@usepowerplant/cli 0.4.15 → 0.4.17

package/dist/hooks/powerplant-codex-transcript.mjs

@@ -1,12 +1,21 @@
 #!/usr/bin/env node
-// Discovery only. The collector owns scope, transcript reads and uploads.
+// Discovery and lifecycle events only. The collector owns scope, transcript
+// reads and uploads. Never persist prompts, messages, or full input.
 import { Buffer } from "node:buffer";
 import { createHash, randomUUID } from "node:crypto";
-import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 const MAX_INPUT_BYTES = 128 * 1024;
+// Codex's events, the lifecycle event each records, and the input field
+// that holds its reason. The collector reads the journal in
+// apps/syncservice/src/lifecycleJournal.ts.
+const LIFECYCLE_EVENTS = new Map([
+  ["SessionStart", { event: "session-start", reasonField: "source" }],
+  ["Stop", { event: "turn-end" }],
+  ["SessionEnd", { event: "session-end", reasonField: "reason" }],
+]);
 let chunks = [];
 let bytes = 0;
 process.stdin.on("error", () => {});
@@ -17,43 +26,70 @@ process.stdin.on("data", (chunk) => {
 });
 process.stdin.on("end", () => {
   const dir = path.join(os.homedir(), ".config", "powerplant");
+  let input;
   try {
-    if (bytes <= MAX_INPUT_BYTES) {
-      const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-      if (
-        ["SessionStart", "SessionEnd", "Stop"].includes(input?.hook_event_name) &&
-        typeof input.session_id === "string" &&
-        /^[a-zA-Z0-9_-]{1,200}$/.test(input.session_id)
-      ) {
-        const record = {
-          sessionId: input.session_id,
-          transcriptPath:
-            typeof input.transcript_path === "string" &&
-            input.transcript_path.length <= 4096 &&
-            path.isAbsolute(input.transcript_path)
-              ? input.transcript_path
-              : null,
-        };
-        const records = path.join(dir, "codex-transcripts");
+    if (bytes <= MAX_INPUT_BYTES) input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    // Invalid input must not interrupt the agent.
+  }
+  const name = input?.hook_event_name;
+  const lifecycle = typeof name === "string" ? LIFECYCLE_EVENTS.get(name) : undefined;
+  const sessionId =
+    lifecycle !== undefined &&
+    typeof input.session_id === "string" &&
+    /^[a-zA-Z0-9_-]{1,200}$/.test(input.session_id)
+      ? input.session_id
+      : null;
+  if (sessionId !== null) {
+    try {
+      const record = {
+        sessionId,
+        transcriptPath:
+          typeof input.transcript_path === "string" &&
+          input.transcript_path.length <= 4096 &&
+          path.isAbsolute(input.transcript_path)
+            ? input.transcript_path
+            : null,
+      };
+      const records = path.join(dir, "codex-transcripts");
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      mkdirSync(records, { recursive: true, mode: 0o700 });
+      const file = path.join(records, `${createHash("sha256").update(sessionId).digest("hex")}.json`);
+      const temporary = `${file}.${randomUUID()}.tmp`;
+      try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        writeFileSync(temporary, JSON.stringify(record), { mode: 0o600, flag: "wx" });
         // eslint-disable-next-line security/detect-non-literal-fs-filename
-        mkdirSync(records, { recursive: true, mode: 0o700 });
-        const file = path.join(
-          records,
-          `${createHash("sha256").update(record.sessionId).digest("hex")}.json`
-        );
-        const temporary = `${file}.${randomUUID()}.tmp`;
-        try {
-          // eslint-disable-next-line security/detect-non-literal-fs-filename
-          writeFileSync(temporary, JSON.stringify(record), { mode: 0o600, flag: "wx" });
-          // eslint-disable-next-line security/detect-non-literal-fs-filename
-          renameSync(temporary, file);
-        } finally {
-          rmSync(temporary, { force: true });
-        }
+        renameSync(temporary, file);
+      } finally {
+        rmSync(temporary, { force: true });
       }
+    } catch {
+      // An unavailable disk must not interrupt the agent.
+    }
+    try {
+      const reason = lifecycle.reasonField === undefined ? undefined : input[lifecycle.reasonField];
+      const at = new Date().toISOString();
+      const entry = {
+        harness: "codex-local",
+        sessionId,
+        event: lifecycle.event,
+        nativeEvent: name,
+        ...(typeof reason === "string" && /^[a-zA-Z_-]{1,40}$/.test(reason) && { reason }),
+        at,
+      };
+      // Codex's own folder, one user-only file per UTC day; the collector
+      // deletes old ones.
+      const journal = path.join(dir, "lifecycle-journal", "codex-local");
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      mkdirSync(journal, { recursive: true, mode: 0o700 });
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      appendFileSync(path.join(journal, `${at.slice(0, 10)}.jsonl`), `${JSON.stringify(entry)}\n`, {
+        mode: 0o600,
+      });
+    } catch {
+      // The journal only adds evidence; transcript scans still find the session.
     }
-  } catch {
-    // Invalid input or unavailable disk must not interrupt the agent.
   }
   try {
     // Publish after the pointer; existing file scans also recover missed hooks.

