@winspan/claude-forge 8.54.3 → 9.2.0

package/dist/hooks/pre-tool-use.sh

@@ -1,5 +1,23 @@
 #!/usr/bin/env bash
 # Claude Forge - PreToolUse Hook（双向通信）
+#
+# jq call budget (3 total — reduced from 10):
+#   1× parse INPUT scalars + tool_input JSON via @sh eval
+#   1× build EVENT JSON via jq -n
+#   1× parse RESPONSE scalars + pre-rendered hookSpecificOutput JSON (only when
+#       RESPONSE non-empty; skipped on daemon-down / empty replies)
+# Each jq spawn is ~5-15ms cold on macOS; the original 10-call fan-out
+# added ~80ms to every tool call. See docs/implementation/2026-05-26.
+
+# Internal-spawn guard: forge spawns the `claude` CLI from several places
+# (src/skills/distill/distiller.ts via CLAUDE_FORGE_DISTILL_SPAWN, and the
+# shared src/core/utils/claude-cli-spawn.ts via CLAUDE_FORGE_INTERNAL_SPAWN —
+# used by cf claudemd, cf knowledge build, cf patch). Each spawn drops
+# `--bare` so OAuth keychain reads still work; this guard prevents the
+# spawned subprocess's hooks from firing back into the daemon (fan-out
+# loop). Both envs are accepted for backward compatibility.
+# See docs/implementation/2026-05-29 for the full design.
+[ -n "$CLAUDE_FORGE_DISTILL_SPAWN" -o -n "$CLAUDE_FORGE_INTERNAL_SPAWN" ] && exit 0
 
 # shellcheck source=./hook-lib.sh
 source "$(dirname "$0")/hook-lib.sh"
@@ -9,15 +27,21 @@ AUTH_TOKEN=$(cat "$HOME/.claude-forge/daemon.token" 2>/dev/null || echo '')
 # 读取 stdin（Claude Code 传入的 JSON）
 INPUT=$(cat)
 
-# 提取字段（单次 jq 调用，替代 3 个 python3 进程）
-TOOL_NAME="${CLAUDE_TOOL_NAME:-$(echo "$INPUT" | jq -r '.tool_name // ""')}"
-TOOL_INPUT=$(echo "$INPUT" | jq -c '.tool_input // {}')
-RAW_CWD=$(echo "$INPUT" | jq -r '.cwd // ""')
-PROJECT_PATH=$(resolve_project_path "${RAW_CWD:-$PWD}")
-SESSION_ID=$(echo "$INPUT" | jq -r '.session_id // .sessionId // ""')
-SESSION_ID="${SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-cli}}"
+# (1/3) 一次性解析输入：标量 + tool_input JSON 串。@sh 输出的字符串已 shell-quote，
+# 可直接 eval 赋值；tool_input 用 tojson 序列化后再 eval 成字符串变量，
+# 后续作为 --argjson 注入回 jq -n 构建器。
+eval "$(echo "$INPUT" | jq -r '@sh "
+_IN_RAW_CWD=\(.cwd // "")
+_IN_SESSION=\(.session_id // .sessionId // "")
+_IN_TOOL=\(.tool_name // "")
+_IN_TOOL_INPUT_JSON=\((.tool_input // {}) | tojson)
+"')"
+
+TOOL_NAME="${CLAUDE_TOOL_NAME:-$_IN_TOOL}"
+PROJECT_PATH=$(resolve_project_path "${_IN_RAW_CWD:-$PWD}")
+SESSION_ID="${_IN_SESSION:-${CLAUDE_CODE_SESSION_ID:-cli}}"
 
-# 构造事件 JSON（jq -n 替代 python3 heredoc）
+# (2/3) 构造事件 JSON
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
 EVENT=$(jq -nc \
   --arg hook_type "PreToolUse" \
@@ -25,7 +49,7 @@ EVENT=$(jq -nc \
   --arg session_id "$SESSION_ID" \
   --arg project_path "$PROJECT_PATH" \
   --arg tool_name "$TOOL_NAME" \
-  --argjson tool_input "$TOOL_INPUT" \
+  --argjson tool_input "$_IN_TOOL_INPUT_JSON" \
   --arg auth "$AUTH_TOKEN" \
   '{hook_type: $hook_type, timestamp: $timestamp, session_id: $session_id,
     project_path: $project_path, tool_name: $tool_name, tool_input: $tool_input,
@@ -36,26 +60,33 @@ send_event_or_enqueue "$EVENT" 5
 RESPONSE="$HOOK_RESPONSE"
 
