@tznthou/ccrecall 0.6.0 → 0.7.1

package/scripts/post-session-extract.sh

@@ -15,6 +15,71 @@
 CCRECALL_PORT="${CCRECALL_PORT:-7749}"
 CCRECALL_EXTRACT_LOG="${CCRECALL_EXTRACT_LOG:-$HOME/.ccrecall/extract.log.jsonl}"
 
+# Telemetry rows carry $PWD (added with #89), which discloses the account name
+# and every project name the user works on. A log first created under a
+# permissive umask lands at 0644 — world-readable on a shared machine. Both
+# write paths below go through here: file permissions belong to the file, not
+# to the call site, so securing only one of them secures neither — whichever
+# path runs first decides the mode.
+#
+# Returns non-zero if the log cannot be secured, and callers then skip the
+# write: losing a telemetry row is cheaper than leaking paths.
+#
+# Every step is silenced, the creation included: a shell redirection error
+# names the full path on stderr, which is the account and project name this
+# function exists to withhold. Failing quietly is the contract — the caller
+# decides what, if anything, to say.
+_ccrecall_secure_log() {
+  local f="$1"
+  # Created under the restrictive umask so a directory this line brings into
+  # existence starts at 0700. It deliberately does not touch the mode of a
+  # directory that is already there: CCRECALL_EXTRACT_LOG is user-configurable,
+  # so that directory can be one the user picked — a project root, or the
+  # current directory for a relative setting — and neither tightening it nor
+  # refusing to use it is this script's call to make. Both were tried and both
+  # were worse: chmod turned a project directory 0755 into 0700, and refusing
+  # dropped every row forever on a `umask 002` machine, silently.
+  #
+  # Existing installs therefore keep whatever mode they have. ~/.ccrecall is
+  # also created on the TypeScript side without a mode (src/core/database.ts,
+  # src/core/integrity-monitor.ts; only recall-telemetry.ts passes 0o700), and
+  # whichever creator runs first wins. Fixing that belongs there, not here.
+  (umask 077; mkdir -p "$(dirname "$f")") 2>/dev/null || return 1
+  # Reject a symlink. This narrows the window rather than closing it: the test
+  # here, the chmod below and the append that follows are separate pathname
+  # resolutions, and both chmod(2) and >> follow links, so an attacker who can
+  # write this directory can still win the race by planting between them.
+  # Closing it properly needs open(O_NOFOLLOW|O_APPEND) + fchmod on the one
+  # descriptor, which shell cannot express; the real remedy is the directory
+  # not being writable by anyone else in the first place.
+  if [ -L "$f" ]; then return 1; fi
+  [ -e "$f" ] || (umask 077; : >> "$f") 2>/dev/null || return 1
+  # And refuse anything that is not a regular file: chmod on a directory
+  # succeeds and leaves it non-traversable, and the append then fails open.
+  [ -f "$f" ] || return 1
+  chmod 600 "$f" 2>/dev/null || return 1
+}
+
+# The only place that appends to the telemetry log. Both callers go through
+# here rather than each pairing a write with its own guard: a guard the caller
+# has to remember is one a later caller forgets, and permissions belong to the
+# file — a single unguarded append under a permissive umask re-creates the log
+# 0644 and every other writer inherits it. Securing is not the caller's job to
+# get right, so it is not the caller's job at all.
+#
+# Arguments after the path are forwarded verbatim to `jq -n -c`.
+# Silenced like every step of the guard: the redirection is set up by the
+# shell, so an open that fails here — the target replaced between the guard
+# and this line, a full disk — prints the full path, the same disclosure the
+# mode exists to prevent. jq's own diagnostics go with it; its arguments are
+# fixed in this file rather than user input, so a jq error is a bug this
+# repo's tests catch, not a condition to report at runtime.
+_ccrecall_log_append() {
+  local f="$1"; shift
+  _ccrecall_secure_log "$f" || return 1
+  { jq -n -c "$@" >> "$f"; } 2>/dev/null
+}
+
 # Resolve the directory containing this script (for prompt file).
 # zsh leaves BASH_SOURCE empty (the user's shell is zsh), so detect zsh and
 # use its %x prompt path; eval isolates the zsh-only ${(%):-%x} syntax from
@@ -29,10 +94,19 @@ CCRECALL_SCRIPT_DIR="$(cd "$(dirname "$_ccrecall_src")" && pwd)"
 unset _ccrecall_src
 
