@popoverinstall/cli 0.8.0 → 0.9.0

package/plugin/scripts/deliver-messages.mjs

@@ -1,77 +1,77 @@
-#!/usr/bin/env node
-// Delivers tells into a live session.
-//
-// One of the two hooks in the plugin that write to stdout on purpose — announce-roster.mjs
-// is the other. Every one of the rest is registered `async: true` and forbidden from
-// printing, because for UserPromptSubmit stdout is injected into the model's context — see
-// the header of emit-event.mjs. That is precisely the channel a tell needs, so this hook is
-// synchronous and its output is the message.
-//
-// Which makes it the riskiest script here, and it is written accordingly:
-//
-//   - It runs before every prompt the user submits, so it must be fast and must fail open.
-//     A missed heads-up is survivable; a prompt that hangs waiting on a dead daemon is not.
-//   - It prints only what the daemon hands back. The envelope is rendered on this machine
-//     from columns the database filled in, so a sender can neither forge the attribution nor
-//     strip the framing off their own message.
-//   - It stays silent inside a fork. Forks run the plugin's hooks like any other session, and
-//     a fork answering a teammate's question must never be handed a third party's text — its
-//     output goes back to whoever asked.
-
-import { callerSessionId, request } from "./_ipc.mjs";
-
-// The fork runner sets this when it spawns a read-only answer session.
-if (process.env.CLAUDE_CODE_ENTRYPOINT === "popover-fork") process.exit(0);
-
-try {
-  // The payload carries session_id; the environment is the fallback, and one of the two is
-  // always present in a real session. Without a session there is no inbox to drain.
-  let sessionId = callerSessionId();
-  try {
-    const raw = await readStdinQuickly();
-    if (raw) sessionId = JSON.parse(raw)?.session_id || sessionId;
-  } catch {
-    // A malformed payload is not a reason to skip delivery; the env var still identifies us.
-  }
-
-  if (sessionId) {
-    const reply = await request(
-      { t: "pending", id: "hook", fromSessionId: sessionId, limit: 3 },
-      { timeoutMs: 300 },
-    );
-
-    if (reply?.t === "pending.ok" && reply.rendered) {
-      // The whole point of the script. Everything above exists to make this line safe.
-      process.stdout.write(`${reply.rendered}\n`);
-    }
-  }
-} catch {
-  // Fail open, always. Whatever went wrong, the user's prompt must still go through.
-}
-
-process.exit(0);
-
-/**
- * Read the hook payload, but never wait long for it.
- *
- * `readStdin` in _ipc.mjs allows two seconds, which is right for a fire-and-forget reporter
- * and far too long for something sitting between a keystroke and the model.
- */
-function readStdinQuickly(timeoutMs = 150) {
-  return new Promise((resolve) => {
-    let data = "";
-    const timer = setTimeout(() => resolve(data), timeoutMs);
-    process.stdin.setEncoding("utf8");
-    process.stdin.on("data", (chunk) => {
-      data += chunk;
-    });
-    process.stdin.on("end", () => {
-      clearTimeout(timer);
-      resolve(data);
-    });
-    process.stdin.on("error", () => {
-      clearTimeout(timer);
-      resolve(data);
-    });
-  });
-}
+#!/usr/bin/env node
+// Delivers tells into a live session.
+//
+// One of the two hooks in the plugin that write to stdout on purpose — announce-roster.mjs
+// is the other. Every one of the rest is registered `async: true` and forbidden from
+// printing, because for UserPromptSubmit stdout is injected into the model's context — see
+// the header of emit-event.mjs. That is precisely the channel a tell needs, so this hook is
+// synchronous and its output is the message.
+//
+// Which makes it the riskiest script here, and it is written accordingly:
+//
+//   - It runs before every prompt the user submits, so it must be fast and must fail open.
+//     A missed heads-up is survivable; a prompt that hangs waiting on a dead daemon is not.
+//   - It prints only what the daemon hands back. The envelope is rendered on this machine
+//     from columns the database filled in, so a sender can neither forge the attribution nor
+//     strip the framing off their own message.
+//   - It stays silent inside a fork. Forks run the plugin's hooks like any other session, and
+//     a fork answering a teammate's question must never be handed a third party's text — its
+//     output goes back to whoever asked.
+
+import { callerSessionId, request } from "./_ipc.mjs";
+
+// The fork runner sets this when it spawns a read-only answer session.
