ashlr-plugin 1.36.4 → 1.37.1

package/scripts/hook-bootstrap.mjs

@@ -27,11 +27,22 @@
  * Usage (wired from hooks/hooks.json):
  *   node "${CODEX_PLUGIN_ROOT}/scripts/hook-bootstrap.mjs" \
  *        "${CODEX_PLUGIN_ROOT}/hooks/<hook>.ts" [args...]
+ *
+ * Group mode runs several hooks for one event from a single node process:
+ *   node hook-bootstrap.mjs --group [--match <tools>] <hook>.ts [--match <tools>] <hook>.ts ...
+ * `--match` takes a Claude Code matcher (`Read|Grep`) and applies to the next
+ * hook only; a hook without one always runs. Each hook still runs as its own
+ * `bun run` process, in parallel, with the same stdin. Their outputs are
+ * merged: `additionalContext` strings are joined, plain-text output is kept,
+ * and exit code 2 from any hook wins. Starting node once per event instead of
+ * once per hook is what saves the time.
  */
 
-import { spawnSync } from "node:child_process";
-import { hasBun, prependBunToPath } from "./bun-resolve.mjs";
+import { spawn, spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { prependBunToPath } from "./bun-resolve.mjs";
 
+const groupMode = process.argv[2] === "--group";
 const hookPath = process.argv[2];
 if (!hookPath) {
   process.stderr.write("[ashlr:hook-bootstrap] missing hook path argument\n");
@@ -42,6 +53,10 @@ const looksLikeCodexPluginHook =
   Boolean(process.env.CODEX_PLUGIN_ROOT) ||
   Boolean(process.env.ASHLR_CODEX_HOOK_MODE) ||
   (Boolean(process.env.CLAUDE_PLUGIN_ROOT) &&
+    // Claude Code sets CLAUDECODE=1 for its child processes but neither of
+    // the two variables below, so without this check every Claude Code hook
+    // ran in Codex nudge mode and suggested bare `ashlr__*` tool names.
+    !process.env.CLAUDECODE &&
     !process.env.CLAUDE_SESSION_ID &&
     !process.env.CLAUDE_CODE_MODEL);
 
@@ -52,24 +67,162 @@ if (process.env.ASHLR_MCP_HOST === "codex-cli" && !process.env.ASHLR_HOOK_MODE)
   process.env.ASHLR_HOOK_MODE = process.env.ASHLR_CODEX_HOOK_MODE || "nudge";
 }
 
-if (!hasBun()) {
-  prependBunToPath();
-  if (!hasBun()) {
-    // Bun genuinely unreachable. Exit 0 — hooks must never fail the harness.
-    // The MCP server's bootstrap.mjs will install bun on its next spawn if it
-    // hasn't already; this hook simply no-ops for now.
+/** True when the error means the `bun` executable was not found. */
+function bunMissing(error) {
+  return Boolean(error) && error.code === "ENOENT";
+}
+
+if (groupMode) {
+  await runGroup(process.argv.slice(3));
+} else {
+  runSingle();
+}
+
+function runSingle() {
+  const forwarded = process.argv.slice(3);
+  const run = () => spawnSync("bun", ["run", hookPath, ...forwarded], { stdio: "inherit", env: process.env });
+  let result = run();
+  if (bunMissing(result.error)) {
+    // Not on PATH: try ~/.bun/bin (a prior bootstrap.mjs install). If bun is
+    // still unreachable, exit 0. Hooks must never fail the harness; the MCP
+    // server's bootstrap.mjs installs bun on its next spawn.
+    prependBunToPath();
+    result = run();
+    if (bunMissing(result.error)) process.exit(0);
+  }
+  if (result.error) {
+    process.stderr.write(`[ashlr:hook-bootstrap] ${result.error.message}\n`);
     process.exit(0);
   }
+  process.exit(result.status ?? 0);
 }
 
-const forwarded = process.argv.slice(3);
-const result = spawnSync("bun", ["run", hookPath, ...forwarded], {
-  stdio: "inherit",
-  env: process.env,
-});
+/** Claude Code matcher semantics: empty or `*` matches all, else a regex over the whole tool name. */
+function matches(matcher, toolName) {
+  if (!matcher || matcher === "*") return true;
+  if (!toolName) return true;
+  try {
+    return new RegExp(`^(?:${matcher})$`).test(toolName);
+  } catch {
+    return matcher === toolName;
+  }
+}
+
+function parseGroup(args) {
+  const hooks = [];
+  let matcher = null;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--match") {
+      matcher = args[++i] ?? null;
+      continue;
+    }
+    hooks.push({ path: args[i], matcher });
+    matcher = null;
+  }
+  return hooks;
+}
 
