderr.";
+  return `Claude Code's "${hook.hookName}" hook (${hook.hookEvent}) ${how}, so whatever it contributes to the session is missing and every turn on this process runs without it. Fix or remove the hook in your Claude Code settings.${detail}`;
+}
+var warnedHookFailures = /* @__PURE__ */ new Set();
+var lastHookFailures = /* @__PURE__ */ new Map();
+function snapshotHookFailures() {
+  return [...lastHookFailures.values()];
+}
+function reportHookEvent(msg) {
+  const hook = parseHookEvent(msg);
+  if (!hook) return;
+  const data = {
+    hook: hook.hookName,
+    event: hook.hookEvent,
+    ...hook.exitCode === void 0 ? {} : { exitCode: hook.exitCode },
+    ...hook.outcome ? { outcome: hook.outcome } : {}
+  };
+  if (!isHookFailure(hook)) {
+    log.debug(`claude code hook ${hook.phase}`, data);
+    return;
+  }
+  const failure = {
+    hookName: hook.hookName,
+    hookEvent: hook.hookEvent,
+    exitCode: hook.exitCode,
+    outcome: hook.outcome,
+    stderr: hook.stderr?.trim().slice(0, HOOK_STDERR_CAP) ?? ""
+  };
+  lastHookFailures.set(`${hook.hookEvent}:${hook.hookName}`, failure);
+  const key = `${hook.hookEvent}:${hook.hookName}:${hook.outcome ?? "?"}:${hook.exitCode ?? "?"}`;
+  const message = describeHookFailure(hook);
+  if (warnedHookFailures.has(key)) {
+    log.debug(message, data);
+    return;
+  }
+  warnedHookFailures.add(key);
+  log.warn(message, data);
+}
+function parseToolProgress(msg) {
+  if (msg.type !== "tool_progress") return null;
+  const raw = msg;
+  const frameToolUseId = str(raw.tool_use_id);
+  const toolName = str(raw.tool_name);
+  const elapsedSeconds = num(raw.elapsed_time_seconds);
+  if (!frameToolUseId || !toolName || elapsedSeconds === void 0) return null;
+  const retry = isRecord(raw.subagent_retry) ? raw.subagent_retry : void 0;
+  return {
+    toolUseId: str(raw.parent_tool_use_id) ?? frameToolUseId,
+    frameToolUseId,
+    toolName,
+    elapsedSeconds,
+    heartbeat: raw.heartbeat === true,
+    taskId: str(raw.task_id),
+    subagentType: str(raw.subagent_type),
+    subagentRetry: retry ? {
+      agentId: str(retry.agent_id) ?? "unknown",
+      attempt: num(retry.attempt) ?? 0,
+      maxRetries: num(retry.max_retries) ?? 0,
+      errorStatus: num(retry.error_status),
+      errorCategory: str(retry.error_category) ?? "unknown"
+    } : void 0
+  };
+}
+function describeToolProgress(progress) {
+  if (progress.subagentRetry) {
+    const retry = progress.subagentRetry;
+    return `Claude Code is retrying a subagent's API call (${retry.errorCategory}${retry.errorStatus === void 0 ? "" : ` ${retry.errorStatus}`}), attempt ${retry.attempt} of ${retry.maxRetries}. The turn is still running.`;
+  }
+  return `claude code tool still running: ${progress.toolName} at ${progress.elapsedSeconds}s`;
+}
+var reportedSubagentRetries = /* @__PURE__ */ new Set();
+function reportToolProgress(msg) {
+  const progress = parseToolProgress(msg);
+  if (!progress) return;
+  const data = {
+    tool: progress.toolName,
+    toolUseId: progress.toolUseId,
+    elapsedSeconds: progress.elapsedSeconds,
+    ...progress.taskId ? { taskId: progress.taskId } : {},
+    ...progress.subagentType ? { subagentType: progress.subagentType } : {}
+  };
+  const message = describeToolProgress(progress);
+  if (!progress.subagentRetry) {
+    log.info(message, data);
+    return;
+  }
+  const retry = progress.subagentRetry;
+  const key = `${retry.agentId}:${retry.errorCategory}`;
+  const retryData = { ...data, ...retry };
+  if (reportedSubagentRetries.has(key)) {
+    log.debug(message, retryData);
+    return;
+  }
+  reportedSubagentRetries.add(key);
+  log.notice(message, retryData);
+}
 
 // src/plan-mode-question.ts
 var QUESTION_TOOL_NAME = "question";
@@ -4996,6 +5128,621 @@ async function handleBtwCommand(client, input, options = {}) {
   }
 }
 
+// src/diagnostic-bundle.ts
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import { openSync, readSync, closeSync, fstatSync, realpathSync } from "fs";
+import { homedir as homedir4 } from "os";
+
+// src/log-messages.ts
+var PLUGIN_LOG_MESSAGES = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN detected; claude may bill as pay-as-you-go API usage instead of your subscription. Set provider option `ignoreAnthropicApiKey: true` to force subscription auth.",
+  "ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN detected; stripping it from claude spawns (ignoreAnthropicApiKey) so requests use your subscription auth, not pay-as-you-go API billing.",
+  "Code Mode execute not forwarded: no model-visible input schema",
+  "Code Mode execute not forwarded: read-only permission preset",
+  "MCP tool not routed through the proxy: another proxy tool already holds that name, and it keeps it",
+  "account failover declined; ending the turn",
+  "agent effort override refused: unknown level",
+  "agent model override refused: unknown model",
+  "agent prompt cache ttl refused: unknown value",
