ccdesk 0.0.0-stage → 0.2.0

package/dist/server/scan/usage.js

@@ -0,0 +1,514 @@
+import { open, realpath, stat } from "node:fs/promises";
+import { join, resolve, sep } from "node:path";
+import { storeDirName } from "../../shared/memory.js";
+import {} from "../../shared/types.js";
+import {} from "./env.js";
+import { isCredentials, isDir, isRecord, isWithin, listDir, wildcard, worktrees } from "./files.js";
+import { namesTool, parseRule } from "./tools.js";
+/**
+ * Transcripts already counted, by path, so reopening a directory reads only what was added. Kept
+ * in memory only, least recently counted first; once they hold more than MAX_CACHED_CALLS calls,
+ * the oldest are dropped and read again when needed.
+ */
+const transcripts = new Map();
+/** Roughly how many calls the cache keeps, beyond those of the directory counted last. */
+export const MAX_CACHED_CALLS = 100_000;
+/** A transcript is read in parts this size, so one huge file never becomes one huge string. */
+const CHUNK = 8 * 1024 * 1024;
+let queue = Promise.resolve();
+/** Requests waiting their turn, so a burst of the same request runs once. */
+const waiting = new Map();
+/** How long one count may take before it stops; what it read by then stays counted. */
+const TIME_LIMIT_MS = 60_000;
+/** A count that stopped before it finished, because it took too long or nobody wanted it. */
+export class CountStopped extends Error {
+}
+/**
+ * Counts the tool calls in the sessions started in `dir`, or anywhere in its repository and its
+ * worktrees, since rules at a repository's root apply there too (docs: permissions#permission-system).
+ * Subagents are included. It also counts the calls you approved or refused by hand, which Claude
+ * Code records on each call's result as `permissionDecision` (not documented; older transcripts
+ * lack it), and how many calls each rule covers. Requests run one at a time, since they share the
+ * cache. A count stops when every `signal` it was asked with aborts, or after `timeLimitMs`: it
+ * rejects with CountStopped and the next one starts, even if a read of the stopped count never
+ * returns.
+ */
+export function readUsage(env, dir, rules, { signal, timeLimitMs = TIME_LIMIT_MS, maxCachedCalls = MAX_CACHED_CALLS, } = {}) {
+    const key = JSON.stringify([env.claudeDir, resolve(dir), rules, timeLimitMs, maxCachedCalls]);
+    let run = waiting.get(key);
+    if (!run) {
+        const stop = new AbortController();
+        const promise = queue.then(() => {
+            waiting.delete(key);
+            const during = AbortSignal.any([stop.signal, AbortSignal.timeout(timeLimitMs)]);
+            // A stopped count answers right away, even while one of its reads never returns.
+            const stopped = new Promise((_, fail) => {
+                const onStop = () => fail(stoppedBecause(during));
+                if (during.aborted)
+                    onStop();
+                else
+                    during.addEventListener("abort", onStop, { once: true });
+            });
+            return Promise.race([count(env, resolve(dir), rules, during, maxCachedCalls), stopped]);
+        });
+        run = { promise, stop, waiters: 0 };
+        waiting.set(key, run);
+        // The queue moves on when the count settles or stops: a stopped count changes nothing more.
+        queue = promise.catch(() => undefined);
+    }
+    const current = run;
+    if (signal?.aborted)
+        return current.promise;
+    current.waiters++;
+    signal?.addEventListener("abort", () => {
+        if (--current.waiters === 0)
+            current.stop.abort();
+    }, { once: true });
+    return current.promise;
+}
+function stoppedBecause(signal) {
+    return new CountStopped(signal.reason instanceof DOMException && signal.reason.name === "TimeoutError"
+        ? "Counting tool calls took too long and stopped; what was read is kept, so the next count continues."
