@yagni-app/code-staging 1.0.9-staging.1301.1 → 1.0.9-staging.1320.1

package/dist/extension/hooks.d.ts

@@ -6,8 +6,8 @@
  * at lifecycle events. The config format mirrors Claude Code's `settings.json`
  * hooks shape so a user can copy-paste between them.
  *
- * Supported events (8): SessionStart, UserPromptSubmit, PreToolUse,
- * PostToolUse, PermissionRequest, PreCompact, PostCompact, SessionEnd.
+ * Supported events (9): SessionStart, UserPromptSubmit, PreToolUse,
+ * PostToolUse, PermissionRequest, PreCompact, PostCompact, SessionEnd, Stop.
  *
  * Exit code semantics (matching Claude Code / Codex):
  *   0   = success; stdout parsed as JSON for structured decisions
@@ -32,7 +32,7 @@ export interface HookGroup {
 /** The hooks section of config.json. */
 export type HooksConfig = Record<string, HookGroup[]>;
 /** Supported Claude Code event names. */
-export type HookEventName = "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "PermissionRequest" | "PreCompact" | "PostCompact" | "SessionEnd";
+export type HookEventName = "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "PermissionRequest" | "PreCompact" | "PostCompact" | "SessionEnd" | "Stop";
 declare const SUPPORTED_EVENTS: readonly HookEventName[];
 /** Result of a PreToolUse hook evaluation. */
 export type PreToolUseHookResult = {
@@ -82,6 +82,16 @@ export declare function parsePermissionRequestOutput(stdout: string): Permission
 export declare function parseAdditionalContext(stdout: string): string | null;
 /** Check if stdout JSON has continue: false (for PreCompact cancellation). */
 export declare function parseCompactCancel(stdout: string): boolean;
+/**
+ * A short upload-safe label for a hook-exec exception, for the always-on
+ * trail line. Tiers, in order: a Node error code ("ENOENT", "ETIMEDOUT"),
+ * the message's first token (a machine word like "spawn"), the constructor
+ * name, and typeof for non-Error throws (execImpl is an injected seam —
+ * a string throw is possible). Message-derived tiers are scrubbed — a
+ * message can begin with content (a credentials URL), and this label rides
+ * the default-on (upload-safe) tier.
+ */
+export declare function hookErrorLabel(err: unknown): string;
 interface HookExecutorOptions {
     config: HooksConfig;
     env?: NodeJS.ProcessEnv;