+  "auto-continuation stopped",
+  "auto-continuing incomplete claude result",
+  "btw: a turn is running but no claude process appeared for it",
+  "btw: early aside failed; the message will ask again",
+  "cannot interrupt this transport; waiting for the turn to end",
+  "claude --version output unparseable",
+  "claude already registers a different skill under this name; not bridging ours",
+  "claude cli < 2.1.142 detected; Opus 4.7 thinking summaries unavailable. Run `npm i -g @anthropic-ai/claude-code` to upgrade.",
+  "claude cli does not support --plugin-dir; opencode skills will not be bridged. Run `npm i -g @anthropic-ai/claude-code` to upgrade.",
+  "claude code compacted its own context",
+  "claude code reset its conversation",
+  "claude finished the turn without a reply",
+  "claude kept missing the probe deadline; keeping the conservative answer for this process",
+  "claude process belongs to another account; starting fresh",
+  "claude process closed without a result",
+  "claude process did not exit; starting a fresh session",
+  "claude process error",
+  "claude process stdin error",
+  "claude process still silent after respawn; ending turn",
+  "claude session ID error, clearing session",
+  "claude-code doctor failed to build its report",
+  "claude-code plugin ready",
+  "cleanup-stale: cache package.json update failed",
+  "cleanup-stale: could not record the sweep marker",
+  "cleanup-stale: error processing cache root",
+  "cleanup-stale: rmSync failed",
+  "delivering proxy results after interrupted continuation",
+  "draining proxy calls queued between turns",
+  "empty user content; sending sentinel to satisfy CLI",
+  "every claude process is mid-turn; skipping LRU eviction",
+  "failed to abort opencode session",
+  "failed to build the agent registry for opencode 2",
+  "failed to close the proxy server of an aborted turn",
+  "failed to detect claude cli version",
+  "failed to expand account provider",
+  "failed to fetch opencode MCP runtime status",
+  "failed to fetch opencode session directory",
+  "failed to fetch opencode session messages",
+  "failed to fetch opencode session parent",
+  "failed to fetch opencode tool list",
+  "failed to parse opencode config",
+  "failed to prepare the failover account runtime; staying put",
+  "failed to probe claude cli flag support",
+  "failed to re-send envelope after respawn",
+  "failed to set up doStream",
+  "failed to stage opencode skill plugin dir",
+  "failed to symlink shared capabilities; continuing anyway",
+  "failed to write bridged MCP config",
+  "failed to write control response",
+  "failed to write interrupt control request",
+  "failed to write system prompt file",
+  "fallback model refused: unknown model",
+  "falling back to the next model in the chain",
+  "fast mode is in cooldown after a rate limit; this turn runs at standard speed and is billed at standard Opus rates, not the fast price shown in the model picker.",
+  "file part without data, skipping",
+  "ignoring a failover reset time that is not in the future",
+  "ignoring unknown proxyOpencodeTools entries",
+  "ignoring unknown proxyTools entries",
+  "interactive permissionMode bypassPermissions ignored: Claude Code prompts for confirmation in the TUI",
+  "interactive system prompt disabled; opencode agent prompts will not be appended",
+  "interactive transport dropped non-text content blocks",
+  "interactive turn failed",
+  "interactiveBypass ignored: Claude Code prompts for bypassPermissions confirmation in the interactive TUI",
+  "malformed data URI, skipping file part",
+  "no active process to respawn (start watchdog); ending turn",
+  "no proxyTools entry was recognised; nothing will be proxied this turn",
+  "no stdout after envelope write; respawning claude process to resume conversation",
+  "opencode 2 event subscription ended; deleted sessions keep their claude process until idle eviction",
+  "pending proxy call arrived after stream close; rejecting",
+  'permissionMode "plan" is enforced: claude cannot edit files or run commands, and --dangerously-skip-permissions is deliberately not passed so it stays that way. Headless Claude Code is not offered an ExitPlanMode tool, so nothing releases plan mode mid-session; approving a plan in chat does not unlock writes. Leaving plan mode means changing the config and restarting opencode.',
+  `permissionPreset "read-only": this claude CLI has no --permission-prompts (2.1.263+), so permission requests are denied by the plugin's own can_use_tool handler instead of by the CLI. Same outcome, one layer fewer.`,
+  'permissionPreset "read-only": this claude CLI has no --restricted (2.1.258+), so file reads are not confined to the working directory. The mutating tools are still refused via --disallowedTools and every permission request is denied.',
+  "previous turn did not stop in time; this turn may see stale output",