+        : "The count was no longer wanted.");
+}
+/** Throws once a count has to stop, before it changes anything else. */
+function checkStopped(signal) {
+    if (signal.aborted)
+        throw stoppedBecause(signal);
+}
+async function count(env, dir, rules, signal, maxCachedCalls) {
+    checkStopped(signal);
+    const checkouts = await worktrees(dir);
+    // $HOME may end in a slash or be a link, while git prints the resolved path.
+    const homes = new Set([
+        resolve(env.home),
+        await realpath(env.home).catch(() => resolve(env.home)),
+    ]);
+    const isHome = (folder) => homes.has(resolve(folder));
+    // A home directory kept in git (dotfiles) is not a project: its folders are separate projects.
+    const repository = checkouts.length > 0 && !isHome(checkouts[0] ?? "");
+    const folders = repository ? checkouts : [dir];
+    const projects = join(env.claudeDir, "projects");
+    const storeNames = await listDir(projects);
+    const taken = new Set();
+    const calls = [];
+    const counted = new Set();
+    let sessions = 0;
+    for (const folder of folders) {
+        const own = storeDirName(folder);
+        // Sessions started in a subfolder or a nested worktree have their own store, named with the
+        // folder's as a prefix; the prefix also matches siblings such as app-old, so each session is
+        // kept by the folder it started in. A home directory would pull in every store, so only its
+        // own is read.
+        const stores = storeNames.filter((name) => name === own || (!isHome(folder) && name.startsWith(`${own}-`)));
+        for (const name of stores) {
+            const store = join(projects, name);
+            const files = await transcriptsIn(store);
+            for (const [file, session] of files) {
+                if (taken.has(file))
+                    continue;
+                // A subagent's session decides; one whose session file is gone goes by its own start.
+                const start = (await transcript(env, session, signal))?.startCwd ??
+                    (await transcript(env, file, signal))?.startCwd;
+                if (start ? !isWithin(folder, start) : name !== own)
+                    continue;
+                taken.add(file);
+                counted.add(file);
+                calls.push(...((await transcript(env, file, signal))?.calls ?? []));
+                if (file === session)
+                    sessions++;
+            }
+            checkStopped(signal);
+            for (const path of transcripts.keys())
+                if (path.startsWith(store + sep) && !files.has(path))
+                    transcripts.delete(path);
+        }
+    }
+    trimCache(counted, maxCachedCalls);
+    return {
+        sessions,
+        repository,
+        since: calls.reduce((min, c) => (min === null || c.at < min ? c.at : min), null),
+        tools: toolUsage(calls),
+        approvals: approvals(calls, rules),
+        matches: Object.fromEntries(rules.map((r) => [r.rule, matchCount(r, calls)])),
+    };
+}
+/** Drops the least recently counted transcripts over the limit, keeping those just counted. */
+function trimCache(counted, maxCalls) {
+    let total = 0;
+    for (const known of transcripts.values())
+        total += known.calls.length;
+    for (const [path, known] of transcripts) {
+        if (total <= maxCalls || counted.has(path))
+            return;
+        transcripts.delete(path);
+        total -= known.calls.length;
+    }
+}
+/** A store's transcripts, each with the session it belongs to: itself, or a subagent's session. */
+async function transcriptsIn(store) {
+    const files = new Map();
+    for (const name of await listDir(store)) {
+        if (name.endsWith(".jsonl"))
+            files.set(join(store, name), join(store, name));
+        else if (await isDir(join(store, name, "subagents")))
+            for (const sub of await listDir(join(store, name, "subagents")))
+                if (sub.endsWith(".jsonl"))
+                    files.set(join(store, name, "subagents", sub), join(store, `${name}.jsonl`));
+    }
+    return files;
+}
+/**
+ * One transcript, read up to its end; one that cannot be read keeps what was read before, and one
+ * whose count stops keeps the whole lines read so far.
+ */
+async function transcript(env, file, signal) {
+    if (await isCredentials(env, file))
+        return null;
+    const info = await stat(file).catch(() => null);
+    checkStopped(signal);
+    if (!info?.isFile())
+        return null;
+    let known = transcripts.get(file);
+    if (!known || info.size < known.offset)
+        known = { size: 0, mtimeMs: 0, offset: 0, calls: [], byId: new Map() };
+    // Set again so the map stays in order of last use.