package/dist/hooks/powerplant-cursor-transcript.mjs

@@ -1,13 +1,22 @@
 #!/usr/bin/env node
-// Local discovery only. The collector validates paths and capture policy
-// before opening transcripts. Never persist prompts, email, or full input.
+// Local discovery and lifecycle events only. The collector validates paths
+// and capture policy before opening transcripts. Never persist prompts,
+// email, or full input.
 import { createHash, randomUUID } from "node:crypto";
 import { Buffer } from "node:buffer";
-import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
 const MAX_INPUT_BYTES = 128 * 1024;
+// Cursor's events, the lifecycle event each records, and the input field
+// that holds its reason. The collector reads the journal in
+// apps/syncservice/src/lifecycleJournal.ts.
+const LIFECYCLE_EVENTS = new Map([
+  ["sessionStart", { event: "session-start" }],
+  ["stop", { event: "turn-end", reasonField: "status" }],
+  ["sessionEnd", { event: "session-end", reasonField: "reason" }],
+]);
 let chunks = [];
 let bytes = 0;
 process.stdin.on("error", () => {});
@@ -18,54 +27,81 @@ process.stdin.on("data", (chunk) => {
 });
 process.stdin.on("end", () => {
   const dir = path.join(os.homedir(), ".config", "powerplant");
+  let input;
   try {
-    if (bytes <= MAX_INPUT_BYTES) {
-      const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-      if (
-        ["sessionStart", "sessionEnd", "stop"].includes(input?.hook_event_name) &&
-        typeof input.conversation_id === "string" &&
-        /^[a-zA-Z0-9_-]{1,200}$/.test(input.conversation_id)
-      ) {
-        const roots =
-          Array.isArray(input.workspace_roots) &&
-          input.workspace_roots.length <= 8 &&
-          input.workspace_roots.every(
-            (p) => typeof p === "string" && p.length <= 4096 && path.isAbsolute(p)
-          )
-            ? input.workspace_roots
-            : [];
-        const record = {
-          sessionId: input.conversation_id,
-          transcriptPath:
-            typeof input.transcript_path === "string" &&
-            input.transcript_path.length <= 4096 &&
-            path.isAbsolute(input.transcript_path)
-              ? input.transcript_path
-              : null,
-          workspaceRoots: roots,
-          ...(typeof input.model === "string" &&
-            input.model.length <= 256 && { model: input.model }),
-        };
-        const records = path.join(dir, "cursor-transcripts");
+    if (bytes <= MAX_INPUT_BYTES) input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    // Invalid input must never stop the provider.
+  }
+  const name = input?.hook_event_name;
+  const lifecycle = typeof name === "string" ? LIFECYCLE_EVENTS.get(name) : undefined;
+  const sessionId =
+    lifecycle !== undefined &&
+    typeof input.conversation_id === "string" &&
+    /^[a-zA-Z0-9_-]{1,200}$/.test(input.conversation_id)
+      ? input.conversation_id
+      : null;
+  if (sessionId !== null) {
+    try {
+      const roots =
+        Array.isArray(input.workspace_roots) &&
+        input.workspace_roots.length <= 8 &&
+        input.workspace_roots.every(
+          (p) => typeof p === "string" && p.length <= 4096 && path.isAbsolute(p)
+        )
+          ? input.workspace_roots
+          : [];
+      const record = {
+        sessionId,
+        transcriptPath:
+          typeof input.transcript_path === "string" &&
+          input.transcript_path.length <= 4096 &&
+          path.isAbsolute(input.transcript_path)
+            ? input.transcript_path
+            : null,
+        workspaceRoots: roots,
+        ...(typeof input.model === "string" &&
+          input.model.length <= 256 && { model: input.model }),
+      };
+      const records = path.join(dir, "cursor-transcripts");
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      mkdirSync(records, { recursive: true, mode: 0o700 });
+      const file = path.join(records, `${createHash("sha256").update(sessionId).digest("hex")}.json`);
+      const temporary = `${file}.${randomUUID()}.tmp`;
+      try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        writeFileSync(temporary, JSON.stringify(record), { mode: 0o600, flag: "wx" });
         // eslint-disable-next-line security/detect-non-literal-fs-filename
-        mkdirSync(records, { recursive: true, mode: 0o700 });
-        const file = path.join(
-          records,
-          `${createHash("sha256").update(record.sessionId).digest("hex")}.json`
-        );
-        const temporary = `${file}.${randomUUID()}.tmp`;
-        try {
-          // eslint-disable-next-line security/detect-non-literal-fs-filename
-          writeFileSync(temporary, JSON.stringify(record), { mode: 0o600, flag: "wx" });
-          // eslint-disable-next-line security/detect-non-literal-fs-filename
-          renameSync(temporary, file);
-        } finally {
-          rmSync(temporary, { force: true });
-        }
+        renameSync(temporary, file);
+      } finally {
+        rmSync(temporary, { force: true });
       }
+    } catch {
+      // Discovery failure must never stop the provider. Existing capture remains.
+    }
+    try {
+      const reason = lifecycle.reasonField === undefined ? undefined : input[lifecycle.reasonField];
+      const at = new Date().toISOString();
+      const entry = {
+        harness: "cursor-local",
+        sessionId,
+        event: lifecycle.event,
+        nativeEvent: name,
+        ...(typeof reason === "string" && /^[a-zA-Z_-]{1,40}$/.test(reason) && { reason }),
+        at,
+      };
+      // Cursor's own folder, one user-only file per UTC day; the collector
+      // deletes old ones.
+      const journal = path.join(dir, "lifecycle-journal", "cursor-local");
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      mkdirSync(journal, { recursive: true, mode: 0o700 });
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      appendFileSync(path.join(journal, `${at.slice(0, 10)}.jsonl`), `${JSON.stringify(entry)}\n`, {
+        mode: 0o600,
+      });
+    } catch {
+      // The journal only adds evidence; existing capture remains.
     }
-  } catch {
-    // Discovery failure must never stop the provider. Existing capture remains.
   }
   try {
     // Publish after the pointer so the watcher sees a complete discovery record.