-if (result.error) {
-  process.stderr.write(`[ashlr:hook-bootstrap] ${result.error.message}\n`);
-  process.exit(0);
+function runHook(path, input) {
+  return new Promise((resolveRun) => {
+    let child;
+    try {
+      child = spawn("bun", ["run", path], { stdio: ["pipe", "pipe", "pipe"], env: process.env });
+    } catch (error) {
+      resolveRun({ error, status: 0, stdout: "", stderr: "" });
+      return;
+    }
+    const out = [];
+    const err = [];
+    child.stdout.on("data", (c) => out.push(c));
+    child.stderr.on("data", (c) => err.push(c));
+    child.on("error", (error) => resolveRun({ error, status: 0, stdout: "", stderr: "" }));
+    child.on("close", (status) =>
+      resolveRun({
+        error: null,
+        status: status ?? 0,
+        stdout: Buffer.concat(out).toString("utf8"),
+        stderr: Buffer.concat(err).toString("utf8"),
+      }),
+    );
+    child.stdin.on("error", () => {}); // a hook that exits without reading stdin
+    child.stdin.end(input);
+  });
+}
+
+async function runGroup(args) {
+  let input = Buffer.alloc(0);
+  try {
+    input = readFileSync(0);
+  } catch {
+    // No stdin (manual run): hooks get an empty payload.
+  }
+  let payload = {};
+  try {
+    payload = JSON.parse(input.toString("utf8") || "{}");
+  } catch {
+    // Unparseable payload: run every hook and let each decide.
+  }
+  const toolName = typeof payload.tool_name === "string" ? payload.tool_name : "";
+  const event = typeof payload.hook_event_name === "string" ? payload.hook_event_name : "";
+  const selected = parseGroup(args).filter((h) => matches(h.matcher, toolName));
+  if (selected.length === 0) process.exit(0);
+
+  let results = await Promise.all(selected.map((h) => runHook(h.path, input)));
+  if (results.some((r) => bunMissing(r.error))) {
+    prependBunToPath();
+    results = await Promise.all(selected.map((h) => runHook(h.path, input)));
+    if (results.some((r) => bunMissing(r.error))) process.exit(0);
+  }
+
+  const contexts = [];
+  const plain = [];
+  let merged = null;
+  let blocking = null;
+  let failure = 0;
+  for (const r of results) {
+    if (r.stderr) process.stderr.write(r.stderr);
+    if (r.error) {
+      process.stderr.write(`[ashlr:hook-bootstrap] ${r.error.message}\n`);
+      continue;
+    }
+    if (r.status === 2 && blocking === null) blocking = r;
+    else if (r.status !== 0 && failure === 0) failure = r.status;
+    const text = r.stdout.trim();
+    if (!text) continue;
+    let parsed = null;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      // Plain-text output.
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      plain.push(text);
+      continue;
+    }
+    const { hookSpecificOutput, ...rest } = parsed;
+    merged = { ...(merged ?? {}), ...rest };
+    if (hookSpecificOutput && typeof hookSpecificOutput.additionalContext === "string" && hookSpecificOutput.additionalContext) {
+      contexts.push(hookSpecificOutput.additionalContext);
+    }
+    if (hookSpecificOutput && !event && typeof hookSpecificOutput.hookEventName === "string") {
+      merged.__event = hookSpecificOutput.hookEventName;
+    }
+  }
+
+  if (blocking) process.exit(2);
+
+  if (merged === null && contexts.length === 0) {
+    // Every hook printed plain text (or nothing): keep it as plain text.
+    if (plain.length > 0) process.stdout.write(plain.join("\n\n") + "\n");
+    process.exit(failure);
+  }
+  const { __event, ...top } = merged ?? {};
+  // Mixed output: plain text joins the JSON's context so nothing is lost.
+  const allContext = [...contexts, ...plain];
+  const output = { ...top };
+  if (allContext.length > 0) {
+    output.hookSpecificOutput = { hookEventName: event || __event, additionalContext: allContext.join("\n\n") };
+  }
+  process.stdout.write(JSON.stringify(output));
+  process.exit(failure);
 }
-process.exit(result.status ?? 0);

package/scripts/mcp-entrypoint.ts

@@ -27,6 +27,9 @@ import { fileURLToPath } from "node:url";
 
 const __filename = fileURLToPath(import.meta.url);
 const PLUGIN_ROOT = resolve(dirname(__filename), "..");
+// Record the folder the host launched us in (the user's project) before
+// moving to PLUGIN_ROOT; the router adopts it once dependencies resolve.
+process.env.ASHLR_LAUNCH_CWD ||= process.cwd();
 process.chdir(PLUGIN_ROOT);
 