+    transcripts.delete(file);
+    transcripts.set(file, known);
+    if (known.size === info.size && known.mtimeMs === info.mtimeMs)
+        return known;
+    try {
+        await readFrom(file, known, info.size, signal);
+        known.size = info.size;
+        known.mtimeMs = info.mtimeMs;
+    }
+    catch (error) {
+        if (error instanceof CountStopped)
+            throw error;
+        // Gone or unreadable since the stat: keep what was counted; the offset still marks it.
+    }
+    return known;
+}
+/** Reads whole lines from the offset up to `size`; a line still being written is read next time. */
+async function readFrom(file, known, size, signal) {
+    const handle = await open(file, "r");
+    try {
+        let carried = Buffer.alloc(0);
+        let position = known.offset;
+        while (position < size) {
+            const chunk = Buffer.alloc(Math.min(CHUNK, size - position));
+            const { bytesRead } = await handle.read(chunk, 0, chunk.length, position);
+            // Checked before the cache changes: a later count may already be reading this file.
+            checkStopped(signal);
+            if (bytesRead === 0)
+                break;
+            position += bytesRead;
+            const data = Buffer.concat([carried, chunk.subarray(0, bytesRead)]);
+            const end = data.lastIndexOf(0x0a) + 1;
+            for (const line of data.subarray(0, end).toString("utf8").split("\n"))
+                read(line, known);
+            known.offset += end;
+            carried = data.subarray(end);
+        }
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Takes the tool calls from an assistant line and your answers from a tool result line. */
+function read(line, transcript) {
+    const hasCall = line.includes('"tool_use"');
+    const hasDecision = line.includes('"permissionDecision"');
+    const hasStart = !transcript.startCwd && line.includes('"cwd"');
+    if (!hasCall && !hasDecision && !hasStart)
+        return;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        return;
+    }
+    if (!isRecord(record))
+        return;
+    if (!transcript.startCwd && typeof record.cwd === "string")
+        transcript.startCwd = record.cwd;
+    if (!isRecord(record.message))
+        return;
+    const content = record.message.content;
+    if (!Array.isArray(content))
+        return;
+    const at = typeof record.timestamp === "string" ? record.timestamp : "";
+    if (record.type === "assistant") {
+        for (const block of content) {
+            if (!isRecord(block) || block.type !== "tool_use")
+                continue;
+            if (typeof block.id !== "string" || typeof block.name !== "string")
+                continue;
+            const call = callOf(block.name, isRecord(block.input) ? block.input : {}, at);
+            transcript.calls.push(call);
+            transcript.byId.set(block.id, call);
+        }
+        return;
+    }
+    const decision = record.permissionDecision;
+    if (record.type !== "user" || !isRecord(decision))
+        return;
+    if (typeof decision.source !== "string" || !decision.source.startsWith("user"))
+        return;
+    for (const block of content) {
+        if (!isRecord(block) || block.type !== "tool_result")
+            continue;
+        const call = typeof block.tool_use_id === "string" && transcript.byId.get(block.tool_use_id);
+        if (call)
+            call.byYou = decision.decision === "accept";
+    }
+}
+function callOf(tool, input, at) {
+    const command = (tool === "Bash" || tool === "Monitor") && typeof input.command === "string"
+        ? input.command
+        : undefined;
+    let host;
+    if (tool === "WebFetch" && typeof input.url === "string") {
+        try {
+            host = new URL(input.url).hostname.replace(/\.$/, "");
+        }
+        catch {
+            // Not a URL: no domain rule can match it.
