@mnemonik/claude-code-hooks 0.9.48 → 0.9.51

package/dist/lib/actionCapture.js

@@ -0,0 +1,211 @@
+import { createHash, createHmac } from 'node:crypto';
+import { statSync } from 'node:fs';
+import { resolve } from 'node:path';
+const MAX_FINGERPRINTS = 128;
+const SHA256_RE = /^[a-f0-9]{64}$/;
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function stableValue(value) {
+    if (Array.isArray(value))
+        return value.map(stableValue);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => [key, stableValue(item)]));
+    }
+    return value;
+}
+export function stableJson(value) {
+    return JSON.stringify(stableValue(value)) ?? 'null';
+}
+function stringLeaves(value, into) {
+    if (typeof value === 'string') {
+        into.push(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            stringLeaves(item, into);
+        return;
+    }
+    if (value && typeof value === 'object') {
+        for (const item of Object.values(value))
+            stringLeaves(item, into);
+    }
+}
+export function fingerprintSurface(value, sessionSalt) {
+    if (!SHA256_RE.test(sessionSalt))
+        return [];
+    const strings = [];
+    stringLeaves(value, strings);
+    const seen = new Set();
+    const fingerprints = [];
+    for (const text of strings) {
+        const tokens = text
+            .normalize('NFC')
+            .toLowerCase()
+            .split(/[^\p{L}\p{N}]+/u);
+        for (const token of tokens) {
+            if (token.length < 4 || seen.has(token))
+                continue;
+            seen.add(token);
+            fingerprints.push({
+                hash: createHmac('sha256', Buffer.from(sessionSalt, 'hex'))
+                    .update(token)
+                    .digest('hex')
+                    .slice(0, 32),
+                length: token.length,
+            });
+            if (fingerprints.length >= MAX_FINGERPRINTS)
+                return fingerprints;
+        }
+    }
+    return fingerprints;
+}
+function withoutPreImage(input) {
+    const result = { ...input };
+    delete result.old_string;
+    delete result.oldString;
+    return result;
+}
+function targetValues(input) {
+    const args = input.tool_input ?? {};
+    const values = [];
+    for (const key of ['file_path', 'notebook_path', 'path', 'memoryId', 'memory_id', 'id']) {
+        const value = args[key];
+        if (typeof value === 'string' && value)
+            values.push(value);
+    }
+    for (const key of ['memoryIds', 'memory_ids', 'ids']) {
+        const value = args[key];
+        if (Array.isArray(value)) {
+            values.push(...value.filter((item) => typeof item === 'string' && !!item));
+        }
+    }
+    return [...new Set(values)].map((value) => value.includes('/') || value.includes('\\') ? resolve(input.cwd, value) : value);
+}
+function commandClass(command) {
+    const normalized = command.normalize('NFC').toLowerCase();
+    if (/\b(vitest|jest|pytest|rspec|cargo\s+test|go\s+test|npm\s+(run\s+)?test|make\s+test)\b/.test(normalized)) {
+        return 'validator_test';
+    }
+    if (/\b(tsc|typecheck|mypy|pyright|cargo\s+check)\b/.test(normalized)) {
+        return 'validator_typecheck';
+    }
+    if (/\b(eslint|prettier\s+--check|ruff|golangci-lint|npm\s+run\s+lint|make\s+lint)\b/.test(normalized)) {
+        return 'validator_lint';
+    }
+    if (/\b(npm\s+run\s+build|pnpm\s+build|yarn\s+build|make\s+build|cargo\s+build|go\s+build)\b/.test(normalized)) {
+        return 'validator_build';
+    }
+    return 'shell';
+}
+export function normalizeActionClass(toolName, toolInput) {
+    const lower = toolName.toLowerCase();
+    if (lower.includes('bash') || lower.includes('shell') || lower.includes('terminal')) {
+        return commandClass(typeof toolInput.command === 'string' ? toolInput.command : '');
+    }
+    if (lower.includes('memory_state') || lower.includes('reinforce')) {
+        const action = typeof toolInput.action === 'string' ? toolInput.action : '';
+        if (action === 'penalize')
+            return 'memory_penalize';
+        if (action === 'reinforce')
+            return 'memory_reinforce';
+    }
+    if (lower === 'edit' || lower.includes('strreplace') || lower.includes('replace'))
+        return 'edit';
+    if (lower === 'write' || lower.includes('write'))
+        return 'write';
+    if (lower.includes('notebook'))
+        return 'notebook_edit';
+    if (lower.includes('grep'))
+        return 'search';
+    return `tool:${lower || 'unknown'}`;
+}
+function resultExitStatus(result) {
+    const visit = (value, depth = 0) => {
+        if (depth > 5 || !value || typeof value !== 'object')
+            return undefined;
+        const row = value;
+        for (const key of ['exitCode', 'exit_code', 'statusCode', 'status_code']) {
+            const code = row[key];
+            if (typeof code === 'number' && Number.isFinite(code))
+                return `exit:${code}`;
+        }
+        if (row.is_error === true || row.isError === true || row.error)
+            return 'error';
+        if (row.ok === false || row.success === false)
+            return 'error';