package/dist/hooks/powerplant-session-lifecycle.mjs

@@ -1,19 +1,26 @@
 #!/usr/bin/env node
 /**
- * Powerplant session lifecycle — SessionStart / SessionEnd hook.
+ * Powerplant session lifecycle: the Claude Code SessionStart, Stop, and
+ * SessionEnd hook.
  *
  * Claude Code fires these at real session boundaries (start, resume, clear,
- * quit). This hook appends one line per event to a local journal
- * (~/.config/powerplant/session-lifecycle.jsonl) so the collector's scan can
- * mark a session "completed" the moment its SessionEnd arrives, with the
- * observed end time — instead of waiting out the transcript-quiet grace
- * window. The `at` stamp is when THIS process observed the hook fire; it is
- * never a claimed or reconstructed time.
+ * quit) and when a turn ends. This hook appends one line per event to the
+ * lifecycle journal, one file per UTC day in
+ * ~/.config/powerplant/lifecycle-journal/claude-local/. Each line names the shared
+ * lifecycle event and keeps Claude Code's own event name as detail. The
+ * collector's scan marks a session "completed" the moment its SessionEnd
+ * arrives, with the observed end time, instead of waiting out the
+ * transcript-quiet grace window. The `at` stamp is when THIS process
+ * observed the hook fire; it is never a claimed or reconstructed time.
+ *
+ * Only the session id, the event names, and Claude Code's source or reason
+ * token are kept. Stop input carries the last assistant message; it is
+ * never written.
  *
  * This file is the CANONICAL SOURCE; the collector's watch service copies it
  * to ~/.config/powerplant/hooks/ and wires it into the user's
  * ~/.claude/settings.json (hookInstall.ts), so every repo's Claude sessions
- * report — not just this checkout's. This hook NEVER blocks or breaks a
+ * report, not just this checkout's. This hook NEVER blocks or breaks a
  * session: every failure path exits 0 with no output.
  *
  * Logic lives in the exported functions so the collector workspace can unit
@@ -26,36 +33,44 @@ import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-/** The collector's watcher and scan read this same path (lifecycleJournal.ts). */
-export function journalPath(home) {
-  return path.join(home, ".config", "powerplant", "session-lifecycle.jsonl");
+/** Claude Code's events, the lifecycle event each records, and the input
+ * field that holds its reason. */
+const LIFECYCLE_EVENTS = new Map([
+  ["SessionStart", { event: "session-start", reasonField: "source" }],
+  ["Stop", { event: "turn-end" }],
+  ["SessionEnd", { event: "session-end", reasonField: "reason" }],
+]);
+const SESSION_ID = /^[a-zA-Z0-9_-]{1,200}$/;
+const REASON = /^[a-zA-Z_-]{1,40}$/;
+
+/** Claude Code's folder in the journal; the collector reads it
+ * (lifecycleJournalHarnessDir in lifecycleJournal.ts). */
+export function journalDir(home) {
+  return path.join(home, ".config", "powerplant", "lifecycle-journal", "claude-local");
 }
 