+if (process.env.CLAUDE_CODE_ENTRYPOINT === "popover-fork") process.exit(0);
+
+try {
+  // The payload carries session_id; the environment is the fallback, and one of the two is
+  // always present in a real session. Without a session there is no inbox to drain.
+  let sessionId = callerSessionId();
+  try {
+    const raw = await readStdinQuickly();
+    if (raw) sessionId = JSON.parse(raw)?.session_id || sessionId;
+  } catch {
+    // A malformed payload is not a reason to skip delivery; the env var still identifies us.
+  }
+
+  if (sessionId) {
+    const reply = await request(
+      { t: "pending", id: "hook", fromSessionId: sessionId, limit: 3 },
+      { timeoutMs: 300 },
+    );
+
+    if (reply?.t === "pending.ok" && reply.rendered) {
+      // The whole point of the script. Everything above exists to make this line safe.
+      process.stdout.write(`${reply.rendered}\n`);
+    }
+  }
+} catch {
+  // Fail open, always. Whatever went wrong, the user's prompt must still go through.
+}
+
+process.exit(0);
+
+/**
+ * Read the hook payload, but never wait long for it.
+ *
+ * `readStdin` in _ipc.mjs allows two seconds, which is right for a fire-and-forget reporter
+ * and far too long for something sitting between a keystroke and the model.
+ */
+function readStdinQuickly(timeoutMs = 150) {
+  return new Promise((resolve) => {
+    let data = "";
+    const timer = setTimeout(() => resolve(data), timeoutMs);
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      data += chunk;
+    });
+    process.stdin.on("end", () => {
+      clearTimeout(timer);
+      resolve(data);
+    });
+    process.stdin.on("error", () => {
+      clearTimeout(timer);
+      resolve(data);
+    });
+  });
+}

package/plugin/scripts/emit-event.mjs

@@ -1,44 +1,44 @@
-#!/usr/bin/env node
-// Status hook handler.
-//
-// Reads the hook payload from stdin, forwards it to the daemon, exits. That is the whole
-// job — all interpretation happens in the daemon, so this stays fast enough to sit on
-// PreToolUse, which fires on every single tool call.
-//
-// Rules this script must never break:
-//   - never write to stdout (for UserPromptSubmit and SessionStart, stdout is injected
-//     into the model's context)
-//   - never exit non-zero (exit 2 would BLOCK the tool call it is reporting on)
-//   - never hang (hooks run async, but a wedged process still costs a handle)
-
-import { readStdin, sendFireAndForget } from "./_ipc.mjs";
-
-/*
- * Stay silent inside a fork — the same guard deliver-messages.mjs and announce-roster.mjs
- * carry, and for a sharper reason than either of them.
- *
- * A fork is a real Claude Code session with its own session id, and it runs the plugin's
- * hooks like any other. Without this, every answered ask reported PreToolUse, PostToolUse and
- * Stop for that throwaway session, and the daemon created a session for it — so every ask put
- * a ghost agent on the team roster, in the answering machine's repo, that nobody could reach
- * and that never went away until it was reaped.
- *
- * Worse, it poisoned attribution. `SessionStore.resolveCaller` infers who is calling from the
- * highest `lastEventAt`, and a fork that has just finished answering is by construction the
- * most recent thing to have emitted an event on this machine — so a tell sent moments after
- * answering an ask was recorded as coming from the fork.
- */
-if (process.env.CLAUDE_CODE_ENTRYPOINT === "popover-fork") process.exit(0);
-
-try {
-  const raw = await readStdin();
-  const payload = JSON.parse(raw);
-
-  if (payload?.session_id && payload?.hook_event_name) {
-    await sendFireAndForget({ t: "status", payload });
-  }
-} catch {
-  // A malformed payload or an absent daemon is not worth interrupting anyone's work.
-}
-
-process.exit(0);
+#!/usr/bin/env node
+// Status hook handler.
+//
+// Reads the hook payload from stdin, forwards it to the daemon, exits. That is the whole
+// job — all interpretation happens in the daemon, so this stays fast enough to sit on
+// PreToolUse, which fires on every single tool call.
+//
+// Rules this script must never break:
+//   - never write to stdout (for UserPromptSubmit and SessionStart, stdout is injected
+//     into the model's context)
+//   - never exit non-zero (exit 2 would BLOCK the tool call it is reporting on)
+//   - never hang (hooks run async, but a wedged process still costs a handle)
+
+import { readStdin, sendFireAndForget } from "./_ipc.mjs";
+
+/*
+ * Stay silent inside a fork — the same guard deliver-messages.mjs and announce-roster.mjs
+ * carry, and for a sharper reason than either of them.