 if [ -n "$RESPONSE" ]; then
-  ALLOW=$(echo "$RESPONSE" | jq -r '.allow // true')
-
-  if [ "$ALLOW" = "false" ]; then
-    # 优先使用 hookSpecificOutput（Claude Code 官方格式），否则降级到 stderr + exit 2
-    HAS_HOOK_OUTPUT=$(echo "$RESPONSE" | jq -r 'if .hookSpecificOutput then "yes" else "no" end')
-    if [ "$HAS_HOOK_OUTPUT" = "yes" ]; then
-      # 输出 hookSpecificOutput 格式到 stdout，但必须 exit 非0 才能真正阻止工具执行
-      echo "$RESPONSE" | jq '{hookSpecificOutput: .hookSpecificOutput}'
+  # (3/3) 一次性解析 RESPONSE：allow / has_hook / has_ctx / reason
+  #       + 预渲染 hookSpecificOutput JSON 串（compact）。
+  # 注意：jq 的 `//` 运算符把 false 和 null 同视为"取后备"，所以
+  # `.allow // true` 在 .allow=false 时也返回 true —— 这是历史遗留问题，
+  # 保持与重构前完全一致的行为（safety-net 已固化）。
+  eval "$(echo "$RESPONSE" | jq -r '@sh "
+_R_ALLOW=\((.allow // true) | tostring)
+_R_HAS_HOOK=\(if .hookSpecificOutput then "yes" else "no" end)
+_R_HAS_CTX=\(if .additionalContext and (.additionalContext != "") then "yes" else "no" end)
+_R_REASON=\(.reason // "操作被 Forge 阻断")
+_R_HOOK_OUT_JSON=\((if .hookSpecificOutput then {hookSpecificOutput: .hookSpecificOutput} else null end) | tojson)
+"')"
+
+  if [ "$_R_ALLOW" = "false" ]; then
+    if [ "$_R_HAS_HOOK" = "yes" ]; then
+      # 输出 hookSpecificOutput 给 Claude Code（compact JSON 同样有效）
+      echo "$_R_HOOK_OUT_JSON"
       exit 1
     else
-      # 降级：输出原因到 stderr，exit 2 强制阻断
-      REASON=$(echo "$RESPONSE" | jq -r '.reason // "操作被 Forge 阻断"')
-      echo "$REASON" >&2
+      # 降级：原因到 stderr + exit 2
+      echo "$_R_REASON" >&2
       exit 2
     fi
   fi
 
-  # 有 additionalContext 时输出
-  HAS_CONTEXT=$(echo "$RESPONSE" | jq -r 'if .additionalContext and (.additionalContext != "") then "yes" else "no" end')
-  if [ "$HAS_CONTEXT" = "yes" ]; then
+  # 有 additionalContext 时把整个 RESPONSE 透传给 Claude Code
+  if [ "$_R_HAS_CTX" = "yes" ]; then
     echo "$RESPONSE"
   fi
 fi

