@mirnoorata/codexa 0.2.2 → 0.3.0

package/integrations/claude-code/scripts/pre-edit.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# PreToolUse hook. When an Edit/Write/MultiEdit/NotebookEdit targets a file
+# inside a codexa-wired repo AND that repo has no change-plan snapshot yet,
+# save an implicit pre-edit baseline via `codexa hook-pre-edit` so the
+# post-edit drift review always has a pre-edit reference, then print a
+# short advisory to stderr. Never blocks — always exits 0.
+#
+# Rules:
+#   - The CLI call only happens when no snapshot exists (once per task),
+#     capped at 8s inside the 10s hook timeout. Repos that already have a
+#     snapshot exit in milliseconds without spawning the CLI.
+#   - Fail-open: CLI unavailable/slow degrades to the advisory text.
+#   - Non-edit tools exit immediately.
+#   - Missing or malformed payload exits 0.
+
+set -u
+
+CLAUDIO_ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "$(dirname "$0")/.." && pwd -P)}"
+# shellcheck source=lib/codexa-repo.sh
+. "$CLAUDIO_ROOT/scripts/lib/codexa-repo.sh"
+
+payload="$(cat)"
+if [[ -z "$payload" ]]; then
+  exit 0
+fi
+
+tool_name="$(printf '%s' "$payload" | claudio_json_field tool_name)"
+if ! claudio_is_edit_tool "$tool_name"; then
+  exit 0
+fi
+
+file_path="$(printf '%s' "$payload" | claudio_tool_input_field file_path)"
+if [[ -z "$file_path" ]]; then
+  # NotebookEdit uses notebook_path
+  file_path="$(printf '%s' "$payload" | claudio_tool_input_field notebook_path)"
+fi
+if [[ -z "$file_path" ]]; then
+  exit 0
+fi
+
+# Absolute paths only — relative paths can't be located without a cwd that
+# the hook payload may not carry reliably.
+if [[ "$file_path" != /* ]]; then
+  exit 0
+fi
+
+resolved="$(claudio_realpath "$file_path")"
+[[ -z "$resolved" ]] && resolved="$file_path"
+
+target_dir="$(dirname "$resolved")"
+repo="$(claudio_find_codexa_repo "$target_dir")"
+if [[ -z "$repo" ]]; then
+  exit 0
+fi
+
+if claudio_has_snapshot "$repo"; then
+  exit 0
+fi
+
+rel="${resolved#"$repo/"}"
+safe_repo="$(claudio_display_path "$repo")"
+safe_rel="$(claudio_display_path "$rel")"
+
+# Negative cache: when the baseline save persistently skips (degraded
+# worktree, blocked plan), every edit would otherwise pay the up-to-8s CLI
+# spawn in the PreToolUse critical path. A recent skip marker (5 min TTL)
+# short-circuits straight to the advisory.
+_pe_state_dir="${CLAUDE_PLUGIN_DATA:-${XDG_STATE_HOME:-$HOME/.local/state}/codexa-claude-code}"
+_pe_repo_key="$(printf '%s' "$repo" | shasum -a 256 2>/dev/null | awk '{print $1}')"
+_pe_skip_marker="$_pe_state_dir/pre-edit-skip-$_pe_repo_key"
+_pe_marker_fresh=0
+if [[ -n "$_pe_repo_key" && -f "$_pe_skip_marker" ]]; then
+  _pe_now="$(date +%s 2>/dev/null)"
+  _pe_mtime="$(stat -c '%Y' "$_pe_skip_marker" 2>/dev/null || stat -f '%m' "$_pe_skip_marker" 2>/dev/null)"
+  if [[ -n "$_pe_now" && -n "$_pe_mtime" ]] && (( _pe_now - _pe_mtime < 300 )); then
+    _pe_marker_fresh=1
+  fi
+fi
+
+# Arm the drift loop: save an implicit baseline of the pre-edit dirty tree.
+# The CLI's own output is discarded; success is re-verified by checking the
+# snapshot on disk so a misbehaving CLI cannot fake the success message.
+if [[ "$_pe_marker_fresh" -eq 0 ]]; then
+  if claudio_codexa_run 8 hook-pre-edit "$repo" >/dev/null 2>&1; then
+    :
+  fi
+  if claudio_has_snapshot "$repo"; then
+    rm -f "$_pe_skip_marker" 2>/dev/null || true
+    cat >&2 <<EOF
+[codexa] Saved an implicit pre-edit baseline for $safe_repo.
+[codexa] /codexa-review can now diff the final tree against this baseline.
+[codexa] Run /codexa-plan "<task>" $safe_rel to upgrade it with planned
+[codexa] scope and tests before anything non-trivial.
+EOF
+    exit 0
+  fi
+  if [[ -n "$_pe_repo_key" ]]; then
+    mkdir -p "$_pe_state_dir" 2>/dev/null || true
+    touch "$_pe_skip_marker" 2>/dev/null || true
+  fi
+fi
+
+# Advisory-only fallback. Stderr surfaces in the transcript UI; stdout is
+# reserved for JSON the harness parses. Filesystem-controlled paths flow
+# through claudio_display_path so a hostile filename cannot inject extra
+# advisory lines or prose into the transcript.
