@useshifu/coding-harness 0.2.5 → 0.2.7

package/README.md

@@ -7,13 +7,13 @@ npx @useshifu/coding-harness install --harness codex
 npx @useshifu/coding-harness connect --harness codex
 ```
 
-`connect` and `sync` each ask for confirmation. The connector has no lifecycle hooks and never uploads in the background. Codex and OpenCode support local time-window discovery and review; Claude Code does not yet.
+`connect` and `sync` each ask for confirmation. The connector has no lifecycle hooks and never uploads in the background. Codex, Claude Code, and OpenCode support local time-window discovery and review. Claude Code discovery reads local sessions under `~/.claude/projects`; review surfaces assistant text for inspection, never raw prompts or tool results.
 
-When asked to sync, Codex and OpenCode discover unsynced user turns from the last 24 hours by default. A user can choose 48 or 72 hours instead. Discovery reports only opaque session references, timestamps, and unsynced turn ranges; it does not send transcript content. `blockedSessions` lists recently changed sessions whose next unsynced turn is older than the chosen window. Those older contiguous backlogs are not silently included; the user can explicitly select a session and review it with `--all`.
+When asked to sync, Codex, Claude Code, and OpenCode discover unsynced user turns from the last 24 hours by default. A user can choose 48 or 72 hours instead. Discovery reports only opaque session references, timestamps, and unsynced turn ranges; it does not send transcript content. `blockedSessions` lists recently changed sessions whose next unsynced turn is older than the chosen window. Those older contiguous backlogs are not silently included; the user can explicitly select a session and review it with `--all`.
 
 ```sh
-npx @useshifu/coding-harness sessions --harness <codex|opencode> --hours 24
-npx @useshifu/coding-harness review --harness <codex|opencode> --session-ref opaque-session-id
+npx @useshifu/coding-harness sessions --harness <codex|claude_code|opencode> --hours 24
+npx @useshifu/coding-harness review --harness <codex|claude_code|opencode> --session-ref opaque-session-id
 ```
 
 `review` reads the next contiguous segment of at most 12 unsynced turns locally. Pass the selected `--hours` value to `review` as well; `--all` is reserved for a specifically selected session's older backlog. It shows assistant final notes, candidate work items, and a draft that leaves required sync and work-item titles blank for the reviewer. Candidates are suggestions, not proof or guaranteed redaction. Candidate scope is left unset until a reviewer chooses the smallest supported level. If a segment has more than 64 candidates, rerun `sessions` and `review` with `--turns 1` to narrow it before syncing. Review each work title, detail, and area, prepare any verification, and preserve an item's `itemRef` when a later segment revises the same work. User-message records are omitted, but assistant notes may quote sensitive material. Nothing is uploaded by this command. Repeat discovery after each accepted segment to continue the delta.