package/dist/hooks/session-start.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Claude Forge - SessionStart Hook
+#
+# Triggered by Claude Code when a new session begins.
+# Runs `cf daemon ensure-running --quiet` in the background so the daemon
+# is always available when the user starts coding.
+#
+# Design:
+#   - Uses mkdir-based locking (POSIX-atomic, works on macOS without flock)
+#     to prevent race conditions when multiple Claude Code windows open simultaneously.
+#   - Uses `nohup ... &` to fully detach from this shell's process group.
+#   - All errors are swallowed (exit 0) to avoid disrupting the user.
+#   - Output: empty (no systemMessage / additionalContext injected here).
+
+# Internal-spawn guard — see pre-tool-use.sh for the full rationale. We must
+# short-circuit BEFORE the stdin swallow so we don't block waiting for an
+# event payload the spawned subprocess never sends.
+[ -n "$CLAUDE_FORGE_DISTILL_SPAWN" -o -n "$CLAUDE_FORGE_INTERNAL_SPAWN" ] && exit 0
+
+# Swallow stdin — we don't need the event payload for this hook.
+cat 2>/dev/null >/dev/null
+
+FORGE_DIR="$HOME/.claude-forge"
+LOCK_DIR="$FORGE_DIR/session-start.lock.d"
+
+# Ensure .claude-forge directory exists
+mkdir -p "$FORGE_DIR" 2>/dev/null || true
+
+# Locate the `cf` binary: prefer PATH, fall back to common install paths.
+CF_BIN=""
+if command -v cf >/dev/null 2>&1; then
+  CF_BIN="$(command -v cf)"
+elif command -v claude-forge >/dev/null 2>&1; then
+  CF_BIN="$(command -v claude-forge)"
+elif [ -x "$HOME/.npm-global/bin/cf" ]; then
+  CF_BIN="$HOME/.npm-global/bin/cf"
+elif [ -x "/usr/local/bin/cf" ]; then
+  CF_BIN="/usr/local/bin/cf"
+fi
+
+if [ -z "$CF_BIN" ]; then
+  # Can't find cf — skip silently
+  exit 0
+fi
+
+# Try atomic mkdir lock (POSIX: mkdir is atomic, returns 1 if already exists).
+# If we fail to acquire the lock, another session-start is already running — skip.
+if ! mkdir "$LOCK_DIR" 2>/dev/null; then
+  exit 0
+fi
+
+# Write a wrapper script to a temp file that runs ensure-running then removes lock.
+# This avoids any subprocess-wait issues with background jobs.
+TMP_SCRIPT=$(mktemp /tmp/forge-session-start-XXXXX.sh 2>/dev/null || echo '')
+if [ -n "$TMP_SCRIPT" ]; then
+  cat > "$TMP_SCRIPT" << WRAPPER_EOF
+#!/bin/sh
+"$CF_BIN" daemon ensure-running --quiet >/dev/null 2>&1 || true
+rmdir "$LOCK_DIR" 2>/dev/null || true
+rm -f "$TMP_SCRIPT" 2>/dev/null || true
+WRAPPER_EOF
+  chmod +x "$TMP_SCRIPT"
+  # nohup ensures the child is immune to SIGHUP; redirects close all inherited fds.
+  nohup /bin/sh "$TMP_SCRIPT" </dev/null >/dev/null 2>/dev/null &
+  # We're done — exit immediately without waiting for the child.
+fi
+
+exit 0

package/dist/hooks/stop.sh

@@ -1,5 +1,13 @@
 #!/usr/bin/env bash
 # Claude Forge - Stop Hook
+#
+# jq call budget (3 total — reduced from 5):
+#   1× parse INPUT scalars
+#   1× build EVENT
+#   1× parse RESPONSE (only when non-empty)
+
+# Internal-spawn guard — see pre-tool-use.sh for the full rationale.
+[ -n "$CLAUDE_FORGE_DISTILL_SPAWN" -o -n "$CLAUDE_FORGE_INTERNAL_SPAWN" ] && exit 0
 
 # shellcheck source=./hook-lib.sh
 source "$(dirname "$0")/hook-lib.sh"
@@ -9,13 +17,16 @@ AUTH_TOKEN=$(cat "$HOME/.claude-forge/daemon.token" 2>/dev/null || echo '')
 # 读取 stdin
 INPUT=$(cat 2>/dev/null || echo '{}')
 
-# 提取 cwd，上溯 git root
-RAW_CWD=$(echo "$INPUT" | jq -r '.cwd // ""')
-PROJECT_PATH=$(resolve_project_path "${RAW_CWD:-$PWD}")
-SESSION_ID=$(echo "$INPUT" | jq -r '.session_id // .sessionId // ""')
-SESSION_ID="${SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-cli}}"
+# (1/3) 一次性解析输入。
+eval "$(echo "$INPUT" | jq -r '@sh "
+_IN_RAW_CWD=\(.cwd // "")
+_IN_SESSION=\(.session_id // .sessionId // "")
+"')"
+
+PROJECT_PATH=$(resolve_project_path "${_IN_RAW_CWD:-$PWD}")
+SESSION_ID="${_IN_SESSION:-${CLAUDE_CODE_SESSION_ID:-cli}}"
 
-# 构造事件 JSON
+# (2/3) 构造事件 JSON
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
 EVENT=$(jq -nc \
   --arg hook_type "Stop" \
@@ -32,10 +43,13 @@ RESPONSE="$HOOK_RESPONSE"
 
 # 解析响应：allow=false 时输出 reason 并以 exit 2 阻断
 if [ -n "$RESPONSE" ]; then
-  ALLOW=$(echo "$RESPONSE" | jq -r '.allow // true' 2>/dev/null)
-  if [ "$ALLOW" = "false" ]; then
-    REASON=$(echo "$RESPONSE" | jq -r '.reason // "质量门禁阻断"' 2>/dev/null)
-    echo "$REASON"
+  # (3/3) 单次 jq 解析 allow + reason
+  eval "$(echo "$RESPONSE" | jq -r '@sh "
+_R_ALLOW=\((.allow // true) | tostring)
+_R_REASON=\(.reason // "质量门禁阻断")
+"')" 2>/dev/null
+  if [ "$_R_ALLOW" = "false" ]; then
+    echo "$_R_REASON"
     exit 2
   fi
 fi