 ccrecall-extract() {
-  local project_id
-  # printf for the same reason as session_id below: zsh's echo mangles
-  # backslash sequences, and $PWD is arbitrary user input.
-  project_id=$(printf '%s' "$PWD" | sed 's|/|-|g')
+  # #89: this used to derive project_id here with `sed 's|/|-|g'`, which
+  # diverged from Claude Code's char-wise [^A-Za-z0-9] encoding for any cwd
+  # holding a space, dot, underscore or CJK — and every such session then
+  # skipped extraction forever with no error surfaced.
+  #
+  # We do NOT reimplement the encoding in shell. BSD sed/tr are byte-wise and
+  # emit three dashes per CJK character; getting it right here would mean a
+  # second implementation to keep in sync. Instead /session/last returns the
+  # id the daemon read off disk (see routes.ts) and we use that verbatim.
+  # It stays empty until that call lands, which is fine: every consumer of
+  # project_id below sits behind a valid session_id, which implies the call
+  # succeeded.
+  local project_id=""
 
   # ── Trust pre-flight ──
   # ccrecall-extract always launches claude with --dangerously-skip-permissions, which
@@ -83,6 +157,9 @@ ccrecall-extract() {
     # skipping extraction for ~1 in 5 sessions (any title with a newline,
     # e.g. every cmux "/model" opener). Root-caused 2026-07-16.
     session_id=$(printf '%s' "$session_meta" | jq -r '.sessionId // empty' 2>/dev/null)
+    # #89: authoritative project id, read off the ~/.claude/projects/ directory
+    # name by the indexer rather than re-derived from $PWD here.
+    project_id=$(printf '%s' "$session_meta" | jq -r '.projectId // empty' 2>/dev/null)
   fi
 
   # Load the structured prompt
@@ -170,14 +247,17 @@ ${prompt}"
   # more and usually saved nothing). A missed session is cheaper than that.
   if [[ "$transcript_mode" != "jsonl" ]]; then
     printf '\n⚠️  ccRecall: no text transcript (%s) — skipping extraction.\n' "$skip_reason"
-    mkdir -p "$(dirname "$CCRECALL_EXTRACT_LOG")"
-    jq -n -c \
+    # cwd, not just projectId: on a skip the daemon lookup may never have
+    # landed, leaving projectId empty. The raw cwd is the one fact always
+    # available, and #89 was diagnosed precisely by comparing it against the
+    # directory names under ~/.claude/projects/.
+    _ccrecall_log_append "$CCRECALL_EXTRACT_LOG" \
       --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
       --arg sid "$session_id" \
       --arg pid "$project_id" \
+      --arg cwd "$PWD" \
       --arg reason "$skip_reason" \
-      '{ts:$ts,sessionId:$sid,projectId:$pid,mode:"skip",reason:$reason,exitCode:null,durationSec:0}' \
-      >> "$CCRECALL_EXTRACT_LOG"
+      '{ts:$ts,sessionId:$sid,projectId:$pid,cwd:$cwd,mode:"skip",reason:$reason,exitCode:null,durationSec:0}' || :
     return $claude_exit
   fi
 