+        for (const child of Object.values(row)) {
+            const found = visit(child, depth + 1);
+            if (found)
+                return found;
+        }
+        return undefined;
+    };
+    return visit(result) ?? 'unknown';
+}
+export function transcriptSequence(input) {
+    if (!input.transcript_path)
+        return {};
+    try {
+        const seq = statSync(input.transcript_path).size;
+        return { seq, transcriptRef: sha256(input.transcript_path) };
+    }
+    catch {
+        return {};
+    }
+}
+export function buildActionObservation(input, sessionSalt) {
+    const event = input.hook_event_name === 'PreToolUse'
+        ? 'pre_tool_use'
+        : input.hook_event_name === 'PostToolUse'
+            ? 'post_tool_use'
+            : input.hook_event_name === 'UserPromptSubmit'
+                ? 'user_prompt'
+                : input.hook_event_name === 'PreCompact'
+                    ? 'compaction'
+                    : input.hook_event_name === 'SessionEnd'
+                        ? 'session_end'
+                        : undefined;
+    if (!event)
+        return undefined;
+    const { seq, transcriptRef } = transcriptSequence(input);
+    if (event !== 'pre_tool_use' && event !== 'post_tool_use') {
+        return {
+            event,
+            nativeActionRef: `boundary:${event}:${seq ?? 'unknown'}`,
+            actionClass: 'boundary',
+            targetHashes: [],
+            fingerprintSet: { args: [], preImage: [] },
+            ...(seq !== undefined ? { seq } : {}),
+            ...(transcriptRef ? { transcriptRef } : {}),
+        };
+    }
+    if (!input.tool_use_id)
+        return undefined;
+    const args = input.tool_input ?? {};
+    const safeArgs = withoutPreImage(args);
+    const preImage = args.old_string ?? args.oldString;
+    return {
+        event,
+        nativeActionRef: input.tool_use_id,
+        actionClass: normalizeActionClass(input.tool_name ?? '', args),
+        targetHashes: targetValues(input).map(sha256),
+        argHash: sha256(stableJson(safeArgs)),
+        ...(event === 'post_tool_use'
+            ? {
+                resultHash: sha256(stableJson(input.tool_response)),
+                exitStatus: resultExitStatus(input.tool_response),
+            }
+            : {}),
+        fingerprintSet: {
+            args: fingerprintSurface(safeArgs, sessionSalt),
+            preImage: fingerprintSurface(preImage, sessionSalt),
+        },
+        ...(seq !== undefined ? { seq } : {}),
+        ...(transcriptRef ? { transcriptRef } : {}),
+    };
+}
+//# sourceMappingURL=actionCapture.js.map

package/dist/lib/actionCapture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionCapture.js","sourceRoot":"","sources":["../../src/lib/actionCapture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAEnC,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;YAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,WAAmB;IACpE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI;aAChB,SAAS,CAAC,KAAK,CAAC;aAChB,WAAW,EAAE;aACb,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,YAAY,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;qBACxD,MAAM,CAAC,KAAK,CAAC;qBACb,MAAM,CAAC,KAAK,CAAC;qBACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,MAAM,IAAI,gBAAgB;gBAAE,OAAO,YAAY,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B;IACrD,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,UAAU,CAAC;IACzB,OAAO,MAAM,CAAC,SAAS,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAgB;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;QACxF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACxC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,IACE,uFAAuF,CAAC,IAAI,CAC1F,UAAU,CACX,EACD,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,gDAAgD,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IACE,iFAAiF,CAAC,IAAI,CACpF,UAAU,CACX,EACD,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IACE,yFAAyF,CAAC,IAAI,CAC5F,UAAU,CACX,EACD,CAAC;QACD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAkC;IACvF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpF,OAAO,YAAY,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO,iBAAiB,CAAC;QACpD,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,kBAAkB,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC;IACjG,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,eAAe,CAAC;IACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,QAAQ,KAAK,IAAI,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAe;IACvC,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAsB,EAAE;QAC9D,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACvE,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,QAAQ,IAAI,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC;QAC/E,IAAI,GAAG,CAAC,EAAE,KAAK,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,OAAO,CAAC;QAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAgB;IACjD,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC;QACjD,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAgB,EAChB,WAAmB;IAEnB,MAAM,KAAK,GACT,KAAK,CAAC,eAAe,KAAK,YAAY;QACpC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