+  "previous turn still in flight; interrupting it",
+  "process error",
+  "provider model entry is partial; completing it from the pass-through template",
+  "proxy call past its deadline, but opencode is still serving it; waiting",
+  "proxy call still waiting, deadline approaching",
+  "proxy call still waiting, no deadline",
+  "proxy-mcp client closed a tool call before its result",
+  "proxy-mcp dropping result for a closed tool call",
+  "proxy-mcp interceptor failed",
+  "proxy-mcp rejected a request",
+  "proxy-mcp tool call timed out",
+  "proxyOpencodeTools entry dropped: a proxy tool already holds that name, and it keeps it",
+  "proxyOpencodeTools is set but opencode's tool registry did not answer; forwarding nothing this spawn",
+  "refusing the pid-named scratch directory",
+  "rejected pending proxy call",
+  "remote URL images are not supported by Claude CLI, skipping",
+  "replaying stdout the child emitted between turns",
+  "result fallback timer fired \u2014 closing stream without result event",
+  "shared Claude capability already exists; leaving untouched",
+  "skipping MCP server with unknown type",
+  "skipping local MCP server with no command",
+  "skipping remote MCP server with no url",
+  "stale scratch directory sweep failed",
+  "task_batch resolving with child results missing",
+  "timed out pending proxy call",
+  "turn abort listener threw",
+  "two different skills share a name; bridging the one the nearest root claimed",
+  "unknown permissionPreset; no preset applied and every permission setting is left exactly as configured",
+  "unsupported file part data type",
+  "unsupported media type for Claude image block, skipping"
+]);
+
+// src/diagnostic-bundle.ts
+var BUNDLE_ARGUMENTS = /* @__PURE__ */ new Set(["bundle", "issue", "report", "paste"]);
+function wantsDiagnosticBundle(argument) {
+  return BUNDLE_ARGUMENTS.has(argument.trim().toLowerCase());
+}
+var BUNDLE_LEVELS = /* @__PURE__ */ new Set(["NOTICE", "WARN", "ERROR"]);
+var BUNDLE_MAX_LINES = 120;
+var BUNDLE_MAX_BYTES = 24e3;
+var BUNDLE_TAIL_BYTES = 512 * 1024;
+var BUNDLE_MAX_VALUE_CHARS = 200;
+var BUNDLE_MAX_ENUM_CHARS = 40;
+var BUNDLE_MAX_VERSION_CHARS = 60;
+var BUNDLE_MAX_NAME_CHARS = 64;
+var BUNDLE_MAX_ARRAY_ITEMS = 20;
+var BUNDLE_DATA_ALLOWLIST = {
+  // booleans: every one of these is a decision the plugin made
+  applied: "flag",
+  attached: "flag",
+  bridgeSkipNativeSkills: "flag",
+  channelClosed: "flag",
+  compaction: "flag",
+  compactionMode: "flag",
+  emitted: "flag",
+  enabled: "flag",
+  executed: "flag",
+  isUsingOverage: "flag",
+  hadProxyActivity: "flag",
+  hadReasoning: "flag",
+  hadStreamThinking: "flag",
+  hadToolActivity: "flag",
+  hasActiveProcess: "flag",
+  hasInput: "flag",
+  hasText: "flag",
+  inFlight: "flag",
+  anthropicApiKeyInEnv: "flag",
+  includeHistoryContext: "flag",
+  interactive: "flag",
+  interactiveTransport: "flag",
+  isError: "flag",
+  planModeQuestion: "flag",
+  kept: "flag",
+  listsAgentTypes: "flag",
+  opencodeHasQuestion: "flag",
+  registryResolved: "flag",
+  sse: "flag",
+  strictMcpConfig: "flag",
+  supported: "flag",
+  turnStats: "flag",
+  // counts and sizes: a length is a shape, never content
+  attempts: "count",
+  cacheReadTokens: "count",
+  cacheWriteTokens: "count",
+  code: "count",
+  count: "count",
+  dropped: "count",
+  exitCode: "count",
+  historyLength: "count",
+  inputTokens: "count",
+  lastTextLength: "count",
+  lines: "count",
+  liveDescriptionLength: "count",
+  numTurns: "count",
+  outputTokens: "count",
+  permissionDenials: "count",
+  pid: "count",
+  port: "count",
+  postTokens: "count",
+  preTokens: "count",
+  removed: "count",
+  skills: "count",
+  stderrBytes: "count",
+  textLength: "count",
+  tools: "count",
+  total: "count",
+  ageMs: "duration",
+  delayMs: "duration",
+  deadlineMs: "duration",
+  durationApiMs: "duration",
+  durationMs: "duration",
+  elapsedMs: "duration",
+  remainingMs: "duration",
+  timeoutMs: "duration",
+  waitedMs: "duration",
+  costUsd: "money",
+  // enums: a fixed vocabulary this package or the CLI defines
+  apiKeySource: "enum",
+  delivery: "enum",
+  effort: "enum",
+  finishReason: "enum",
+  hash: "enum",
+  hostApi: "enum",
+  kind: "enum",
+  level: "enum",
+  mode: "enum",
+  overageDisabledReason: "enum",
+  overageStatus: "enum",
+  permissionMode: "enum",
+  preset: "enum",
+  rateLimitType: "enum",
+  reason: "enum",
+  reasoningEffort: "enum",
+  scope: "enum",
+  signal: "enum",
+  source: "enum",
+  state: "enum",
+  status: "enum",
+  stopReason: "enum",
+  subtype: "enum",
+  transport: "enum",
+  trigger: "enum",
+  type: "enum",
+  verdict: "enum",
+  // names: identifiers the operator configured or Claude Code published. The
+  // doctor table already prints the same class of value (providers, accounts,
+  // proxyTools, MCP servers), so a bundle is no more revealing than the report
+  // it is attached to.