package/bin/shifu-harness.js

@@ -16,6 +16,8 @@ const HARNESS_NAMES = {
 const TOKEN_PATTERN = /^cs_sk_[a-f0-9]{16}_[a-f0-9]{64}$/;
 const SENSITIVE_PATTERNS = ["-----begin", "authorization", "sk-", "sk_", "ghp_", "gho_", "ghu_", "ghs_", "ghr_", "xox", "github_pat_", "glpat-", "ignore previous instructions", "ignore all previous instructions", "system prompt", "@", "://", "`", "/"];
 const PHONE_NUMBER_PATTERN = /(?:\+?\d[\d .()-]{6,}\d)/i;
+const OPAQUE_SESSION_REF_PATTERN = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|(?:ses|thread)_[a-z0-9_-]+)$/i;
+const UNSAFE_SESSION_REF_PATTERNS = ["api_key", "authorization", "password", "@", "://", "`", "/"];
 const UNSAFE_CODE_PATTERN = /\b(?:func|class|interface|struct|package|import|select|insert|update|delete|create\s+table)\s+[a-z_][a-z0-9_]*\s*(?:\(|\{|=|$)/i;
 const CREDENTIAL_ASSIGNMENT_PATTERN = /\b(?:token|secret|password|api[_-]?key)\s*[:=]\s*\S+/i;
 const CLOUD_CREDENTIAL_PATTERN = /\bAKIA[0-9A-Z]{16}\b|AIza[0-9A-Za-z_-]{20,}/;
@@ -51,6 +53,10 @@ function codexSessionsRoot() {
   return process.env.SHIFU_CODEX_SESSIONS_ROOT || path.join(os.homedir(), ".codex", "sessions");
 }
 
+function claudeSessionsRoot() {
+  return process.env.SHIFU_CLAUDE_SESSIONS_ROOT || path.join(os.homedir(), ".claude", "projects");
+}
+
 function opencodeQuery(query) {
   if (process.env.SHIFU_OPENCODE_DB && !process.env.SHIFU_OPENCODE_BIN) {
     try {
@@ -114,8 +120,9 @@ function opencodeSessions(rows) {
 
 function localSessions(harness) {
   if (harness === "codex") return sessionFiles(codexSessionsRoot()).map(codexSession).filter(Boolean);
+  if (harness === "claude_code") return sessionFiles(claudeSessionsRoot()).map(claudeSession).filter(Boolean);
   if (harness === "opencode") return opencodeSessions(opencodeQuery("SELECT s.id AS sessionRef, s.time_created AS startedAt, s.time_updated AS updatedAt, m.time_created AS turnAt FROM session s JOIN message m ON m.session_id = s.id WHERE json_extract(m.data, '$.role') = 'user' ORDER BY s.time_updated, m.time_created"));
-  throw new Error("Session discovery is currently available for Codex and OpenCode only.");
+  throw new Error("Choose a supported coding harness.");
 }
 
 function requireHarness(value) {
@@ -216,6 +223,52 @@ function codexSession(file) {
   return { sessionRef, startedAt: startedAt || updatedAt, updatedAt, turnCount, turnTimes };
 }
 
+function claudeEntries(file) {
+  return fs.readFileSync(file, "utf8").split("\n").filter(Boolean).map((line) => {
+    try { return JSON.parse(line); }
+    catch { throw new Error(`Could not read Claude Code session metadata from ${file}.`); }
+  }).filter((entry) => !entry.isSidechain);
+}
+
+function isClaudeUserTurn(entry) {
+  if (entry.type !== "user" || entry.message?.role !== "user") return false;
+  const content = entry.message.content;
+  return typeof content === "string" || (Array.isArray(content) && content.some((part) => part.type === "text"));
+}
+
+function claudeSession(file) {
+  const sessionRef = path.basename(file, ".jsonl");
+  if (!OPAQUE_SESSION_REF_PATTERN.test(sessionRef)) return undefined;
+  let startedAt;
+  let updatedAt;
+  const turnTimes = [];
+  for (const entry of claudeEntries(file)) {
+    if (typeof entry.timestamp !== "string" || !Number.isFinite(Date.parse(entry.timestamp))) continue;
+    startedAt ||= entry.timestamp;
+    updatedAt = entry.timestamp;
+    if (isClaudeUserTurn(entry)) turnTimes.push(entry.timestamp);
+  }
+  return updatedAt && turnTimes.length ? { sessionRef, startedAt, updatedAt, turnCount: turnTimes.length, turnTimes } : undefined;
+}
+
+function claudeReview(file, fromTurn, toTurn) {
+  const sessionRef = path.basename(file, ".jsonl");