+ *
+ * A fork is a real Claude Code session with its own session id, and it runs the plugin's
+ * hooks like any other. Without this, every answered ask reported PreToolUse, PostToolUse and
+ * Stop for that throwaway session, and the daemon created a session for it — so every ask put
+ * a ghost agent on the team roster, in the answering machine's repo, that nobody could reach
+ * and that never went away until it was reaped.
+ *
+ * Worse, it poisoned attribution. `SessionStore.resolveCaller` infers who is calling from the
+ * highest `lastEventAt`, and a fork that has just finished answering is by construction the
+ * most recent thing to have emitted an event on this machine — so a tell sent moments after
+ * answering an ask was recorded as coming from the fork.
+ */
+if (process.env.CLAUDE_CODE_ENTRYPOINT === "popover-fork") process.exit(0);
+
+try {
+  const raw = await readStdin();
+  const payload = JSON.parse(raw);
+
+  if (payload?.session_id && payload?.hook_event_name) {
+    await sendFireAndForget({ t: "status", payload });
+  }
+} catch {
+  // A malformed payload or an absent daemon is not worth interrupting anyone's work.
+}
+
+process.exit(0);

package/plugin/scripts/ensure-daemon.mjs

@@ -1,156 +1,156 @@
-#!/usr/bin/env node
-// SessionStart hook: make sure exactly one daemon is running, then register this session.
-//
-// This runs on every session start, so the common case — a daemon is already up — must
-// be a single cheap probe with no side effects.
-
-import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, openSync, readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { daemonAddress, popoverHome, readStdin, request, sendFireAndForget } from "./_ipc.mjs";
-
-const HERE = path.dirname(fileURLToPath(import.meta.url));
-
-/*
- * A fork has nothing to do here, and doing it is actively harmful.
- *
- * The daemon spawns forks itself, so a daemon demonstrably exists — and registering the
- * fork's session id would put a ghost agent on the team roster for every ask answered. Same
- * guard, same reason, as emit-event.mjs; see its header for what the ghost then does to
- * attribution.
- */
-if (process.env.CLAUDE_CODE_ENTRYPOINT === "popover-fork") process.exit(0);
-
-async function main() {
-  const raw = await readStdin().catch(() => "");
-  let payload = null;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    /* still worth ensuring the daemon is up */
-  }
-
-  const alive = await ping();
-  // `updateInProgress()` is the interlock, not an optimisation. `popover update` stops the
-  // daemon and hands npm up to five minutes to replace the global install; a daemon started
-  // in that window runs out of the tree being replaced and holds its files open, so npm's
-  // rename fails EPERM/EBUSY on Windows and the update aborts half-done. Every session on the
-  // machine runs this hook, so without the check one of them wins that race almost every time.
-  if (!alive && !updateInProgress()) {
-    const entry = resolveDaemonEntry();
-    if (entry) {
-      launch(entry);
-      // Give it a moment to bind before we register, but do not block the session on it:
-      // the hook is async and the status event falls back to the spool file regardless.
-      await waitForDaemon(3000);
-    }
-  }
-
-  if (payload?.session_id) {
-    await sendFireAndForget({ t: "status", payload });
-  }
-  process.exit(0);
-}
-
-async function ping() {
-  const reply = await request({ t: "ping", id: "ensure" }, { timeoutMs: 1200 });
-  return reply?.t === "pong";
-}
-
-async function waitForDaemon(budgetMs) {
-  const deadline = Date.now() + budgetMs;
-  while (Date.now() < deadline) {
-    if (await ping()) return true;
-    await new Promise((r) => setTimeout(r, 200));
-  }
-  return false;
-}
-
-/**
- * Find the daemon entry point.
- *
- * Order matters: an explicit override wins, then the pointer file, then the monorepo
- * layouts used during development.
- *
- * The pointer file is the one that matters in production, and it holds an absolute path on
- * purpose. Installing a plugin *copies* it into
- * `~/.claude/plugins/cache/<mkt>/<plugin>/<version>/`, severed from whatever tree it was
- * built in — so every path relative to this file lands inside that cache directory, where
- * no daemon has ever existed. Only a fixed location under `~/.popover` survives the copy,
- * and `popover setup` is what writes it there.
- *
- * Keep in step with `daemonEntryPointerPath()` in @popoverinstall/shared. This file cannot import
- * it: a hook that fails to resolve an import would break every tool call in the session.