 /**
- * One journal line from the hook's stdin JSON; null when the input isn't a
+ * One journal entry from the hook's stdin JSON; null when the input isn't a
  * lifecycle event we can attribute to a session. SessionStart carries a
  * `source` (startup|resume|clear|compact|fork), SessionEnd a `reason`
- * (clear|resume|logout|prompt_input_exit|other) — both land as `reason`.
+ * (clear|resume|logout|prompt_input_exit|other); both land as `reason`.
  */
-export function journalLineOf(inputText, at) {
+export function journalEntryOf(inputText, at) {
   try {
     const input = JSON.parse(inputText);
+    const nativeEvent = input?.hook_event_name;
+    const mapping = typeof nativeEvent === "string" ? LIFECYCLE_EVENTS.get(nativeEvent) : undefined;
     const sessionId = input?.session_id;
-    if (typeof sessionId !== "string" || sessionId === "") return null;
-    const event =
-      input?.hook_event_name === "SessionStart"
-        ? "start"
-        : input?.hook_event_name === "SessionEnd"
-          ? "end"
-          : null;
-    if (event === null) return null;
-    const reason = event === "start" ? input?.source : input?.reason;
-    return JSON.stringify({
+    if (mapping === undefined || typeof sessionId !== "string" || !SESSION_ID.test(sessionId)) return null;
+    const reason = mapping.reasonField === undefined ? undefined : input[mapping.reasonField];
+    return {
+      harness: "claude-local",
       sessionId,
-      event,
-      ...(typeof reason === "string" && reason !== "" && { reason }),
+      event: mapping.event,
+      nativeEvent,
+      ...(typeof reason === "string" && REASON.test(reason) && { reason }),
       at,
-    });
+    };
   } catch {
     return null;
   }
@@ -63,15 +78,17 @@ export function journalLineOf(inputText, at) {
 
 function main() {
   try {
-    const line = journalLineOf(readFileSync(0, "utf8"), new Date().toISOString());
-    if (line === null) return;
-    // The path is the user's homedir plus fixed segments — nothing from the
-    // hook input can steer where the journal lands.
-    const file = journalPath(os.homedir());
+    const entry = journalEntryOf(readFileSync(0, "utf8"), new Date().toISOString());
+    if (entry === null) return;
+    // The path is the user's homedir plus fixed segments and the date;
+    // nothing from the hook input can steer where the journal lands.
+    const dir = journalDir(os.homedir());
     // eslint-disable-next-line security/detect-non-literal-fs-filename
-    mkdirSync(path.dirname(file), { recursive: true });
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
     // eslint-disable-next-line security/detect-non-literal-fs-filename
-    appendFileSync(file, `${line}\n`);
+    appendFileSync(path.join(dir, `${entry.at.slice(0, 10)}.jsonl`), `${JSON.stringify(entry)}\n`, {
+      mode: 0o600,
+    });
   } catch {
     // never surface an error into someone's session
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usepowerplant/cli",
-  "version": "0.4.15",
+  "version": "0.4.17",
   "publishConfig": {
     "access": "public"
   },
@@ -29,7 +29,7 @@
   "devDependencies": {
     "@powerplant/collector": "workspace:*",
     "@powerplant/core": "workspace:*",
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.2",
     "esbuild": "^0.28.2",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",