package/dist/hooks/user-prompt-submit.sh

@@ -1,6 +1,15 @@
 #!/usr/bin/env bash
 # Claude Forge - UserPromptSubmit Hook
 # 拦截用户输入，触发意图分析和自动 Pipeline 编排
+#
+# jq call budget (3 total — reduced from 9):
+#   1× parse INPUT scalars (cwd, session, prompt) via @sh eval
+#   1× build EVENT JSON via jq -n
+#   1× parse RESPONSE: has_system / has_ctx / sm_length / first-3-lines-ctx
+#       all in one shot
+
+# Internal-spawn guard — see pre-tool-use.sh for the full rationale.
+[ -n "$CLAUDE_FORGE_DISTILL_SPAWN" -o -n "$CLAUDE_FORGE_INTERNAL_SPAWN" ] && exit 0
 
 # shellcheck source=./hook-lib.sh
 source "$(dirname "$0")/hook-lib.sh"
@@ -10,19 +19,23 @@ AUTH_TOKEN=$(cat "$HOME/.claude-forge/daemon.token" 2>/dev/null || echo '')
 # 读取 stdin（Claude Code 传入的 JSON）
 INPUT=$(cat)
 
-# 提取字段（jq 替代 python3）
-USER_PROMPT=$(echo "$INPUT" | jq -r '.prompt // ""')
-RAW_CWD=$(echo "$INPUT" | jq -r '.cwd // ""')
-PROJECT_PATH=$(resolve_project_path "${RAW_CWD:-$PWD}")
-SESSION_ID=$(echo "$INPUT" | jq -r '.session_id // .sessionId // ""')
-SESSION_ID="${SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-cli}}"
+# (1/3) 一次性解析输入。
+eval "$(echo "$INPUT" | jq -r '@sh "
+_IN_RAW_CWD=\(.cwd // "")
+_IN_SESSION=\(.session_id // .sessionId // "")
+_IN_PROMPT=\(.prompt // "")
+"')"
+
+USER_PROMPT="$_IN_PROMPT"
+PROJECT_PATH=$(resolve_project_path "${_IN_RAW_CWD:-$PWD}")
+SESSION_ID="${_IN_SESSION:-${CLAUDE_CODE_SESSION_ID:-cli}}"
 
 # 空 prompt 跳过
 if [ -z "$USER_PROMPT" ]; then
   exit 0
 fi
 
-# 构造事件 JSON（jq -n 替代 python3 heredoc）
+# (2/3) 构造事件 JSON
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
 EVENT=$(jq -nc \
   --arg hook_type "UserPromptSubmit" \
@@ -39,26 +52,29 @@ if [ -z "$EVENT" ]; then
   exit 0
 fi
 
-# 发送事件（10 秒超时，AI 分析可能需要更多时间）
-# 失败时自动入队（daemon 停机期间事件不丢失）
+# 发送事件（10 秒超时，AI 分析可能需要更多时间；失败时入队）
 send_event_or_enqueue "$EVENT" 10
 RESPONSE="$HOOK_RESPONSE"
 
 if [ -n "$RESPONSE" ]; then
-  HAS_SYSTEM=$(echo "$RESPONSE" | jq -r 'if .systemMessage and (.systemMessage != "") then "yes" else "no" end')
-  HAS_CONTEXT=$(echo "$RESPONSE" | jq -r 'if .additionalContext and (.additionalContext != "") then "yes" else "no" end')
+  # (3/3) 一次性解析 RESPONSE。
+  # `_R_CTX_HEAD3` 取 additionalContext 的前 3 行（原脚本 `printf '%s' "$CTX" | head -3`
+  # 等价的 jq 实现：split + 切片 + join）。
+  eval "$(echo "$RESPONSE" | jq -r '@sh "
+_R_HAS_SYSTEM=\(if .systemMessage and (.systemMessage != "") then "yes" else "no" end)
+_R_HAS_CTX=\(if .additionalContext and (.additionalContext != "") then "yes" else "no" end)
+_R_SM_LEN=\((.systemMessage // "") | length | tostring)
+_R_CTX_HEAD3=\((.additionalContext // "") | split("\n") | .[0:3] | join("\n"))
+"')"
 
