@klars/agentobs 0.1.1 → 0.1.3

package/README.md

@@ -168,6 +168,26 @@ across calls to manufacture a number.
 Model prices live in `~/.agentobs/pricing.json` and are yours to edit. A model
 missing from that file shows cost as `—`, never `$0.00`.
 
+
+### Hook latency
+
+The hook does its own work in **well under 1ms** (measured: ~0.3ms per
+invocation, including the SQLite write). What you actually pay per tool call is
+**Node.js process startup**, since Claude Code spawns the hook as a fresh
+process each time.
+
+On a typical Linux/macOS machine that is ~40-80ms. On Windows with real-time
+antivirus scanning it can reach **1-1.5 seconds** - and that cost is not
+specific to AgentObs: a bare `node -e "0"` measures the same. Check yours with:
+
+```bash
+node -e "0"          # time this; it is the floor for any Node-based hook
+```
+
+If it is slow, adding an exclusion for your Node install directory and
+`~/.agentobs` in your antivirus settings is the fix. There is no code change
+that avoids it - the cost is paid before AgentObs runs at all.
+
 ---
 
 ## Dashboard access

package/dist/adapters/process-wrap.js

@@ -61,14 +61,20 @@ export async function runWrapped(command, opts = {}) {
         // Resolving the .cmd/.bat shim directly keeps npm-installed CLIs working
         // (`agentobs run -- claude`) while spawn still escapes each argument.
         const executable = process.platform === 'win32' ? resolveWindowsExecutable(command[0]) : command[0];
-        const child = spawn(executable, command.slice(1), {
-            cwd,
-            stdio: 'inherit',
-            // A .cmd shim is a batch script, so it does need a shell interpreter -
-            // but only for the shim itself, and cmd.exe applies its own escaping.
-            shell: /\.(cmd|bat)$/i.test(executable),
-            windowsHide: true,
-        });
+        // A .cmd/.bat file is a batch script: Windows cannot exec it directly, it
+        // must run through cmd.exe. Spawning cmd.exe explicitly with /d /s /c and
+        // a quoted command line is the only form that survives BOTH a path
+        // containing spaces (C:\Program Files\nodejs\npm.cmd) and arguments
+        // containing spaces. `shell: true` cannot do this - it concatenates
+        // without quoting (Node DEP0190), so the path breaks at the first space.
+        const isBatch = process.platform === 'win32' && /\.(cmd|bat)$/i.test(executable);
+        const child = isBatch
+            ? spawn(process.env.COMSPEC ?? 'cmd.exe', ['/d', '/s', '/c', `"${quoteWindows(executable, command.slice(1))}"`], { cwd, stdio: 'inherit', windowsHide: true, windowsVerbatimArguments: true })
+            : spawn(executable, command.slice(1), {
+                cwd,
+                stdio: 'inherit',
+                windowsHide: true,
+            });
         const finish = (code) => {
             sink({ type: 'session_end', sessionId, exitCode: code });
             resolve(code);
@@ -99,6 +105,18 @@ export async function runWrapped(command, opts = {}) {
         }
     });
 }
+/**
+ * Builds a cmd.exe command line, quoting each part that needs it.
+ *
+ * Used with windowsVerbatimArguments so Node passes this string through
+ * untouched; cmd.exe then does its own parsing. Each element is quoted only
+ * when it contains a space or a quote, because unnecessary quoting can change
+ * how some batch scripts interpret their arguments.
+ */
+function quoteWindows(executable, args) {
+    const quote = (s) => /[\s"]/.test(s) ? `"${s.replace(/"/g, '\\"')}"` : s;
+    return [quote(executable), ...args.map(quote)].join(' ');
+}
 /**
  * Finds the real file behind a bare command name on Windows.
  *
@@ -117,14 +135,23 @@ function resolveWindowsExecutable(command) {
     const exts = (process.env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean);
     const dirs = (process.env.PATH ?? '').split(';').filter(Boolean);
     for (const dir of dirs) {
-        for (const ext of ['', ...exts]) {
-            const candidate = join(dir, command + ext.toLowerCase());
-            if (existsSync(candidate))
-                return candidate;
+        // Try the PATHEXT extensions BEFORE the bare name. Node ships both `npm`
+        // (an extensionless shell script, for Git Bash) and `npm.cmd` in the same
+        // directory; the bare file exists but Windows cannot execute it, so
+        // checking it first resolves to something that fails with ENOENT.
+        for (const ext of exts) {
+            const lower = join(dir, command + ext.toLowerCase());
+            if (existsSync(lower))
+                return lower;
             const upper = join(dir, command + ext);
             if (existsSync(upper))
                 return upper;
         }
+        // Only fall back to the bare name if no extension matched - covers a real
+        // extensionless executable, which is rare on Windows but not impossible.
+        const bare = join(dir, command);
+        if (existsSync(bare))
+            return bare;
     }
     return command;
 }

package/dist/commands/hook-config.js

@@ -22,7 +22,31 @@ import { existsSync } from 'node:fs';
  */
 export function hookCommandPath() {
     const here = dirname(fileURLToPath(import.meta.url));
-    // dist/commands -> package root
+    // On Windows, prefer npm's generated .cmd shim in the global bin directory.
+    //
+    // The raw bin/agentobs-hook file has no extension, and Windows cannot
+    // execute an extensionless file - cmd.exe reports "not recognized as an
+    // internal or external command". Claude Code swallows that, so the hook
+    // silently never runs and no data is ever recorded: the worst possible
+    // failure for an observability tool, because it looks like "no activity"
+    // rather than "broken". npm generates the .cmd shim for exactly this.
+    if (process.platform === 'win32') {
+        // dist/commands -> .../node_modules/@klars/agentobs -> up to the dir
+        // holding npm's shims (node_modules/.bin, or the global npm root).
+        const packageRoot = resolve(here, '..', '..');
+        const shims = [
+            resolve(packageRoot, '..', '..', '..', 'agentobs-hook.cmd'), // global npm root
+            resolve(packageRoot, '..', '..', '.bin', 'agentobs-hook.cmd'), // local node_modules/.bin
+        ];
+        for (const shim of shims) {
+            if (existsSync(shim))
+                return shim;
+        }
+        // No shim found (e.g. running from a source checkout): fall back to the
+        // bare name so PATH resolution can still find it, rather than emitting a
+        // path that is guaranteed not to execute.
+        return 'agentobs-hook.cmd';
+    }
     const candidate = resolve(here, '..', '..', 'bin', 'agentobs-hook');
     if (existsSync(candidate))
         return candidate;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@klars/agentobs",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Observability and control layer for AI coding agents - see every tool call, token, and dollar your agents spend, and stop them before they do something risky.",
   "license": "MIT",
   "author": "Klars AI",