+  accounts: "name",
+  agent: "name",
+  bundled: "name",
+  excluded: "name",
+  excludeServers: "name",
+  from: "name",
+  joined: "name",
+  left: "name",
+  mappedName: "name",
+  model: "name",
+  name: "name",
+  names: "name",
+  opencodeAgent: "name",
+  provider: "name",
+  providerOptionsKeys: "name",
+  providers: "name",
+  proxyTools: "name",
+  server: "name",
+  servers: "name",
+  skipped: "name",
+  toolName: "name",
+  toolNames: "name",
+  cliFloor: "version",
+  cliVersion: "version",
+  opencode: "version",
+  plugin: "version",
+  version: "version",
+  // ids: hashed, never printed. Correlation survives, identity does not.
+  callId: "id",
+  claudeSessionId: "id",
+  id: "id",
+  messageId: "id",
+  newConversationId: "id",
+  previousSessionId: "id",
+  sessionId: "id",
+  sessionID: "id",
+  sessionKey: "id",
+  toolCallId: "id",
+  toolCallIds: "id",
+  toolUseId: "id",
+  // paths: home becomes `~`. The doctor table prints cwd and the CLI path
+  // already, so withholding them here would buy nothing and cost the one
+  // field that explains most "it picked the wrong directory" reports.
+  claudeLoads: "path",
+  cliPath: "path",
+  configDir: "path",
+  cwd: "path",
+  dir: "path",
+  notBridged: "path",
+  path: "path",
+  pluginDir: "path",
+  resolved: "path",
+  target: "path",
+  url: "url",
+  cliArgs: "argv",
+  // The hook and tool_progress reporters (#g185), added when the two lanes
+  // merged: their message text is built at runtime and redacted, so these
+  // fields are what keeps a failed-hook WARN readable in a bundle. `stderr`
+  // is deliberately absent, because a hook can print anything to it.
+  hook: "name",
+  hookName: "name",
+  event: "enum",
+  hookEvent: "enum",
+  outcome: "enum",
+  tool: "name",
+  subagentType: "name",
+  errorCategory: "enum",
+  errorStatus: "count",
+  elapsedSeconds: "count",
+  attempt: "count",
+  maxRetries: "count",
+  taskId: "id",
+  agentId: "id"
+};
+function shape(value) {
+  if (typeof value === "string") return `[redacted, ${value.length} chars]`;
+  let size;
+  try {
+    size = JSON.stringify(value)?.length ?? 0;
+  } catch {
+    size = 0;
+  }
+  return `[redacted, ${size} chars]`;
+}
+function createIdHasher(salt = randomBytes2(16).toString("hex")) {
+  return (raw) => createHash3("sha256").update(salt).update("\0").update(raw).digest("hex").slice(0, 8);
+}
+function createRedactionContext(options = {}) {
+  const home = options.home ?? homedir4();
+  const homes = /* @__PURE__ */ new Set();
+  if (home) homes.add(home);
+  if (home) {
+    try {
+      homes.add(realpathSync.native(home));
+    } catch {
+    }
+  }
+  return {
+    homes: [...homes].filter(Boolean).sort((a, b) => b.length - a.length),
+    hash: createIdHasher(options.salt)
+  };
+}
+function redactHome(text, context) {
+  let out = text;
+  for (const home of context.homes) out = out.split(home).join("~");
+  return out;
+}
+var OPENCODE_SESSION_ID = /\bses_[A-Za-z0-9]{6,}/g;
+var UUID = /\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/g;
+function redactSessionIds(text, context) {
+  return text.replace(OPENCODE_SESSION_ID, (raw) => `ses_${context.hash(raw)}`).replace(UUID, (raw) => `uuid_${context.hash(raw)}`);
+}
+function redactForPaste(text, context) {
+  return redactSessionIds(redactHome(text, context), context);
+}
+var SAFE_NAME = /^[A-Za-z0-9][\w.:@+/-]*$/;
+var SAFE_ENUM = /^[A-Za-z0-9][\w.:@+/-]*$/;
+var SAFE_VERSION = /^[v0-9][\w.()+ -]*$/;
+var VERSION_PLACEHOLDERS = /* @__PURE__ */ new Set(["unknown", "none", "not detected", "unset"]);
+var SAFE_PATH = /^(?:[/~.]|[A-Za-z]:[\\/])/;
+var CLI_FLAG = /^-{1,2}[A-Za-z][\w-]*$/;
+var SUSPICIOUS = [
+  /sk-[A-Za-z0-9]/,
+  // Anthropic and OpenAI style API keys
+  /\b(?:gh[pousr]_|xox[baprs]-|github_pat_)/,
+  // GitHub and Slack tokens
+  /[0-9a-f]{32,}/i,
+  // hex secrets; the proxy authToken is 64 of these
+  /[A-Za-z0-9+/]{40,}={0,2}/,
+  // base64 blobs