,aAAa;YACvC,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,kBAAkB;gBAC5C,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,YAAY;oBACtC,CAAC,CAAC,YAAY;oBACd,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,YAAY;wBACtC,CAAC,CAAC,aAAa;wBACf,CAAC,CAAC,SAAS,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC1D,OAAO;YACL,KAAK;YACL,eAAe,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI,SAAS,EAAE;YACxD,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE,EAAE;YAChB,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC1C,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC;IACnD,OAAO;QACL,KAAK;QACL,eAAe,EAAE,KAAK,CAAC,WAAW;QAClC,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC;QAC9D,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC7C,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrC,GAAG,CAAC,KAAK,KAAK,eAAe;YAC3B,CAAC,CAAC;gBACE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACnD,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC;aAClD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,cAAc,EAAE;YACd,IAAI,EAAE,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC;YAC/C,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC;SACpD;QACD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/lib/creditCapture.d.ts

@@ -0,0 +1,32 @@
+/** Private, fail-open Claude Code transcript confirmation. */
+import type { DeliveryConfirmation, HookInput, InjectionsResponse } from './types.js';
+export interface PendingDelivery {
+    deliveryRef: string;
+    emittedHashes: string[];
+    rendererVersion: string;
+    transcriptByteOffset: number;
+    sessionSalt: string;
+}
+export declare function pendingDeliveryPath(sessionId: string): string;
+/** Generate one random salt per host session without any awaited work. */
+export declare function getOrCreateSessionSalt(sessionId: string): string;
+/** One bounded O_APPEND write. Any failure is silent and never blocks emission. */
+export declare function appendPendingDelivery(sessionId: string, record: PendingDelivery): boolean;
+/** Parse only bytes appended after each stored transcript offset. */
+export declare function collectDeliveryConfirmations(input: HookInput): DeliveryConfirmation[];
+/** Remove accepted references after the existing request returns. */
+export declare function acknowledgeDeliveryConfirmations(sessionId: string, accepted: string[]): void;
+/** Sessions older than this can never confirm again (confirmation rides the SAME session's next hook event). */
+export declare const STALE_SESSION_MS: number;
+/**
+ * Remove abandoned session directories. Users close IDEs; SessionEnd rarely
+ * fires; the OS temp cleaner is not our contract. Runs once per SessionStart:
+ * one readdir plus one lstat per entry, synchronous, best-effort. Skips
+ * anything that is not a plain directory (symlinks, junctions, files) and
+ * never throws.
+ */
+export declare function sweepStaleSessionDirs(now?: number): number;
+/** Remove one session's private pending log on clean SessionEnd. */
+export declare function clearPendingDeliveries(sessionId: string): void;
+/** Record the reflex fragments that survived final additionalContext composition. */
+export declare function captureReflexDeliveries(input: HookInput, additionalContext: string, response: InjectionsResponse | null): boolean;

package/dist/lib/creditCapture.js

@@ -0,0 +1,417 @@
+/** Private, fail-open Claude Code transcript confirmation. */
+import { createHash, randomBytes } from 'node:crypto';
+import { chmodSync, closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync, writeSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+const MAX_PENDING_BYTES = 1024 * 1024;
+const MAX_RECORD_BYTES = 64 * 1024;
+const MAX_DELTA_BYTES = 8 * 1024 * 1024;
+const DELTA_READ_CHUNK_BYTES = 64 * 1024;
+const POINTER_RE = /— memory_get [0-9a-f]{8}/gi;
+const ATTACHMENT_MARKER = Buffer.from('"hook_additional_context"');
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function privateRoot() {
+    const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
+    return join(tmpdir(), `mnemonik-credit-${uid}`);
+}
+export function pendingDeliveryPath(sessionId) {
+    return join(privateRoot(), sha256(sessionId), 'pending.jsonl');
+}
+function sessionSaltPath(sessionId) {
+    return join(privateRoot(), sha256(sessionId), 'session.salt');
+}
+/** Generate one random salt per host session without any awaited work. */
+export function getOrCreateSessionSalt(sessionId) {
+    const path = sessionSaltPath(sessionId);
+    let fd = null;
+    try {
+        if (!ensurePrivateDirectory(path) || !secureRegularFile(path))
+            return '';
+        try {
+            fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+            const salt = randomBytes(32).toString('hex');
+            if (writeSync(fd, salt, 0, 'utf8') !== salt.length)
+                return '';
+            return salt;
+        }
+        catch {
+            if (fd !== null) {
+                try {
+                    closeSync(fd);
+                }
+                catch {
+                    // Fall through to the winner's file.