- */
-function resolveDaemonEntry() {
-  if (process.env.POPOVER_DAEMON_ENTRY && existsSync(process.env.POPOVER_DAEMON_ENTRY)) {
-    return process.env.POPOVER_DAEMON_ENTRY;
-  }
-
-  // Written by `popover setup`. Survives the plugin-cache copy; see above.
-  try {
-    const entry = readFileSync(path.join(popoverHome(), "daemon-entry"), "utf8").trim();
-    if (entry && existsSync(entry)) return entry;
-  } catch {
-    /* no pointer yet — `popover setup` has not run */
-  }
-
-  const candidates = [
-    // Vendored beside the plugin.
-    path.join(HERE, "..", "node_modules", "@popoverinstall", "daemon", "dist", "index.js"),
-    // Monorepo checkout.
-    path.join(HERE, "..", "..", "daemon", "dist", "index.js"),
-    path.join(HERE, "..", "..", "..", "packages", "daemon", "dist", "index.js"),
-  ];
-
-  for (const candidate of candidates) {
-    if (existsSync(candidate)) return candidate;
-  }
-  return null;
-}
-
-/**
- * Whether `popover update` is replacing the install tree right now.
- *
- * Written by `beginUpdateLock` in packages/cli/src/daemon-lock.ts, which holds the readable
- * version of why this exists. Duplicated here rather than imported for the same reason
- * `resolveDaemonEntry` duplicates its path: this file must resolve no imports beyond the ones
- * it already has, because a hook that throws breaks every session on the machine. Keep the
- * two in step.
- *
- * Every branch fails towards starting the daemon. A marker with no deadline, or one whose
- * deadline has passed, is a crashed update rather than a running one, and refusing to start
- * on that basis would leave a machine permanently without a daemon and nothing on screen to
- * explain it. Only a marker that is present, readable and unexpired holds us back.
- */
-function updateInProgress() {
-  try {
-    const file = path.join(popoverHome(), "update.lock");
-    if (!existsSync(file)) return false;
-    const deadline = Number(JSON.parse(readFileSync(file, "utf8")).deadline);
-    return Number.isFinite(deadline) && Date.now() < deadline;
-  } catch {
-    return false;
-  }
-}
-
-function launch(entry) {
-  try {
-    // Detached with stdio to a log file: the daemon must outlive this hook, this session,
-    // and the terminal window it was started from.
-    mkdirSync(popoverHome(), { recursive: true });
-    const out = openSync(path.join(popoverHome(), "daemon-stdout.log"), "a");
-    const child = spawn(process.execPath, [entry], {
-      detached: true,
-      stdio: ["ignore", out, out],
-      windowsHide: true,
-      env: { ...process.env, POPOVER_DAEMON_ADDR: daemonAddress() },
-    });
-    child.unref();
-  } catch {
-    // If the daemon cannot start, /team will say so plainly. Never fail the session.
-  }
-}
-
-main().catch(() => process.exit(0));
+#!/usr/bin/env node
+// SessionStart hook: make sure exactly one daemon is running, then register this session.
+//
+// This runs on every session start, so the common case — a daemon is already up — must
+// be a single cheap probe with no side effects.
+
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, openSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { daemonAddress, popoverHome, readStdin, request, sendFireAndForget } from "./_ipc.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+
+/*
+ * A fork has nothing to do here, and doing it is actively harmful.
+ *
+ * The daemon spawns forks itself, so a daemon demonstrably exists — and registering the
+ * fork's session id would put a ghost agent on the team roster for every ask answered. Same
+ * guard, same reason, as emit-event.mjs; see its header for what the ghost then does to
+ * attribution.
+ */
+if (process.env.CLAUDE_CODE_ENTRYPOINT === "popover-fork") process.exit(0);
+
+async function main() {
+  const raw = await readStdin().catch(() => "");
+  let payload = null;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    /* still worth ensuring the daemon is up */
+  }
+
+  const alive = await ping();
+  // `updateInProgress()` is the interlock, not an optimisation. `popover update` stops the
+  // daemon and hands npm up to five minutes to replace the global install; a daemon started
+  // in that window runs out of the tree being replaced and holds its files open, so npm's
+  // rename fails EPERM/EBUSY on Windows and the update aborts half-done. Every session on the
+  // machine runs this hook, so without the check one of them wins that race almost every time.