+  let turn = 0;
+  const lastNoteByTurn = new Map();
+  for (const entry of claudeEntries(file)) {
+    if (isClaudeUserTurn(entry)) {
+      turn += 1;
+      continue;
+    }
+    if (entry.type !== "assistant" || entry.message?.role !== "assistant" || turn < fromTurn || turn > toTurn) continue;
+    const content = entry.message.content;
+    if (!Array.isArray(content) || content.some((part) => part.type === "tool_use")) continue;
+    const note = content.filter((part) => part.type === "text" && typeof part.text === "string").map((part) => part.text).join("\n").trim();
+    if (note) lastNoteByTurn.set(turn, note);
+  }
+  return { sessionRef, turnCount: turn, notes: [...lastNoteByTurn].map(([t, note]) => ({ turn: t, note })) };
+}
+
 function finalAssistantNote(file) {
   const lines = fs.readFileSync(file, "utf8").split("\n").filter(Boolean);
   let sessionRef;
@@ -488,6 +541,7 @@ function install(harness) {
     const content = fs.readFileSync(skill, "utf8")
       .replaceAll('"codex"', `"${harness}"`)
       .replaceAll("--harness codex", `--harness ${harness}`)
+      .replaceAll("Codex", HARNESS_NAMES[harness])
       .replaceAll("npx @useshifu/coding-harness", `"${process.execPath}" "${installedRunnerPath()}"`);
     fs.writeFileSync(skill, content, { mode: 0o600 });
   }
@@ -513,10 +567,17 @@ function textIsSafe(value, maximum) {
   return typeof value === "string" && value.trim().length > 0 && value.length <= maximum && !/[\x00-\x1f\x7f]/.test(value) && !PHONE_NUMBER_PATTERN.test(value) && !UNSAFE_CODE_PATTERN.test(value) && !CREDENTIAL_ASSIGNMENT_PATTERN.test(value) && !CLOUD_CREDENTIAL_PATTERN.test(value) && !SENSITIVE_PATTERNS.some((pattern) => value.toLowerCase().includes(pattern));
 }
 
+function sessionRefIsSafe(value) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (UNSAFE_SESSION_REF_PATTERNS.some((pattern) => trimmed.toLowerCase().includes(pattern))) return false;
+  return trimmed.length >= 8 && trimmed.length <= 200 && (OPAQUE_SESSION_REF_PATTERN.test(trimmed) || textIsSafe(trimmed, 200));
+}
+
 function validateSync(input, harness) {
   if (!input || Object.keys(input).some((field) => !SYNC_FIELDS.has(field))) throw new Error("Remove unsupported fields from the reviewed sync payload.");
-  if (!input || input.harness !== harness || typeof input.sessionRef !== "string" || !textIsSafe(input.sessionRef, 200) || input.sessionRef.length < 8) throw new Error("Add the current opaque sessionRef before syncing.");
-  if (!Number.isInteger(input.fromTurn) || !Number.isInteger(input.toTurn) || input.fromTurn < 1 || input.toTurn < input.fromTurn || input.toTurn - input.fromTurn >= MAX_TURNS_PER_SEGMENT) throw new Error("Use a valid incremental range of at most 12 turns.");
+  if (!input || input.harness !== harness || !sessionRefIsSafe(input.sessionRef)) throw new Error("Add the current opaque sessionRef before syncing.");
+  if (!Number.isInteger(input.fromTurn) || !Number.isInteger(input.toTurn) || input.fromTurn < 1 || input.toTurn < input.fromTurn || input.toTurn > 1_000_000 || input.toTurn - input.fromTurn >= MAX_TURNS_PER_SEGMENT) throw new Error("Use a valid incremental range of at most 12 turns.");
   if (input.redactionVersion === 3 && !textIsSafe(input.title, MAX_TITLE_LENGTH)) throw new Error("Add a concise, redacted title for this reviewed sync.");
   if (!textIsSafe(input.summary, 1200)) throw new Error("The summary is empty, too long, or contains sensitive content. Redact it before syncing.");
   if (!Array.isArray(input.evidence) || input.evidence.length < 1 || input.evidence.length > MAX_EVIDENCE_ITEMS || !input.evidence.every((item) => item && EVIDENCE_KINDS.has(item.kind) && SCOPE_LEVELS.has(item.scope) && (input.redactionVersion !== 3 || textIsSafe(item.title, MAX_TITLE_LENGTH)) && textIsSafe(item.statement, MAX_WORK_DETAIL_LENGTH))) {