+                }
+                fd = null;
+            }
+            const existing = readFileSync(path, 'utf8').trim();
+            return /^[a-f0-9]{64}$/.test(existing) ? existing : '';
+        }
+    }
+    catch {
+        return '';
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // Fail-open.
+            }
+        }
+    }
+}
+function ensurePrivateDirectory(path) {
+    try {
+        const root = privateRoot();
+        if (existsSync(root) && lstatSync(root).isSymbolicLink())
+            return false;
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+        chmodSync(root, 0o700);
+        if (existsSync(dirname(path)) && lstatSync(dirname(path)).isSymbolicLink())
+            return false;
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        chmodSync(dirname(path), 0o700);
+        return !lstatSync(root).isSymbolicLink() && !lstatSync(dirname(path)).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+function secureRegularFile(path) {
+    try {
+        if (!existsSync(path))
+            return true;
+        const stat = lstatSync(path);
+        return stat.isFile() && !stat.isSymbolicLink() && (stat.mode & 0o077) === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** One bounded O_APPEND write. Any failure is silent and never blocks emission. */
+export function appendPendingDelivery(sessionId, record) {
+    const path = pendingDeliveryPath(sessionId);
+    let fd = null;
+    try {
+        if (!ensurePrivateDirectory(path) || !secureRegularFile(path))
+            return false;
+        const existingBytes = existsSync(path) ? statSync(path).size : 0;
+        if (existingBytes >= MAX_PENDING_BYTES)
+            return false;
+        const line = Buffer.from(`${JSON.stringify(record)}\n`, 'utf8');
+        if (line.length > MAX_RECORD_BYTES || existingBytes + line.length > MAX_PENDING_BYTES) {
+            return false;
+        }
+        fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | (constants.O_NOFOLLOW ?? 0), 0o600);
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || (stat.mode & 0o077) !== 0)
+            return false;
+        return writeSync(fd, line, 0, line.length) === line.length;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // Fail-open and log nothing.
+            }
+        }
+    }
+}
+function readPending(sessionId) {
+    const path = pendingDeliveryPath(sessionId);
+    try {
+        if (!secureRegularFile(path))
+            return [];
+        const text = readFileSync(path, 'utf8');
+        if (Buffer.byteLength(text) > MAX_PENDING_BYTES)
+            return [];
+        return text
+            .split('\n')
+            .filter(Boolean)
+            .slice(-32)
+            .flatMap((line) => {
+            try {
+                const record = JSON.parse(line);
+                return typeof record.deliveryRef === 'string' &&
+                    Array.isArray(record.emittedHashes) &&
+                    typeof record.rendererVersion === 'string' &&
+                    Number.isSafeInteger(record.transcriptByteOffset) &&
+                    record.transcriptByteOffset >= 0 &&
+                    typeof record.sessionSalt === 'string' &&
+                    /^[a-f0-9]{64}$/.test(record.sessionSalt)
+                    ? [record]
+                    : [];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Match exact item hashes without assuming memory text has no blank lines.
+ * Every blank-line boundary before a pointer is tried; only a server-supplied
+ * SHA-256 match is admitted.