+  /BEGIN [A-Z ]*PRIVATE KEY/,
+  /^bearer\b/i,
+  /=/
+  // any assignment: ANTHROPIC_API_KEY=…, token=…
+];
+function looksSecret(value) {
+  return SUSPICIOUS.some((pattern) => pattern.test(value));
+}
+function sanitizeScalar(kind, value, context) {
+  if (value === null) return null;
+  switch (kind) {
+    case "flag":
+      return typeof value === "boolean" ? value : shape(value);
+    case "count":
+    case "duration":
+      return typeof value === "number" && Number.isFinite(value) ? value : shape(value);
+    case "money":
+      return typeof value === "number" && Number.isFinite(value) ? Math.round(value * 1e4) / 1e4 : shape(value);
+    case "enum": {
+      if (typeof value === "boolean" || typeof value === "number") return value;
+      if (typeof value !== "string") return shape(value);
+      return value.length <= BUNDLE_MAX_ENUM_CHARS && SAFE_ENUM.test(value) && !looksSecret(value) ? value : shape(value);
+    }
+    case "name": {
+      if (typeof value !== "string") return shape(value);
+      return value.length <= BUNDLE_MAX_NAME_CHARS && SAFE_NAME.test(value) && !looksSecret(value) ? value : shape(value);
+    }
+    case "version": {
+      if (typeof value !== "string") return shape(value);
+      if (VERSION_PLACEHOLDERS.has(value)) return value;
+      return value.length <= BUNDLE_MAX_VERSION_CHARS && SAFE_VERSION.test(value) && !looksSecret(value) ? value : shape(value);
+    }
+    case "id":
+      return typeof value === "string" ? context.hash(value) : shape(value);
+    case "path": {
+      if (typeof value !== "string") return shape(value);
+      if (!SAFE_PATH.test(value)) return sanitizeScalar("name", value, context);
+      if (looksSecret(value)) return shape(value);
+      const rewritten = redactHome(value, context);
+      return rewritten.length <= BUNDLE_MAX_VALUE_CHARS && !/\s{2,}|[\n\r]/.test(rewritten) ? rewritten : shape(value);
+    }
+    case "url":
+      return typeof value === "string" ? sanitizeUrl(value) : shape(value);
+    case "argv":
+      return shape(value);
+  }
+}
+function sanitizeUrl(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return shape(raw);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return shape(raw);
+  if (looksSecret(parsed.pathname)) return shape(raw);
+  const credentials = parsed.username || parsed.password ? "[redacted]@" : "";
+  const query = parsed.search ? `?[redacted, ${parsed.search.length - 1} chars]` : "";
+  return `${parsed.protocol}//${credentials}${parsed.host}${parsed.pathname}${query}`;
+}
+function sanitizeArgv(value) {
+  if (!Array.isArray(value)) return shape(value);
+  const out = [];
+  for (const item of value.slice(0, BUNDLE_MAX_ARRAY_ITEMS * 2)) {
+    if (typeof item !== "string") {
+      out.push(shape(item));
+      continue;
+    }
+    if (!item.startsWith("-")) {
+      out.push(`[redacted, ${item.length} chars]`);
+      continue;
+    }
+    const equals = item.indexOf("=");
+    if (equals === -1) {
+      out.push(CLI_FLAG.test(item) ? item : shape(item));
+      continue;
+    }
+    const flag = item.slice(0, equals);
+    out.push(
+      `${CLI_FLAG.test(flag) ? flag : "[redacted]"}=[redacted, ${item.length - equals - 1} chars]`
+    );
+  }
+  if (value.length > out.length) out.push(`[+${value.length - out.length} more]`);
+  return out;
+}
+var BUNDLE_MAX_DEPTH = 4;
+function kindFor(key) {
+  return Object.prototype.hasOwnProperty.call(BUNDLE_DATA_ALLOWLIST, key) ? BUNDLE_DATA_ALLOWLIST[key] : void 0;
+}
+function sanitizeValue(key, value, context, depth = 0) {
+  if (kindFor(key) === "argv") return sanitizeArgv(value);
+  if (depth > BUNDLE_MAX_DEPTH) return shape(value);
+  if (Array.isArray(value)) {
+    const out = value.slice(0, BUNDLE_MAX_ARRAY_ITEMS).map((item) => sanitizeValue(key, item, context, depth + 1));
+    if (value.length > out.length) out.push(`[+${value.length - out.length} more]`);
+    return out;
+  }