@@ -534,6 +595,12 @@ function validateSync(input, harness) {
       item.verificationRefs.every((ref) => Number.isInteger(ref) && ref >= 0 && ref < input.verification.length))))) {
     throw new Error("Each work item must use a supported area, safe itemRef, and distinct indexes into verification.");
   }
+  const identities = new Set();
+  for (const item of input.evidence) {
+    const identity = item.itemRef || `${item.kind}:${item.scope}:${item.statement.trim()}`;
+    if (identities.has(identity)) throw new Error("Each work item must have a distinct identity.");
+    identities.add(identity);
+  }
   if (input.redactionVersion !== 2 && input.redactionVersion !== 3) throw new Error("Use redactionVersion 3 for new reviewed syncs.");
 }
 
@@ -616,7 +683,10 @@ function review(harness) {
   if (!Number.isInteger(turns) || turns < 1 || turns > MAX_TURNS_PER_SEGMENT) throw new Error("Choose --turns between 1 and 12.");
   const toTurn = Math.min(selected.turnCount, fromTurn + turns - 1);
   if (fromTurn > toTurn) throw new Error(`This ${HARNESS_NAMES[harness]} session has no unsynced turns to review.`);
-  const { notes } = harness === "codex" ? codexReview(sessionFiles(codexSessionsRoot()).map((file) => ({ file, session: codexSession(file) })).filter(({ session }) => session?.sessionRef === sessionRef).sort((left, right) => right.session.turnCount - left.session.turnCount)[0].file, fromTurn, toTurn) : opencodeReview(sessionRef, fromTurn, toTurn);
+  const files = harness === "codex" ? sessionFiles(codexSessionsRoot()) : harness === "claude_code" ? sessionFiles(claudeSessionsRoot()) : [];
+  const selectedFile = files.map((file) => ({ file, session: harness === "codex" ? codexSession(file) : claudeSession(file) }))
+    .filter(({ session }) => session?.sessionRef === sessionRef).sort((left, right) => right.session.turnCount - left.session.turnCount)[0]?.file;
+  const { notes } = harness === "codex" ? codexReview(selectedFile, fromTurn, toTurn) : harness === "claude_code" ? claudeReview(selectedFile, fromTurn, toTurn) : opencodeReview(sessionRef, fromTurn, toTurn);
   const candidates = reviewCandidates(notes);
   console.log(JSON.stringify({
     sessionRef,
@@ -654,4 +724,4 @@ if (require.main === module) {
     });
 }
 
-module.exports = { codexReview, codexSession, configPath, finalAssistantNote, install, installDestination, localSessions, opencodeQuery, opencodeReview, opencodeSessions, readSecret, removeHooks, requireSafeApiUrl, reviewCandidates, statePath, textIsSafe, unsyncedCodexSessions, validSyncReceipt, validateSync };
+module.exports = { claudeReview, claudeSession, codexReview, codexSession, configPath, finalAssistantNote, install, installDestination, localSessions, opencodeQuery, opencodeReview, opencodeSessions, readSecret, removeHooks, requireSafeApiUrl, reviewCandidates, statePath, textIsSafe, unsyncedCodexSessions, validSyncReceipt, validateSync };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@useshifu/coding-harness",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Reviewed, incremental coding-harness sync for Shifu",
   "bin": {
     "coding-harness": "bin/shifu-harness.js",

package/skills/shifu-sync/SKILL.md

@@ -31,7 +31,7 @@ Use detail proportionate to the work: retain high-level design, low-level contro
 
 Do not install or rely on lifecycle hooks or background reminders. A sync is always initiated by an explicit user request.
 
-Use this structure:
+Use this structure. Do not invent additional evidence fields; the sync API rejects fields outside its contract.
 
 ```json
 {