 // 1. Self-install deps if missing. Idempotent — `bun install` is a no-op once

package/scripts/ollama-setup.ts

@@ -22,6 +22,7 @@
 /* eslint-disable no-console */
 
 import { spawn } from "bun";
+import { DEFAULT_OLLAMA_BASE_URL, ollamaBaseUrl } from "../servers/_base-urls.ts";
 
 // ---------------------------------------------------------------------------
 // Colored output (zero deps, respects NO_COLOR / FORCE_COLOR / !isTTY)
@@ -79,7 +80,7 @@ function printFix(cmd: string): void {
 // Types + constants
 // ---------------------------------------------------------------------------
 
-export const OLLAMA_BASE_URL = "http://localhost:11434";
+export const OLLAMA_BASE_URL = DEFAULT_OLLAMA_BASE_URL;
 const TAGS_TIMEOUT_MS = 3000;
 const SMOKE_TIMEOUT_MS = 30000;
 
@@ -192,7 +193,7 @@ export interface TagsResult {
 
 /** Fetch /api/tags. Returns `running: false` if the daemon is unreachable. */
 export async function fetchTags(
-  baseUrl = OLLAMA_BASE_URL,
+  baseUrl = ollamaBaseUrl(),
   timeoutMs = TAGS_TIMEOUT_MS,
   fetchImpl: typeof fetch = fetch,
 ): Promise<TagsResult> {
@@ -241,7 +242,7 @@ export interface SmokeTestResult {
  */
 export async function smokeTest(
   model: string,
-  baseUrl = OLLAMA_BASE_URL,
+  baseUrl = ollamaBaseUrl(),
   timeoutMs = SMOKE_TIMEOUT_MS,
   fetchImpl: typeof fetch = fetch,
 ): Promise<SmokeTestResult> {
@@ -368,7 +369,7 @@ export async function run(args: CliArgs): Promise<number> {
   if (!tags.running) {
     printOk("Ollama CLI found on PATH");
     printFail(
-      `Ollama daemon not reachable at ${OLLAMA_BASE_URL}${tags.error ? ` (${tags.error})` : ""}`,
+      `Ollama daemon not reachable at ${ollamaBaseUrl()}${tags.error ? ` (${tags.error})` : ""}`,
     );
     console.log("");
     for (const l of startInstructions()) console.log(`  ${l}`);

package/scripts/run-benchmark.ts

@@ -14,9 +14,11 @@
  * ashlr__edit by calling the handler functions directly — no MCP layer.
  */
 
+import { describePhantomExec, detectPhantomExec, providerKeyUsable } from "../servers/_phantom-exec.ts";
 import { readFileSync, writeFileSync, existsSync } from "fs";
 import { resolve, relative } from "path";
 import { spawnSync } from "child_process";
+import { rgTextArgs, truncateRgText } from "../servers/_rg-text";
 
 import {
   estimateTokensFromString,
@@ -345,10 +347,11 @@ function resolveRg(): string {
 function measureGrep(pattern: string, repoPath: string): GrepSample | null {
   try {
     const rgBin = resolveRg();
-    const res = spawnSync(rgBin, ["--json", "-n", "--", pattern, repoPath], {
+    // Baseline: what a plain grep returns (`path:line:text`, no column cap).
+    const res = spawnSync(rgBin, ["-n", "--no-heading", "--color", "never", "--", pattern, repoPath], {
       encoding: "utf-8",
       timeout: 15_000,
-      maxBuffer: 32 * 1024 * 1024,
+      maxBuffer: 64 * 1024 * 1024,
     });
     const raw = res.stdout ?? "";
     if (!raw.trim()) return null;
@@ -356,11 +359,13 @@ function measureGrep(pattern: string, repoPath: string): GrepSample | null {
     const rawBytes = Buffer.byteLength(raw, "utf-8");
     const rawTokens = estimateTokensFromString(raw);
 