+  if (value !== null && typeof value === "object") {
+    return sanitizeLogData(value, context, depth + 1);
+  }
+  const kind = kindFor(key);
+  return kind === void 0 ? shape(value) : sanitizeScalar(kind, value, context);
+}
+function sanitizeLogData(data, context, depth = 0) {
+  const out = {};
+  for (const [key, value] of Object.entries(data)) {
+    const known = kindFor(key) !== void 0;
+    const safeKey = known || key.length <= BUNDLE_MAX_NAME_CHARS && SAFE_NAME.test(key) && !looksSecret(key) ? key : `[redacted key, ${key.length} chars]`;
+    out[safeKey] = sanitizeValue(key, value, context, depth);
+  }
+  return out;
+}
+var LOG_LINE = /^\[([^\]]+)\] \[opencode-claude-code\] (DEBUG|INFO|NOTICE|WARN|ERROR): ([\s\S]*)$/;
+function parseLogLine(raw) {
+  const match = LOG_LINE.exec(raw);
+  if (!match) return null;
+  const rest = match[3];
+  for (let index = rest.indexOf("{"); index !== -1; index = rest.indexOf("{", index + 1)) {
+    let parsed;
+    try {
+      parsed = JSON.parse(rest.slice(index));
+    } catch {
+      continue;
+    }
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return {
+        timestamp: match[1],
+        level: match[2],
+        message: rest.slice(0, index).trimEnd(),
+        data: parsed
+      };
+    }
+  }
+  return { timestamp: match[1], level: match[2], message: rest, data: null };
+}
+function redactLogLine(raw, context) {
+  const parsed = parseLogLine(raw);
+  if (!parsed || !BUNDLE_LEVELS.has(parsed.level)) return null;
+  const message = PLUGIN_LOG_MESSAGES.has(parsed.message) ? parsed.message : `[redacted message, ${parsed.message.length} chars]`;
+  const head = `[${parsed.timestamp}] ${parsed.level}: ${message}`;
+  if (!parsed.data || Object.keys(parsed.data).length === 0) return head;
+  return `${head} ${JSON.stringify(sanitizeLogData(parsed.data, context))}`;
+}
+function readLogTail(path10, maxBytes = BUNDLE_TAIL_BYTES) {
+  const fd = openSync(path10, "r");
+  try {
+    const size = fstatSync(fd).size;
+    const length = Math.min(size, maxBytes);
+    const buffer = Buffer.allocUnsafe(length);
+    readSync(fd, buffer, 0, length, size - length);
+    const text = buffer.toString("utf8");
+    if (length < size) {
+      const newline = text.indexOf("\n");
+      return newline === -1 ? "" : text.slice(newline + 1);
+    }
+    return text;
+  } finally {
+    closeSync(fd);
+  }
+}
+var BUNDLE_HEADER = "**Redacted log bundle**";
+var BUNDLE_PREAMBLE = [
+  "Safe to paste into a GitHub issue. Built by an allowlist, not a filter: a line",
+  "keeps its timestamp, its level, its message **only** when that message is a",
+  "constant in this package's own source, and only those data fields whose values",
+  "are non-secret by type (versions, counts, flags, enums, durations, exit codes,",
+  "model and tool and server names). Everything else, including every unknown",
+  "field, is replaced by `[redacted, N chars]`. Session ids are a per-bundle hash,",
+  "so lines correlate here and nowhere else, and your home directory is `~`.",
+  "",
+  "Never included: prompt or reply text, system prompts, tool inputs or outputs,",
+  "file contents, environment values, bearer tokens, API keys, `Authorization`",
+  "headers, MCP server env or headers, URL credentials or query strings, or the",
+  "raw spawn argv."
+].join("\n");
+var BUNDLE_LOGGING_OFF = [
+  "File logging is **off**, so there is nothing to bundle. The report above still",
+  "answers versions, config shape and live processes.",
+  "",
+  "Turn it on for one run and reproduce the problem:",
+  "",
+  "```sh",
+  "OPENCODE_CLAUDE_CODE_LOG_FILE=1 opencode",
+  "```",
+  "",
+  "or set it permanently in `opencode.json` under",
+  "`provider.claude-code.options.logging`:",
+  "",
+  "```json",
+  '{ "logging": { "file": true } }',
+  "```",
+  "",
+  "Then run `/claude-code-doctor bundle` again. Logging is read once at process",
+  "start, so a running window has to be relaunched."