+ */
+function matchFragments(content, expected) {
+    const matches = [];
+    let cursor = 0;
+    let pointerIndex = 0;
+    POINTER_RE.lastIndex = 0;
+    let pointer;
+    while ((pointer = POINTER_RE.exec(content)) !== null && matches.length < expected.length) {
+        const end = pointer.index + pointer[0].length;
+        const starts = [cursor];
+        let boundary = content.indexOf('\n\n', cursor);
+        while (boundary >= 0 && boundary < pointer.index) {
+            starts.push(boundary + 2);
+            boundary = content.indexOf('\n\n', boundary + 2);
+        }
+        for (const start of starts) {
+            const candidate = content.slice(start, end).trim();
+            if (sha256(candidate) === expected[matches.length]) {
+                matches.push({ hash: expected[matches.length], fragmentIndex: pointerIndex });
+                cursor = end;
+                break;
+            }
+        }
+        pointerIndex += 1;
+    }
+    return matches;
+}
+function readTranscriptDelta(path, offset) {
+    let fd = null;
+    try {
+        const stat = lstatSync(path);
+        if (!stat.isFile() || stat.isSymbolicLink() || offset > stat.size)
+            return null;
+        const length = stat.size - offset;
+        if (length <= 0 || length > MAX_DELTA_BYTES)
+            return null;
+        fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        let out = Buffer.allocUnsafe(Math.min(length, DELTA_READ_CHUNK_BYTES));
+        let total = 0;
+        while (total < length) {
+            if (total === out.length) {
+                const expanded = Buffer.allocUnsafe(Math.min(length, out.length + DELTA_READ_CHUNK_BYTES));
+                out.copy(expanded, 0, 0, total);
+                out = expanded;
+            }
+            const read = readSync(fd, out, total, out.length - total, offset + total);
+            if (read <= 0)
+                return null;
+            total += read;
+            const current = out.subarray(0, total);
+            const markerAt = current.indexOf(ATTACHMENT_MARKER);
+            if (markerAt >= 0) {
+                const newlineAt = current.indexOf(0x0a, markerAt);
+                if (newlineAt >= 0)
+                    return current.subarray(0, newlineAt + 1);
+                if (total === length)
+                    return current;
+            }
+        }
+        return out.subarray(0, total);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // Read failure is silent.
+            }
+        }
+    }
+}
+/** Parse only bytes appended after each stored transcript offset. */
+export function collectDeliveryConfirmations(input) {
+    if (!input.transcript_path)
+        return [];
+    const pending = readPending(input.session_id);
+    const transcriptRef = sha256(input.transcript_path);
+    const confirmations = [];
+    for (const record of pending) {
+        const delta = readTranscriptDelta(input.transcript_path, record.transcriptByteOffset);
+        if (!delta)
+            continue;
+        let best;
+        // Multi-MB tool results dominate transcript deltas. Search for the exact
+        // attachment discriminator first, then JSON-decode only those JSONL lines.
+        // This preserves the reference parser's malformed-line behavior without
+        // allocating an array or parsing thousands of unrelated tool-result rows.
+        let searchFrom = 0;
+        const marker = ATTACHMENT_MARKER;
+        while (searchFrom < delta.length) {
+            const markerAt = delta.indexOf(marker, searchFrom);
+            if (markerAt < 0)
+                break;
+            const lineStart = delta.lastIndexOf(0x0a, markerAt) + 1;
+            const newlineAt = delta.indexOf(0x0a, markerAt);
+            const lineEnd = newlineAt < 0 ? delta.length : newlineAt;
+            const line = delta.subarray(lineStart, lineEnd).toString('utf8');
+            const currentOffset = record.transcriptByteOffset + lineStart;
+            searchFrom = lineEnd + 1;
+            try {
+                const parsed = JSON.parse(line);
+                if (parsed.type !== 'attachment' ||
+                    parsed.attachment?.type !== 'hook_additional_context' ||
+                    !Array.isArray(parsed.attachment.content)) {
+                    continue;
+                }
+                parsed.attachment.content.forEach((content, contentIndex) => {
+                    const found = matchFragments(content, record.emittedHashes);
+                    if (found.length === 0)
+                        return;
+                    const candidate = {
+                        hashes: found.map((item) => item.hash),
+                        positions: found.map((item) => ({
+                            transcriptRef,
+                            byteOffset: currentOffset,
+                            contentIndex,
+                            fragmentIndex: item.fragmentIndex,
+                        })),
+                    };
+                    if (!best || candidate.hashes.length > best.hashes.length)
+                        best = candidate;
+                });
+            }
+            catch {
+                // Reference parser contract: malformed JSONL lines are ignored.