-    // Replicate rg-fallback path in ashlrGrep: truncate to 4000 chars head+tail
-    const truncated =
-      raw.length > 4000
-        ? raw.slice(0, 2000) + "\n\n[... truncated ...]\n\n" + raw.slice(-1000)
-        : raw;
+    // Replicate the rg-fallback path in ashlrGrep (servers/_rg-text.ts).
+    const ashlrRes = spawnSync(rgBin, rgTextArgs(pattern, repoPath), {
+      encoding: "utf-8",
+      timeout: 15_000,
+      maxBuffer: 64 * 1024 * 1024,
+    });
+    const truncated = truncateRgText(ashlrRes.stdout ?? "");
 
     const ashlrBytes = Buffer.byteLength(truncated, "utf-8");
     const ashlrTokens = estimateTokensFromString(truncated);
@@ -402,13 +407,10 @@ function summarizeEditForBench(
   replace: string,
   fileSize: number,
 ): string {
-  // Replicate the summarizeEdit output from efficiency-server.ts
-  const first = (s: string) => s.split("\n")[0]?.slice(0, 72) ?? "";
-  return [
-    `[ashlr__edit] file.ts  ·  1 of 1 hunks applied`,
-    `  - removed (${estimateTokensFromString(search)} tok):  ${first(search)}${search.length > 72 ? "…" : ""}`,
-    `  + added   (${estimateTokensFromString(replace)} tok):  ${first(replace)}${replace.length > 72 ? "…" : ""}`,
-  ].join("\n");
+  // Mirrors servers/edit-server.ts: an exact, unique match (every benchmark edit
+  // is one) returns the header only, because the caller already has the text it sent.
+  void search; void replace; void fileSize;
+  return `[ashlr__edit] file.ts  ·  1 of 1 hunks applied`;
 }
 
 function measureEdit(size: EditSize): EditSample {
@@ -548,9 +550,10 @@ size buckets (2–5 KB, 5–15 KB, 15–50 KB, 50+ KB). Re-running on the same
 commit always picks the same files.
 
 **ashlr__grep**: Five common patterns (function, import, TODO, class, interface)
-are run via rg --json against the repo root. Raw output bytes are measured
-directly. The ashlr__grep fallback path (no genome) truncates output to 4 000
-chars (head 2 000 + tail 1 000). The ratio is truncated/raw.
+are run via plain \`rg -n\` (path:line:text, the shape a native grep returns)
+against the repo root; that output is the raw size. The ashlr__grep fallback
+path (no genome) caps lines at 300 columns and, above 4 000 chars, keeps whole
+lines from the head and tail. The ratio is ashlr/raw.
 
 Note: when a .ashlrcode/genome/ index is present, real-world grep savings are
 substantially higher. This benchmark measures only the conservative
@@ -705,7 +708,14 @@ export async function runBenchmark(opts: {
 
   // --validate-tokenizer: sample 5% through measureTokens
   let heuristicError: number | null = null;
-  if (validateTokenizer && process.env.ANTHROPIC_API_KEY) {
+  const phantomExec = detectPhantomExec();
+  if (validateTokenizer && phantomExec.inSession) {
+    console.log(`[run-benchmark] ${describePhantomExec(phantomExec)}`);
+  }
+  if (validateTokenizer && process.env.ANTHROPIC_API_KEY && !providerKeyUsable("ANTHROPIC_API_KEY")) {
+    for (const w of phantomExec.warnings) console.log(`[run-benchmark] --validate-tokenizer: ${w}`);
+    console.log("[run-benchmark] --validate-tokenizer: ANTHROPIC_API_KEY is not usable here, skipping");
+  } else if (validateTokenizer && process.env.ANTHROPIC_API_KEY) {
     console.log("[run-benchmark] --validate-tokenizer: sampling API token counts...");
     const { measureTokens } = await import("../servers/_token-measure.ts");
     const sampleN = Math.max(1, Math.ceil(readSamples.length * 0.05));

package/scripts/upgrade-flow.ts

@@ -29,6 +29,7 @@ import * as readline from "readline";
 import { randomBytes } from "crypto";
 import { recordNudgeClicked, maybeSyncToCloud as maybeSyncNudgeEvents } from "../servers/_nudge-events.ts";
 import { validateProToken } from "../servers/_pro.ts";
+import { PLAINTEXT_FALLBACK_WARNING, storeProToken } from "../servers/_pro-token-keychain.ts";
 