+].join("\n");
+function buildLogBundleSection(input) {
+  const lines = [BUNDLE_HEADER, "", BUNDLE_PREAMBLE, ""];
+  if (!input.fileLogging) {
+    lines.push(BUNDLE_LOGGING_OFF);
+    return lines.join("\n");
+  }
+  let tail;
+  try {
+    tail = (input.readTailImpl ?? readLogTail)(input.logPath, BUNDLE_TAIL_BYTES);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    lines.push(
+      `File logging is on, but the log could not be read: ${redactHome(reason, input.context)}`
+    );
+    return lines.join("\n");
+  }
+  const raw = tail.split("\n");
+  let scanned = 0;
+  const kept = [];
+  for (let index = raw.length - 1; index >= 0; index--) {
+    const line = raw[index];
+    if (!line) continue;
+    if (parseLogLine(line)) scanned++;
+    const redacted = redactLogLine(line, input.context);
+    if (redacted === null) continue;
+    if (kept.length >= BUNDLE_MAX_LINES) break;
+    if (kept.reduce((total, entry) => total + entry.length + 1, 0) + redacted.length > BUNDLE_MAX_BYTES) {
+      break;
+    }
+    kept.push(redacted);
+  }
+  kept.reverse();
+  const dropped = Math.max(0, scanned - kept.length);
+  lines.push(
+    `Log: \`${redactHome(input.logPath, input.context)}\`. ${kept.length} NOTICE/WARN/ERROR line${kept.length === 1 ? "" : "s"} kept of ${scanned} scanned (caps: ${BUNDLE_MAX_LINES} lines, ${BUNDLE_MAX_BYTES} bytes, last ${BUNDLE_TAIL_BYTES} bytes of the file).`
+  );
+  if (dropped > 0) {
+    lines.push("");
+    lines.push(
+      `${dropped} earlier or lower-level line${dropped === 1 ? " was" : "s were"} not included.`
+    );
+  }
+  lines.push("");
+  lines.push("```text");
+  if (kept.length === 0) {
+    lines.push("No NOTICE, WARN or ERROR line in the retained log.");
+  } else {
+    lines.push(...kept);
+  }
+  lines.push("```");
+  return lines.join("\n");
+}
+
 // src/plan-usage.ts
 import { execFile as execFile2 } from "child_process";
 var PLAN_USAGE_ARGUMENTS = /* @__PURE__ */ new Set(["usage", "cost", "stats", "limits"]);
@@ -5219,7 +5966,7 @@ function logStartupDiagnostics(providers, opencodeVersion) {
 
 // src/doctor.ts
 var DOCTOR_COMMAND = "claude-code-doctor";
-var DOCTOR_COMMAND_DESCRIPTION = "Report what the Claude Code plugin sees: versions, cwd, live processes, pending proxy calls. Add `usage` for plan windows";
+var DOCTOR_COMMAND_DESCRIPTION = "Report what the Claude Code plugin sees: versions, cwd, live processes, pending proxy calls. Add `usage` for plan windows, or `bundle` for a redacted log you can paste into an issue";
 var DOCTOR_MARKER = "\u258C **claude-code doctor**";
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -5278,6 +6025,9 @@ function describePermissionPresets(rows) {
     return `${row.provider}: ${row.preset}${suffix}`;
   }).join(", ");
 }
+function tableCell(text) {
+  return text.replace(/\r?\n/g, " ").replace(/\|/g, "\\|");
+}
 function formatDoctorReport(report) {
   const lines = [];
   lines.push(DOCTOR_MARKER);
@@ -5356,7 +6106,7 @@ function formatDoctorReport(report) {
     lines.push("| server | category | Claude Code said |");
     lines.push("|---|---|---|");
     for (const error of report.mcpServerErrors) {
-      lines.push(`| ${error.name} | \`${error.type}\` | ${error.message || "no detail"} |`);
+      lines.push(`| ${error.name} | \`${error.type}\` | ${tableCell(error.message) || "no detail"} |`);
     }
     lines.push("");
     lines.push("A skipped server is missing from the model's tools with no other sign of it.");
@@ -5369,9 +6119,25 @@ function formatDoctorReport(report) {
     lines.push("|---|---|---|---|");
     for (const failure of report.pluginLoadFailures) {
       lines.push(
-        `| ${failure.plugin} | ${failure.kind} | \`${failure.type}\` | ${failure.message || "no detail"} |`
+        `| ${failure.plugin} | ${failure.kind} | \`${failure.type}\` | ${tableCell(failure.message) || "no detail"} |`
+      );
+    }
+  }
+  if (report.hookFailures.length > 0) {
+    lines.push("");
+    lines.push("**Hooks Claude Code ran that failed**");
+    lines.push("");
+    lines.push("| hook | event | exit | outcome | its stderr |");
+    lines.push("|---|---|---|---|---|");
+    for (const failure of report.hookFailures) {
+      lines.push(
+        `| ${failure.hookName} | ${failure.hookEvent} | ${failure.exitCode ?? "n/a"} | ${failure.outcome ?? "unknown"} | ${tableCell(failure.stderr) || "nothing"} |`
       );
     }
+    lines.push("");
+    lines.push(
+      "These are your own Claude Code hooks, not opencode's. A failed hook's contribution to the session is missing and the turn succeeds anyway. Only the hook's stderr is shown: its stdout is spliced into the model's context and has no business in a bug report."