package/dist/extension/hooks.js

@@ -6,8 +6,8 @@
  * at lifecycle events. The config format mirrors Claude Code's `settings.json`
  * hooks shape so a user can copy-paste between them.
  *
- * Supported events (8): SessionStart, UserPromptSubmit, PreToolUse,
- * PostToolUse, PermissionRequest, PreCompact, PostCompact, SessionEnd.
+ * Supported events (9): SessionStart, UserPromptSubmit, PreToolUse,
+ * PostToolUse, PermissionRequest, PreCompact, PostCompact, SessionEnd, Stop.
  *
  * Exit code semantics (matching Claude Code / Codex):
  *   0   = success; stdout parsed as JSON for structured decisions
@@ -21,8 +21,10 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { codeStateHome } from "./stateHome.js";
+import { isDriverCaller } from "./config.js";
 import { isDebug } from "./diagnostics.js";
 import { logEvent } from "./errorSink.js";
+import { scrubSecrets } from "./pipeline/scrubSecrets.js";
 const SUPPORTED_EVENTS = [
     "SessionStart",
     "UserPromptSubmit",
@@ -32,6 +34,7 @@ const SUPPORTED_EVENTS = [
     "PreCompact",
     "PostCompact",
     "SessionEnd",
+    "Stop",
 ];
 // ---------------------------------------------------------------------------
 // Config loading
@@ -301,8 +304,72 @@ export function parseCompactCancel(stdout) {
     return parsed.continue === false;
 }
 // ---------------------------------------------------------------------------
+// Stop capture
+// ---------------------------------------------------------------------------
+/**
+ * Extract the last assistant message's text and stopReason from an
+ * agent_end event. Walks backwards (the shape cmux/state.ts walks forwards)
+ * so an aborted final turn with no text still reports its stopReason —
+ * the reason is what decides whether Stop hooks fire at all.
+ */
+function lastAssistantInfo(event) {
+    const messages = event?.messages;
+    if (!Array.isArray(messages))
+        return undefined;
+    for (let index = messages.length - 1; index >= 0; index -= 1) {
+        const message = messages[index];
+        if (!message || typeof message !== "object")
+            continue;
+        const typed = message;
+        if (typed.role !== "assistant")
+            continue;
+        const text = typeof typed.content === "string"
+            ? typed.content.trim() || undefined
+            : textFromBlocks(typed.content);
+        return { text, stopReason: typeof typed.stopReason === "string" ? typed.stopReason : undefined };
+    }
+    return undefined;
+}
+/** Join text blocks from a content array (mirrors cmux's textFromContent). */
+function textFromBlocks(content) {
+    if (!Array.isArray(content))
+        return undefined;
+    const parts = [];
+    for (const block of content) {
+        if (!block || typeof block !== "object")
+            continue;
+        const typed = block;
+        if (typed.type === "text" && typeof typed.text === "string" && typed.text.trim()) {
+            parts.push(typed.text);
+        }
+    }
+    return parts.join("\n") || undefined;
+}
+// ---------------------------------------------------------------------------
 // Diagnostic logging
 // ---------------------------------------------------------------------------
+/**
+ * A short upload-safe label for a hook-exec exception, for the always-on
+ * trail line. Tiers, in order: a Node error code ("ENOENT", "ETIMEDOUT"),
+ * the message's first token (a machine word like "spawn"), the constructor
+ * name, and typeof for non-Error throws (execImpl is an injected seam —
+ * a string throw is possible). Message-derived tiers are scrubbed — a
+ * message can begin with content (a credentials URL), and this label rides
+ * the default-on (upload-safe) tier.
+ */
+export function hookErrorLabel(err) {
+    const code = err?.code;
+    // Scrub BEFORE slicing: a secret-shaped value longer than the 40-char cap
+    // would be split first and the fragment could match no pattern.
+    if (typeof code === "string" && code)
+        return scrubSecrets(code).slice(0, 40);
+    if (err instanceof Error) {
+        if (err.message)
+            return scrubSecrets(err.message.split(/[\s:]+/)[0]).slice(0, 40);
+        return err.constructor.name;
+    }
+    return typeof err;
+}
 function logHookEvent(env, payload) {
     if (!isDebug(env))
         return;
@@ -656,6 +723,64 @@ export function registerHooks(pi, deps = {}) {
             }
         });
     }
+    // --- Stop (agent finished responding; driver turn complete) ---
+    // Two-phase capture, mirroring the cmux bridge: agent_settled carries no
+    // payload, so the last assistant message is captured at agent_end and
+    // consumed at settled. Firing is VOID, not awaited — pi awaits settled
+    // handlers before unblocking the TUI's prompt loop and RPC waitForIdle,
+    // so an awaited hook would keep a finished session looking busy for up
+    // to the full hook timeout.
+    const stopGroups = config["Stop"] ?? [];
+    if (stopGroups.length > 0 && isDriverCaller(env)) {
+        let pendingStop;
+        pi.on("agent_end", (event) => {
+            pendingStop = lastAssistantInfo(event);
+        });
+        pi.on("agent_settled", (_event, ctx) => {
+            // hasUI is fixed per session — checking it first keeps the capture
+            // consume order-independent (a headless session simply never fires).
+            if (!ctx.hasUI)
+                return;
+            const captured = pendingStop;
+            if (!captured)
+                return;
+            // Mid-retry/compaction/continuation settles are not the turn's end —
+            // pi sets isIdle only once no automatic follow-up work will run. The
+            // capture is NOT consumed here: a settle that isn't idle leaves it for
+            // the genuine end-of-turn settle (an agent_end between the two
+            // overwrites it with the continuation's own final message).
+            try {
+                if (!ctx.isIdle())
+                    return;
+            }
+            catch {
+                return;
+            }
+            pendingStop = undefined;
+            // Claude Code parity: its query loop returns before running Stop hooks
+            // when the user aborted or the model errored — "finished, your move"
+            // would be a lie for a killed turn. Retry/continuation agent_ends
+            // overwrite the capture, so an error followed by a successful retry
+            // still fires (with the retry's message).
+            if (captured.stopReason === "aborted" || captured.stopReason === "error")
+                return;
+            const cwd = ctx.cwd;
+            const inputJson = JSON.stringify({
+                session_id: sessionId,
+                cwd,
+                hook_event_name: "Stop",
+                stop_hook_active: false,
+                ...(captured.text ? { last_assistant_message: captured.text } : {}),
+            });
+            void (async () => {
+                for (const group of filterByTrust(stopGroups, trusted(ctx))) {
+                    for (const entry of group.hooks) {
+                        await runSideEffectHook(entry.command, inputJson, cwd, "Stop", ctx, env, execImpl);
+                    }
+                }
+            })();
+        });
+    }
 }
 /** Run a side-effect-only hook (no control effects, output ignored). */
 async function runSideEffectHook(command, inputJson, cwd, eventName, ctx, env, execImpl) {
@@ -665,6 +790,13 @@ async function runSideEffectHook(command, inputJson, cwd, eventName, ctx, env, e
             YAGNI_HOOK_CWD: cwd,
             YAGNI_HOOK_SESSION_ID: env.YAGNI_SESSION_ID ?? "",
         });
+        const failed = !!result.error || (result.exitCode !== 0 && result.exitCode !== null);
+        // One outcome, two tiers: the debug line carries the full detail
+        // (stderr, timing) and is YAGNI_DEBUG-gated; the warn line is always-on
+        // and upload-safe, so "hook fired and failed" is distinguishable from
+        // "hook never fired" in a default session. The command rides the warn
+        // line scrubbed (below) so N hooks on one event produce distinguishable
+        // lines without leaking anything the user embedded in the command.
         logHookEvent(env, {
             event: eventName,
             command,
@@ -674,14 +806,47 @@ async function runSideEffectHook(command, inputJson, cwd, eventName, ctx, env, e
             ...(result.error ? { error: result.error } : {}),
             ...(result.stderr.trim() ? { stderr: result.stderr.trim().slice(0, 512) } : {}),
         });
-        if (result.error || (result.exitCode !== 0 && result.exitCode !== null)) {
+        if (failed) {
+            logEvent({
+                source: "hooks",
+                level: "warn",
+                event: "hook_failed",
+                sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                fields: {
+                    event_name: eventName,
+                    // Scrubbed at write time: the trail file stores lines raw (scrubbing
+                    // otherwise happens only at readSessionTrail), and a user's hook
+                    // command can embed secrets inline (curl -H "Authorization: Bearer …").
+                    // The full, unscrubbed command stays on the YAGNI_DEBUG tier.
+                    command: scrubSecrets(command).slice(0, 80),
+                    exit_code: result.exitCode,
+                    // Scrub the whole error string before taking the first colon token —
+                    // result.error embeds a raw err.message (spawn failed/err paths in
+                    // execHook), and the sibling hookErrorLabel path scrubs message-derived
+                    // tiers the same way.
+                    ...(result.error ? { error: scrubSecrets(result.error).split(":")[0] } : {}),
+                },
+            });
             if (ctx.hasUI && result.stderr.trim()) {
                 ctx.ui.notify(`Hook '${eventName}' exited with code ${result.exitCode}: ${result.stderr.trim().slice(0, 200)}`, "warning");
             }
         }
     }
-    catch {
-        // Fail-soft: a hook error never breaks the session
+    catch (err) {
+        // Fail-soft: a hook error never breaks the session — but never silent.
+        // The label distinguishes "spawn ENOENT" from a timeout (see
+        // hookErrorLabel); the command is scrubbed like the sibling path's.
+        logEvent({
+            source: "hooks",
+            level: "warn",
+            event: "hook_exec_threw",
+            sessionId: env.YAGNI_SESSION_ID ?? undefined,
+            fields: {
+                event_name: eventName,
+                command: scrubSecrets(command).slice(0, 80),
+                error: hookErrorLabel(err),
+            },
+        });
     }
 }
 // ---------------------------------------------------------------------------