+cat >&2 <<EOF
+[codexa] No codexa change-plan snapshot found for $safe_repo.
+[codexa] Before editing $safe_rel, run:
+[codexa]   /codexa-plan "<task>" $safe_rel
+[codexa] This saves a baseline under .codex/cache/codexa-tasks/latest.json so
+[codexa] /codexa-review can compute post-edit drift. Skipping the snapshot is
+[codexa] fine for trivial edits; run the planner for anything meaningful.
+EOF
+
+exit 0

package/integrations/claude-code/scripts/session-start.sh

@@ -0,0 +1,201 @@
+#!/usr/bin/env bash
+# SessionStart hook. Behaves in two modes depending on cwd:
+#
+#   (1) Single-repo mode — cwd is inside a codexa-wired repo (walks up to
+#       find `.codex/config.toml`). Emits a structured packet with that
+#       repo's freshness + top read-first files, all allowlist-validated.
+#
+#   (2) Parent-scan mode — cwd has no wired repo above it but contains
+#       wired child repos one level down (for example, cwd=~/code with
+#       ~/code/myproject wired). Emits a structured roll-up listing each
+#       child with its parsed status fields.
+#
+#   (3) Silent — cwd has no wired repo either way. Exit 0, no output.
+#
+# Design rules:
+#   - Must never block. 5s hard timeout per subprocess; total budget is
+#     bounded by the 6s hook timeout in hooks.json.
+#   - Never write to disk. Read-only.
+#   - No free-form repo text in model-visible fields. Structured only.
+
+set -u
+
+CLAUDIO_ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "$(dirname "$0")/.." && pwd -P)}"
+# shellcheck source=lib/codexa-repo.sh
+. "$CLAUDIO_ROOT/scripts/lib/codexa-repo.sh"
+
+payload="$(cat)"
+if [[ -z "$payload" ]]; then
+  exit 0
+fi
+
+cwd="$(printf '%s' "$payload" | claudio_json_field cwd)"
+if [[ -z "$cwd" ]]; then
+  exit 0
+fi
+
+# --- Mode 1: Single repo (existing behavior). ------------------------------
+repo="$(claudio_find_codexa_repo "$cwd")"
+if [[ -n "$repo" ]]; then
+  status_raw=""
+  if claudio_codexa_available; then
+    status_raw="$(claudio_codexa_run 5 status "$repo" 2>/dev/null || true)"
+  fi
+
+  readme_raw=""
+  readme_path="$repo/.codex/codebase/README.md"
+  if [[ -f "$readme_path" ]]; then
+    readme_raw="$(head -c 65536 "$readme_path" 2>/dev/null || true)"
+  fi
+
+  status_fields="$(claudio_parse_codexa_status "$status_raw")"
+  read_first_entries="$(claudio_parse_read_first "$readme_raw" 8)"
+
+  context="$(
+    printf 'codexa/plugin v0.1.0 — validated session context.\n'
+    printf '(All values below were parsed against strict allowlists; repo prose is not forwarded.)\n'
+    printf '\nStatus:\n'
+    if [[ -n "$status_fields" ]]; then
+      printf '%s\n' "$status_fields" | sed 's/^/  /'
+    else
+      printf '  (unavailable)\n'
+    fi
+    printf '\nRead-first (top-ranked files):\n'
+    if [[ -n "$read_first_entries" ]]; then
+      while IFS=$'\t' read -r p r; do
+        [[ -z "$p" ]] && continue
+        printf '  - %s (rank %s)\n' "$p" "$r"
+      done <<<"$read_first_entries"
+    else
+      printf '  (none parsed)\n'
+    fi
+    printf '\nNext calls:\n'
+    printf '  - /codexa-status    — refresh this packet\n'
+    printf '  - /codexa-brief     — task brief + diff impact\n'
+    printf '  - /codexa-plan      — save a change-plan snapshot\n'
+    printf '  - /codexa-review    — post-edit drift review\n'
+    printf '  - /codexa-impact    — blast-radius for a file or symbol\n'
+  )"
+
+  python3 - "$repo" "$context" <<'PY'
+import json
+import sys
+
+repo_path = sys.argv[1]
+additional_context = sys.argv[2]
+payload = {
+    "hookSpecificOutput": {
+        "hookEventName": "SessionStart",
+        "additionalContext": additional_context,
+        "codexaRepoPath": repo_path,
+    },
+    "systemMessage": "Codexa-wired repo detected. See hookSpecificOutput for details.",
+}
+sys.stdout.write(json.dumps(payload, ensure_ascii=False))
+sys.stdout.write("\n")
+PY
+  exit 0
+fi
+
+# --- Mode 2: Parent-scan fallback. -----------------------------------------
+# cwd has no wired repo above; look for wired repos one level down.