+    );
   }
   lines.push("");
   lines.push("**Background subagents**");
@@ -5529,6 +6295,7 @@ async function gatherDoctorReport(options) {
     proxyServers,
     mcpServerErrors: snapshotMcpServerErrors(),
     pluginLoadFailures: snapshotPluginLoadFailures(),
+    hookFailures: snapshotHookFailures(),
     planUsage,
     backgroundSubagents: {
       gate: snapshotBackgroundSubagentGate(),
@@ -5536,6 +6303,42 @@ async function gatherDoctorReport(options) {
     }
   };
 }
+function decorateDoctorReport(report, options) {
+  if (!wantsDiagnosticBundle(options.argument ?? "")) return report;
+  const context = options.redactionContextImpl ?? createRedactionContext();
+  const logFile = (options.logFileImpl ?? describeLogFile)();
+  const section = buildLogBundleSection({
+    logPath: logFile.path,
+    fileLogging: logFile.enabled,
+    context,
+    readTailImpl: options.readLogTailImpl
+  });
+  return redactForPaste(`${report}
+
+${section}`, context);
+}
+function withholdFreeText(report) {
+  const withhold = (text) => text ? `[redacted, ${text.length} chars]` : text;
+  return {
+    ...report,
+    mcpServerErrors: report.mcpServerErrors.map((error) => ({
+      ...error,
+      message: withhold(error.message)
+    })),
+    pluginLoadFailures: report.pluginLoadFailures.map((failure) => ({
+      ...failure,
+      message: withhold(failure.message)
+    })),
+    hookFailures: report.hookFailures.map((failure) => ({
+      ...failure,
+      stderr: withhold(failure.stderr)
+    }))
+  };
+}
+function renderDoctorReport(report, options) {
+  const bundle = wantsDiagnosticBundle(options.argument ?? "");
+  return decorateDoctorReport(formatDoctorReport(bundle ? withholdFreeText(report) : report), options);
+}
 async function buildDoctorReport(options) {
   try {
     const report = await gatherDoctorReport(options);
@@ -5548,10 +6351,11 @@ async function buildDoctorReport(options) {
       proxyServers: report.proxyServers.map((server2) => server2.auth.status),
       mcpServerErrors: report.mcpServerErrors.length,
       pluginLoadFailures: report.pluginLoadFailures.length,
+      hookFailures: report.hookFailures.length,
       planUsage: report.planUsage.status,
       backgroundSubagents: report.backgroundSubagents.gate?.supported ?? "not read"
     });
-    return formatDoctorReport(report);
+    return renderDoctorReport(report, options);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     log.warn("claude-code doctor failed to build its report", { error: message });
@@ -7673,7 +8477,7 @@ function spawnInteractiveProcess(opts) {
 
 // src/prompts.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { randomUUID as randomUUID5 } from "crypto";
 import { dirname as dirname5, join as join8 } from "path";
 function readPromptFileIfPresent(path10) {
@@ -7796,7 +8600,7 @@ ${options.compressionSummary.trim()}`
   for (const s of extraSystemContent) {
     if (s.trim()) parts.push(s.trim());
   }
-  const configRoot = process.env.XDG_CONFIG_HOME ?? join8(homedir6(), ".config");
+  const configRoot = process.env.XDG_CONFIG_HOME ?? join8(homedir7(), ".config");
   const globalAgents = readPromptFileIfPresent(join8(configRoot, "opencode", "AGENTS.md"));
   const workspaceAgents = nearestWorkspaceAgentsPrompt(cwd);
   const forwarded = extraSystemContent.join("\n\n");
@@ -9343,6 +10147,13 @@ function createLineHandler(state, ctx) {
           state.endTextBlock();
         }
       }
+      if (msg.type === "system") {
+        reportHookEvent(msg);
+      }
+      if (msg.type === "tool_progress") {
+        reportToolProgress(msg);
+        return;
+      }
       if (msg.type === "conversation_reset") {
         const note = reportConversationReset(msg);
         if (note) {
@@ -11663,11 +12474,11 @@ import {
   existsSync as existsSync3,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync6,
-  realpathSync as realpathSync3,
+  realpathSync as realpathSync4,
   rmSync as rmSync3,
   writeFileSync as writeFileSync5
 } from "fs";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 import { dirname as dirname6, join as join9, resolve as resolve5 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var STALE_PACKAGE_NAME = "opencode-claude-code-plugin";
@@ -11677,12 +12488,12 @@ function candidateCacheRoots() {
   const xdg = process.env.XDG_CACHE_HOME;
   return [
     xdg ? join9(xdg, "opencode") : null,
-    join9(homedir7(), ".cache", "opencode"),
-    join9(homedir7(), "Library", "Caches", "opencode")
+    join9(homedir8(), ".cache", "opencode"),
+    join9(homedir8(), "Library", "Caches", "opencode")
   ].filter((p) => Boolean(p));
 }
 function userOpencodeJsonPath() {
-  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join9(homedir7(), ".config");
+  const xdgConfig = process.env.XDG_CONFIG_HOME ?? join9(homedir8(), ".config");
   return join9(xdgConfig, "opencode", "opencode.json");
 }
 function userIntendsToUseUnscoped() {
@@ -11702,7 +12513,7 @@ function userIntendsToUseUnscoped() {
 function ourLoadedDir() {
   try {
     const filePath = fileURLToPath3(import.meta.url);
-    return realpathSync3(resolve5(filePath, "..", ".."));
+    return realpathSync4(resolve5(filePath, "..", ".."));
   } catch {
     return null;
   }
@@ -11717,7 +12528,7 @@ function ourVersion(dir) {
   }
 }
 function markerPath() {
-  const stateRoot = process.env.XDG_STATE_HOME ?? join9(homedir7(), ".local", "state");
+  const stateRoot = process.env.XDG_STATE_HOME ?? join9(homedir8(), ".local", "state");
   return join9(stateRoot, "opencode-claude-code-plugin", "cleanup-stale.json");
 }
 function markerVersion() {
@@ -11771,7 +12582,7 @@ function cleanupOne(cacheRoot, ourDir) {
   if (!existsSync3(stalePath)) return;
   let realStalePath = stalePath;
   try {
-    realStalePath = realpathSync3(stalePath);
+    realStalePath = realpathSync4(stalePath);
   } catch {
   }
   if (ourDir && realStalePath === ourDir) return;