package/dist/extension/pipeline/scrubSecrets.js

@@ -22,6 +22,11 @@ const PATTERNS = [
     [/\b([A-Za-z0-9_]*(?:secret|password|passwd|api[_-]?key|token|private[_-]?key|access[_-]?key)[A-Za-z0-9_]*)\b(\s*[:=]\s*)("[^"]+"|'[^']+'|`[^`]+`|[^\s"']+)/gi, "$1$2[REDACTED]"],
     // Long base64-ish blobs (likely keys/JWTs)
     [/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, "[REDACTED]"],
+    // Opaque bearer tokens in Authorization headers: no provider prefix, no
+    // secret-named key, and usually under the base64 length threshold — none of
+    // the patterns above catch them. Keep the scheme, redact the token. Header
+    // names and auth schemes are case-insensitive (RFC 9110) — hence the flag.
+    [/(\bauthorization\s*[:=]\s*["']?bearer\s+)([a-z0-9._~+/=-]+)/gi, "$1[REDACTED]"],
 ];
 export function scrubSecrets(text) {
     let out = text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.0.9-staging.1301.1",
+  "version": "1.0.9-staging.1320.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "2d51041ec00bbf091fa349e5c0a199cf52d4fe1e"
+  "yagniSourceSha": "957fbf97db7f25d2f34ef4b2e1e443670a4c180f"
 }