+            }
+        }
+        if (best) {
+            confirmations.push({
+                deliveryRef: record.deliveryRef,
+                emittedHashes: record.emittedHashes,
+                transcriptHashes: best.hashes,
+                positions: best.positions,
+                rendererVersion: record.rendererVersion,
+                sessionSalt: record.sessionSalt,
+            });
+        }
+    }
+    return confirmations;
+}
+/** Remove accepted references after the existing request returns. */
+export function acknowledgeDeliveryConfirmations(sessionId, accepted) {
+    if (accepted.length === 0)
+        return;
+    const path = pendingDeliveryPath(sessionId);
+    const temp = `${path}.${process.pid}.tmp`;
+    try {
+        if (!secureRegularFile(path))
+            return;
+        const keep = readPending(sessionId).filter((record) => !accepted.includes(record.deliveryRef));
+        writeFileSync(temp, keep.map((record) => JSON.stringify(record)).join('\n') + (keep.length ? '\n' : ''), {
+            mode: 0o600,
+            flag: 'wx',
+        });
+        renameSync(temp, path);
+    }
+    catch {
+        try {
+            unlinkSync(temp);
+        }
+        catch {
+            // Cleanup is best-effort.
+        }
+    }
+}
+/** Sessions older than this can never confirm again (confirmation rides the SAME session's next hook event). */
+export const STALE_SESSION_MS = 24 * 60 * 60 * 1000;
+/**
+ * Remove abandoned session directories. Users close IDEs; SessionEnd rarely
+ * fires; the OS temp cleaner is not our contract. Runs once per SessionStart:
+ * one readdir plus one lstat per entry, synchronous, best-effort. Skips
+ * anything that is not a plain directory (symlinks, junctions, files) and
+ * never throws.
+ */
+export function sweepStaleSessionDirs(now = Date.now()) {
+    const root = privateRoot();
+    let removed = 0;
+    try {
+        if (!existsSync(root) || lstatSync(root).isSymbolicLink())
+            return 0;
+        for (const entry of readdirSync(root)) {
+            const full = join(root, entry);
+            try {
+                const st = lstatSync(full);
+                if (!st.isDirectory() || st.isSymbolicLink())
+                    continue;
+                if (now - st.mtimeMs < STALE_SESSION_MS)
+                    continue;
+                rmSync(full, { recursive: true, force: true });
+                removed += 1;
+            }
+            catch {
+                // Best-effort per entry.
+            }
+        }
+    }
+    catch {
+        // Best-effort overall; never blocks a session from starting.
+    }
+    return removed;
+}
+/** Remove one session's private pending log on clean SessionEnd. */
+export function clearPendingDeliveries(sessionId) {
+    const path = pendingDeliveryPath(sessionId);
+    try {
+        if (existsSync(path) && secureRegularFile(path))
+            unlinkSync(path);
+        const saltPath = sessionSaltPath(sessionId);
+        if (existsSync(saltPath) && secureRegularFile(saltPath))
+            unlinkSync(saltPath);
+        rmdirSync(dirname(path));
+    }
+    catch {
+        // Session cleanup is best-effort and never blocks shutdown.
+    }
+}
+/** Record the reflex fragments that survived final additionalContext composition. */
+export function captureReflexDeliveries(input, additionalContext, response) {
+    if (!input.transcript_path || !response?.ok)
+        return false;
+    let transcriptByteOffset;
+    try {
+        transcriptByteOffset = statSync(input.transcript_path).size;
+    }
+    catch {
+        return false;
+    }
+    let appended = false;
+    const sessionSalt = getOrCreateSessionSalt(input.session_id);
+    if (!sessionSalt)
+        return false;
+    for (const injection of response.injections) {
+        if (injection.signal !== 'reflex_recall' || !injection.creditCapture)
+            continue;
+        const emittedHashes = matchFragments(additionalContext, injection.creditCapture.expectedFragmentHashes).map((item) => item.hash);
+        appended =
+            appendPendingDelivery(input.session_id, {
+                deliveryRef: injection.creditCapture.deliveryRef,
+                emittedHashes,
+                rendererVersion: injection.creditCapture.rendererVersion,
+                transcriptByteOffset,
+                sessionSalt,
+            }) || appended;
+    }
+    return appended;
+}
+//# sourceMappingURL=creditCapture.js.map