 // ---------------------------------------------------------------------------
 // Config
@@ -186,19 +187,10 @@ function saveToken(token: string): void {
   try { chmodSync(TOKEN_FILE, 0o600); } catch { /* best-effort */ }
 }
 
-async function writeEnvFile(token: string): Promise<void> {
+async function writeEnvFile(token: string): Promise<"keychain" | "file"> {
   ensureAshlrDir();
-  let existing = "";
-  try { existing = await readFile(ENV_FILE, "utf8"); } catch { /* new file */ }
-
-  // Remove any prior ASHLR_PRO_TOKEN line, then append the fresh one
-  const lines = existing
-    .split("\n")
-    .filter((l) => !l.startsWith("export ASHLR_PRO_TOKEN="));
-  lines.push(`export ASHLR_PRO_TOKEN=${token}`);
-
-  await writeFile(ENV_FILE, lines.join("\n").trimStart() + "\n", { encoding: "utf8", mode: 0o600 });
-  try { chmodSync(ENV_FILE, 0o600); } catch { /* best-effort */ }
+  // OS keychain first; the 0600 `export ASHLR_PRO_TOKEN=` line only as fallback.
+  return storeProToken(token, ENV_FILE);
 }
 
 function readStoredToken(): string | null {
@@ -690,9 +682,12 @@ async function main(): Promise<number> {
 
     // Persist token
     saveToken(token);
-    await writeEnvFile(token);
+    const where = await writeEnvFile(token);
     process.env["ASHLR_PRO_TOKEN"] = token;
-    ok("Token saved to ~/.ashlr/pro-token and ~/.ashlr/env (auto-loaded on next session).");
+    if (where === "file") warn(PLAINTEXT_FALLBACK_WARNING);
+    ok(where === "keychain"
+      ? "Token saved to ~/.ashlr/pro-token and the OS keychain (auto-loaded on next session)."
+      : "Token saved to ~/.ashlr/pro-token and ~/.ashlr/env (auto-loaded on next session).");
   } else {
     step(2, totalSteps, "Sign in");
     ok("Already authenticated — skipping sign-in.");

package/servers/_base-urls.ts

@@ -0,0 +1,48 @@
+/**
+ * Base URLs for the provider hosts the plugin's scripts and servers call.
+ *
+ * Each helper reads the same environment variable the provider's own tooling
+ * uses and falls back to the host the plugin always used, so nothing changes
+ * unless a variable is set. A gateway (for example LiteLLM) or a local proxy
+ * can then sit in front by setting the variable.
+ *
+ *   ANTHROPIC_BASE_URL  root without /v1 (default https://api.anthropic.com)
+ *   OPENAI_BASE_URL     includes /v1 (default https://api.openai.com/v1)
+ *   OLLAMA_HOST         host, host:port, :port or a full URL (default http://localhost:11434)
+ *
+ * Empty or whitespace-only values count as unset. Trailing slashes are trimmed.
+ */
+
+export const DEFAULT_ANTHROPIC_BASE_URL = "https://api.anthropic.com";
+export const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
+export const DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434";
+
+type Env = Record<string, string | undefined>;
+
+function trimmed(value: string | undefined): string {
+  return (value ?? "").trim().replace(/\/+$/, "");
+}
+
+/** Anthropic API root, no trailing slash. Append `/v1/...`. */
+export function anthropicBaseUrl(env: Env = process.env): string {
+  return trimmed(env["ANTHROPIC_BASE_URL"]) || DEFAULT_ANTHROPIC_BASE_URL;
+}
+
+/** OpenAI API root including `/v1`, no trailing slash. Append `/models` etc. */
+export function openaiBaseUrl(env: Env = process.env): string {
+  return trimmed(env["OPENAI_BASE_URL"]) || DEFAULT_OPENAI_BASE_URL;
+}
+
+/**
+ * Ollama root, no trailing slash. OLLAMA_HOST may omit the scheme (`host:port`,
+ * `host`, `:port`); `http://` is assumed and port 11434 when none is given.
+ */
+export function ollamaBaseUrl(env: Env = process.env): string {
+  const raw = trimmed(env["OLLAMA_HOST"]);
+  if (!raw) return DEFAULT_OLLAMA_BASE_URL;
+  if (/^https?:\/\//i.test(raw)) return raw;
+  let hostPort = raw;
+  if (hostPort.startsWith(":")) hostPort = `localhost${hostPort}`;
+  if (!/:\d+$/.test(hostPort)) hostPort = `${hostPort}:11434`;
+  return `http://${hostPort}`;
+}