-  if [ "$HAS_SYSTEM" = "yes" ] || [ "$HAS_CONTEXT" = "yes" ]; then
-    # stderr 输出摘要到终端
-    if [ "$HAS_SYSTEM" = "yes" ]; then
-      SM_LEN=$(echo "$RESPONSE" | jq -r '.systemMessage | length')
-      printf '\033[36m💉 [Forge] 注入 systemMessage (%s chars)\033[0m\n' "$SM_LEN" >&2
+  if [ "$_R_HAS_SYSTEM" = "yes" ] || [ "$_R_HAS_CTX" = "yes" ]; then
+    # stderr 摘要
+    if [ "$_R_HAS_SYSTEM" = "yes" ]; then
+      printf '\033[36m💉 [Forge] 注入 systemMessage (%s chars)\033[0m\n' "$_R_SM_LEN" >&2
     fi
-    if [ "$HAS_CONTEXT" = "yes" ]; then
-      CONTEXT=$(echo "$RESPONSE" | jq -r '.additionalContext // ""')
-      DISPLAY_LINES=$(printf '%s' "$CONTEXT" | head -3)
-      if [ -n "$DISPLAY_LINES" ]; then
-        printf '\033[36m💉 [Forge] %s\033[0m\n' "$DISPLAY_LINES" >&2
+    if [ "$_R_HAS_CTX" = "yes" ]; then
+      if [ -n "$_R_CTX_HEAD3" ]; then
+        printf '\033[36m💉 [Forge] %s\033[0m\n' "$_R_CTX_HEAD3" >&2
       fi
     fi
     # stdout 返回给 Claude Code

package/dist/knowledge/adapters/go-adapter.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @file adapters/go-adapter.ts
+ * v10.3 — Go adapter (cmd/pkg layout support).
+ *
+ * Uses tree-sitter-go for AST parsing. Native module dependency is declared
+ * as optionalDependencies in package.json; if installation fails, parseSymbols
+ * throws a friendly error.
+ *
+ * Supports:
+ * - Standard Go project layout (cmd/<app>/ and pkg/<lib>/)
+ * - Single-module projects (all .go files at root)
+ * - go.mod detection
+ *
+ * Module discovery:
+ * - If cmd/ or pkg/ exist: each subdirectory becomes a module
+ * - Otherwise: single 'root' module
+ *
+ * Limitations (v10.3):
+ * - Does NOT parse go.mod for module path
+ * - Method signatures simplified (no parameter types extracted)
+ * - Generics/complex AST nodes may be skipped
+ */
+import type { LanguageAdapter, ModuleInfo, SourceFile } from './types.js';
+import type { RepoMapSymbol } from '../types.js';
+export declare class GoAdapter implements LanguageAdapter {
+    readonly name = "go";
+    readonly fileExtensions: readonly [".go"];
+    /**
+     * Project is Go iff it has go.mod.
+     */
+    detect(projectRoot: string): boolean;
+    /**
+     * Discover source roots.
+     * For Go, the entire repository is the source root (excluding vendor/).
+     */
+    discoverSourceRoots(projectRoot: string): string[];
+    /**
+     * Discover Go modules.
+     * Strategy:
+     * 1. If cmd/ exists: each cmd/<app>/ is a module
+     * 2. If pkg/ exists: each pkg/<lib>/ is a module
+     * 3. Otherwise: single 'root' module at project root
+     */
+    discoverModules(projectRoot: string): ModuleInfo[];
+    /**
+     * Recursively walk module root, collecting .go files.
+     * Excludes: vendor/, _test.go, hidden dirs, .git
+     */
+    walkModuleFiles(module: ModuleInfo): Promise<SourceFile[]>;
+    /**
+     * Extract symbols from Go source using tree-sitter-go.
+     * Lazy-imports tree-sitter to avoid breaking the entire adapter when native
+     * module installation fails.
+     */
+    parseSymbols(file: SourceFile): Promise<RepoMapSymbol[]>;
+    /**
+     * Describe project metadata files.
+     * Returns go.mod as manifestPath and no config paths.
+     */
+    describeProjectMeta(projectRoot: string): {
+        manifestPath: string | null;
+        configPaths: string[];
+    };
+}
+//# sourceMappingURL=go-adapter.d.ts.map

package/dist/knowledge/adapters/go-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"go-adapter.d.ts","sourceRoot":"","sources":["../../../src/knowledge/adapters/go-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AASjD,qBAAa,SAAU,YAAW,eAAe;IAC/C,QAAQ,CAAC,IAAI,QAAQ;IACrB,QAAQ,CAAC,cAAc,mBAAoB;IAE3C;;OAEG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAIpC;;;OAGG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE;IAIlD;;;;;;OAMG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,EAAE;IAsDlD;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAmChE;;;;OAIG;IACG,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA6J9D;;;OAGG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE;CAMjG"}