+declare -a child_repos=()
+while IFS= read -r child; do
+  [[ -z "$child" ]] && continue
+  child_repos+=("$child")
+done < <(claudio_list_child_codexa_repos "$cwd")
+
+# Mode 3: Silent exit if no children either.
+if [[ ${#child_repos[@]} -eq 0 ]]; then
+  exit 0
+fi
+
+# Parent-scan mode deliberately does NOT run `codexa status` per child.
+# Up to 8 wired children × 2s-per-call can chew through the 6s outer hook
+# budget before the banner is emitted at all. Instead we list the child
+# repo paths with no per-repo status — the user can `/codexa-status`
+# after `cd`-ing into a repo to get full detail.
+declare -a child_paths=()
+for child in "${child_repos[@]:0:8}"; do
+  child_paths+=("$child")
+done
+
+# Build the multi-repo additionalContext. Repo names are validated as
+# basename-only (no paths), which means ${child##*/}. Those are
+# filesystem-controlled but already pass through the structured
+# additionalContext field, and downstream we never re-interpret them.
+# The parent cwd is also filesystem-controlled, so it runs through the
+# display-safe quoter before reaching the banner — same threat as a
+# hostile repo directory name would otherwise smuggle in newlines.
+safe_cwd="$(claudio_display_path "$cwd")"
+
+# Privacy knob: by default, list each wired child by basename so the user
+# can see which projects are discoverable. Set CLAUDIO_PARENT_SCAN_NAMES=0
+# to emit a count-only banner instead — useful when Claude Code is
+# started from a shared parent directory where exposing sibling project
+# names to the session context would leak information.
+reveal_names="${CLAUDIO_PARENT_SCAN_NAMES:-1}"
+
+context="$(
+  printf 'codexa/plugin v0.1.0 — parent-scan session context.\n'
+  printf '(cwd is above any wired repo. Reporting direct children that are codexa-wired.)\n'
+  if [[ "$reveal_names" == "0" ]]; then
+    # Privacy mode: NO cwd, NO child names. Just the count. Nothing in
+    # this banner can identify the parent directory or any sibling
+    # project once CLAUDIO_PARENT_SCAN_NAMES=0 is set.
+    printf '\nWired repos:\n'
+    printf '  (%d wired child repo(s) detected; names and parent cwd redacted via CLAUDIO_PARENT_SCAN_NAMES=0)\n' "${#child_paths[@]}"
+  else
+    printf '\nWired repos under %s:\n' "$safe_cwd"
+    for repo_path in "${child_paths[@]}"; do
+      short_name="$(basename "$repo_path")"
+      # Basename must pass a strict allowlist. Anything else — prose,
+      # punctuation, control chars — is replaced with a stable placeholder
+      # so a hostile directory name cannot inject prompt text.
+      if [[ "$short_name" =~ ^[A-Za-z0-9._-]{1,64}$ ]]; then
+        safe_name="$short_name"
+      else
+        safe_name="(unsafe-name)"
+      fi
+      printf '  - %s\n' "$safe_name"
+    done
+    printf '\n(Run /codexa-status after cd-ing into any repo for freshness / commit / dirty-file detail.)\n'
+  fi  # end reveal_names branch
+  printf '\nNext calls:\n'
+  printf '  - cd into any wired repo to enable auto-nudges on Edit/Write/MultiEdit\n'
+  printf '  - /codexa-status    — full status for the repo containing your cwd\n'
+  printf '  - /codexa-brief     — task brief + diff impact\n'
+  printf '  - /codexa-plan      — save a change-plan snapshot before editing\n'
+  printf '  - /codexa-review    — post-edit drift review\n'
+  printf '  - codexa init <repo>  — wire an unwired project\n'
+)"
+
+# Emit multi-repo envelope. `codexaRepoPaths` is a JSON array of the raw
+# paths for structured-field consumers (e.g. Claude tool calls that want
+# to enumerate available projects).
+python3 - "$cwd" "$context" "$reveal_names" "${child_paths[@]}" <<'PY'
+import json
+import sys
+
+cwd = sys.argv[1]
+additional_context = sys.argv[2]
+reveal_names = sys.argv[3] != "0"
+child_paths = list(sys.argv[4:])
+output = {
+    "hookEventName": "SessionStart",
+    "additionalContext": additional_context,
+    "codexaRepoCount": len(child_paths),
+}
+# Count-only privacy mode: suppress BOTH codexaRepoPaths and codexaCwd so
+# no path-level identifier (raw paths, parent cwd) leaks to downstream
+# structured consumers. Only the count survives.
+if reveal_names:
+    output["codexaCwd"] = cwd
+    output["codexaRepoPaths"] = child_paths
+payload = {
+    "hookSpecificOutput": output,
+    "systemMessage": "Codexa-wired child repos detected. See hookSpecificOutput for details.",
+}
+sys.stdout.write(json.dumps(payload, ensure_ascii=False))
+sys.stdout.write("\n")
+PY