@@ -223,7 +303,18 @@ ${prompt}"
   # command before it).
   local log_dir
   log_dir=$(dirname "$CCRECALL_EXTRACT_LOG")
-  mkdir -p "$log_dir"
+  # Same umask as the log guard uses. This line runs ~95 lines before the
+  # telemetry append and creates the directory on every non-skip session, so
+  # without it the guard's own mkdir is a no-op here and the two paths through
+  # this function would leave the directory at different modes — 0700 when a
+  # skip returns early, 0755 otherwise.
+  #
+  # Silenced and non-fatal for the same reasons as everything else that
+  # touches this path: a failure prints $log_dir, and a bare command is not
+  # exempt from errexit. Ignoring the failure is safe — mktemp below degrades
+  # to /dev/null on its own, and the log guard re-creates the directory when
+  # the telemetry row is written.
+  (umask 077; mkdir -p "$log_dir") 2>/dev/null || :
   find "$log_dir" -maxdepth 1 -name 'extract-stdout.*' -mmin +60 -delete 2>/dev/null
   # Trailing Xs are mandatory: BSD/macOS mktemp only substitutes Xs at the END
   # of the template — an inner XXXXXX (e.g. a .tmp suffix after it) is taken
@@ -309,7 +400,16 @@ ${prompt}"
   # rather than invoking — splits exit-0 zero-write rows into silent miss vs
   # genuine no-op (#75). Absent on rows written before this marker shipped, so
   # analysis must treat missing as unknown, not as 0.
-  jq -n -c \
+  # Secured even though this row carries no cwd: the mode belongs to the file,
+  # and this path can be the one that creates it.
+  #
+  # `|| :` on both call sites is load-bearing under `set -e` / `setopt
+  # err_exit`. The previous shape put the guard in an `if` condition, which
+  # errexit exempts; a bare command is not exempt, so a dropped telemetry row
+  # would abort the function before `return $claude_exit` and hand the caller
+  # 1 instead of Claude's real exit status — in an interactive shell with
+  # errexit set, it would close the shell.
+  _ccrecall_log_append "$CCRECALL_EXTRACT_LOG" \
     --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
     --arg sid "$session_id" \
     --arg pid "$project_id" \
@@ -318,8 +418,7 @@ ${prompt}"
     --argjson exit "$extract_exit" \
     --argjson dur "$extract_duration" \
     --argjson textSaves "$recall_save_text_count" \
-    '{ts:$ts,sessionId:$sid,projectId:$pid,mode:"jsonl",exitCode:$exit,durationSec:$dur,stderr:$stderr,stdoutMarker:$marker,recallSaveTextCount:$textSaves}' \
-    >> "$CCRECALL_EXTRACT_LOG"
+    '{ts:$ts,sessionId:$sid,projectId:$pid,mode:"jsonl",exitCode:$exit,durationSec:$dur,stderr:$stderr,stdoutMarker:$marker,recallSaveTextCount:$textSaves}' || :
 
   return $claude_exit
 }

package/scripts/usefulness-report.sql

@@ -28,16 +28,41 @@ SELECT
 FROM injection_log;
 
 -- ── Coverage ───────────────────────────────────────────────────────
+-- Broken out per source. The done-criteria count *startup* injections, and
+-- v0.6.0 added a second writer to this table (`prompt` — mid-conversation
+-- recall), so an unfiltered COUNT(DISTINCT memory_id) mixes the two. Read the
+-- startup row. The rows do not sum: a memory injected by two sources is
+-- distinct within each.
 
-SELECT '── COVERAGE ──' AS '';
+SELECT '── COVERAGE BY SOURCE (lifetime) ──' AS '';
 
 SELECT
+  source,
   MIN(injected_at)              AS first,
   MAX(injected_at)              AS last,
   CAST(julianday(MAX(injected_at)) - julianday(MIN(injected_at)) AS INTEGER) AS span_days,
+  COUNT(*)                      AS injections,
   COUNT(DISTINCT memory_id)     AS distinct_memories,
   COUNT(DISTINCT session_id)    AS distinct_sessions
-FROM injection_log;
+FROM injection_log
+GROUP BY source
+ORDER BY injections DESC;
+
+-- Criterion 2 is scoped to a 7-day window; the lifetime figures above span the
+-- whole table and read far higher. Rolling window rather than hardcoded dates,
+-- so the report stays usable past the verdict.
+
+SELECT '── COVERAGE BY SOURCE (last 7 days) ──' AS '';
+
+SELECT
+  source,
+  COUNT(*)                      AS injections,
+  COUNT(DISTINCT memory_id)     AS distinct_memories,
+  COUNT(DISTINCT session_id)    AS distinct_sessions
+FROM injection_log
+WHERE injected_at >= datetime('now', '-7 days')
+GROUP BY source
+ORDER BY injections DESC;
 
 -- ── Overlap distribution ───────────────────────────────────────────