+  if (!alive && !updateInProgress()) {
+    const entry = resolveDaemonEntry();
+    if (entry) {
+      launch(entry);
+      // Give it a moment to bind before we register, but do not block the session on it:
+      // the hook is async and the status event falls back to the spool file regardless.
+      await waitForDaemon(3000);
+    }
+  }
+
+  if (payload?.session_id) {
+    await sendFireAndForget({ t: "status", payload });
+  }
+  process.exit(0);
+}
+
+async function ping() {
+  const reply = await request({ t: "ping", id: "ensure" }, { timeoutMs: 1200 });
+  return reply?.t === "pong";
+}
+
+async function waitForDaemon(budgetMs) {
+  const deadline = Date.now() + budgetMs;
+  while (Date.now() < deadline) {
+    if (await ping()) return true;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  return false;
+}
+
+/**
+ * Find the daemon entry point.
+ *
+ * Order matters: an explicit override wins, then the pointer file, then the monorepo
+ * layouts used during development.
+ *
+ * The pointer file is the one that matters in production, and it holds an absolute path on
+ * purpose. Installing a plugin *copies* it into
+ * `~/.claude/plugins/cache/<mkt>/<plugin>/<version>/`, severed from whatever tree it was
+ * built in — so every path relative to this file lands inside that cache directory, where
+ * no daemon has ever existed. Only a fixed location under `~/.popover` survives the copy,
+ * and `popover setup` is what writes it there.
+ *
+ * Keep in step with `daemonEntryPointerPath()` in @popoverinstall/shared. This file cannot import
+ * it: a hook that fails to resolve an import would break every tool call in the session.
+ */
+function resolveDaemonEntry() {
+  if (process.env.POPOVER_DAEMON_ENTRY && existsSync(process.env.POPOVER_DAEMON_ENTRY)) {
+    return process.env.POPOVER_DAEMON_ENTRY;
+  }
+
+  // Written by `popover setup`. Survives the plugin-cache copy; see above.
+  try {
+    const entry = readFileSync(path.join(popoverHome(), "daemon-entry"), "utf8").trim();
+    if (entry && existsSync(entry)) return entry;
+  } catch {
+    /* no pointer yet — `popover setup` has not run */
+  }
+
+  const candidates = [
+    // Vendored beside the plugin.
+    path.join(HERE, "..", "node_modules", "@popoverinstall", "daemon", "dist", "index.js"),
+    // Monorepo checkout.
+    path.join(HERE, "..", "..", "daemon", "dist", "index.js"),
+    path.join(HERE, "..", "..", "..", "packages", "daemon", "dist", "index.js"),
+  ];
+
+  for (const candidate of candidates) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+/**
+ * Whether `popover update` is replacing the install tree right now.
+ *
+ * Written by `beginUpdateLock` in packages/cli/src/daemon-lock.ts, which holds the readable
+ * version of why this exists. Duplicated here rather than imported for the same reason
+ * `resolveDaemonEntry` duplicates its path: this file must resolve no imports beyond the ones
+ * it already has, because a hook that throws breaks every session on the machine. Keep the
+ * two in step.
+ *
+ * Every branch fails towards starting the daemon. A marker with no deadline, or one whose
+ * deadline has passed, is a crashed update rather than a running one, and refusing to start
+ * on that basis would leave a machine permanently without a daemon and nothing on screen to
+ * explain it. Only a marker that is present, readable and unexpired holds us back.
+ */
+function updateInProgress() {
+  try {
+    const file = path.join(popoverHome(), "update.lock");
+    if (!existsSync(file)) return false;
+    const deadline = Number(JSON.parse(readFileSync(file, "utf8")).deadline);
+    return Number.isFinite(deadline) && Date.now() < deadline;
+  } catch {
+    return false;
+  }
+}
+
+function launch(entry) {
+  try {
+    // Detached with stdio to a log file: the daemon must outlive this hook, this session,
+    // and the terminal window it was started from.
+    mkdirSync(popoverHome(), { recursive: true });
+    const out = openSync(path.join(popoverHome(), "daemon-stdout.log"), "a");
+    const child = spawn(process.execPath, [entry], {
+      detached: true,
+      stdio: ["ignore", out, out],
+      windowsHide: true,
+      env: { ...process.env, POPOVER_DAEMON_ADDR: daemonAddress() },
+    });
+    child.unref();
+  } catch {
+    // If the daemon cannot start, /team will say so plainly. Never fail the session.
+  }
+}
+
+main().catch(() => process.exit(0));