+        }
+    }
+    const call = { tool, at, rule: ruleFor(tool, command, host) };
+    if (command !== undefined)
+        call.commands = everyCommandIn(command);
+    if (host !== undefined)
+        call.host = host;
+    return call;
+}
+function toolUsage(calls) {
+    const byTool = new Map();
+    for (const c of calls) {
+        const usage = byTool.get(c.tool) ?? { tool: c.tool, calls: 0, approved: 0, refused: 0 };
+        usage.calls++;
+        if (c.byYou === true)
+            usage.approved++;
+        if (c.byYou === false)
+            usage.refused++;
+        byTool.set(c.tool, usage);
+    }
+    return [...byTool.values()].sort((a, b) => b.calls - a.calls);
+}
+/**
+ * Calls you allowed by hand, grouped by the allow rule that would cover them. A rule is left out
+ * when it would also cover a call you refused, or when rules in effect already decide every call
+ * behind it: allowing it then changes nothing.
+ */
+function approvals(calls, rules) {
+    const matchers = rules.flatMap((r) => matcherFor(r) ?? []);
+    const groups = new Map();
+    for (const c of calls) {
+        if (c.byYou !== true)
+            continue;
+        if (c.rule)
+            groups.set(c.rule, [...(groups.get(c.rule) ?? []), c]);
+    }
+    const refused = calls.filter((c) => c.byYou === false);
+    const out = [];
+    for (const [rule, approved] of groups) {
+        if (rules.some((r) => r.rule === rule))
+            continue;
+        const covers = matcherFor({ list: "allow", rule });
+        if (covers && refused.some(covers))
+            continue;
+        if (approved.every((c) => matchers.some((m) => m(c))))
+            continue;
+        const last = approved.reduce((max, c) => (c.at > max ? c.at : max), "");
+        out.push({ rule, approved: approved.length, last });
+    }
+    return out.sort((a, b) => b.approved - a.approved);
+}
+/**
+ * Programs a prefix rule may name on their own: read-only commands with no flag that runs a
+ * command or writes a file (docs: permissions#read-only-commands). A rule for any other program
+ * could allow far more than you approved, as `sed`'s `e` command or `make --eval` do, so ccdesk
+ * suggests none.
+ */
+const SAFE_PROGRAMS = new Set("ls cat head tail wc grep diff cmp comm cut tr jq stat du df pwd echo printf date whoami uname which basename dirname realpath readlink nproc".split(" "));
+/**
+ * Programs with subcommands, and the subcommands a rule may name, one or two words each: those
+ * whose flags neither run another command nor write a file you did not name
+ * (docs: permissions#wildcard-patterns). The exceptions are the script runners `test`, `run`,
+ * `build` and `lint`, and `git commit`, whose hooks may run scripts from package.json: they run
+ * the project's own code, and npm and pnpm config flags such as `--node-options` can make them
+ * run any code. A rule for them is the one Claude Code's own prompt offers, `npm test *`
+ * (docs: permissions#permission-system), and no wider.
+ *
+ * Left out on purpose: `git stash show`, `git blame` and `git log` write anywhere with
+ * `--output`; `git grep -O` and `git fetch --upload-pack` run a command; the rest of `gh repo`
+ * reaches delete, visibility and deploy keys; `bun build --compile --outfile` writes an
+ * executable; `npm audit fix` installs; every pnpm command loads a pnpmfile, which
+ * `--config.pnpmfile` can point at any script; podman takes `--runtime` after the subcommand;
+ * `go test -exec`, `cargo --config`, kubeconfig exec plugins, `pip --python` and installs run
+ * whatever they are given.
+ */
+const SUBCOMMANDS = {
+    git: "status add commit switch restore tag branch rev-parse describe ls-files".split(" "),
+    npm: "test run ls outdated view".split(" "),
+    pnpm: "test run build lint".split(" "),
+    yarn: "test run build lint".split(" "),
+    bun: ["test"],
+    gh: [
+        "status",
+        "pr view",
+        "pr list",
+        "pr diff",
+        "pr checks",
+        "issue view",
+        "issue list",
+        "repo view",
+    ],
+    docker: "ps images logs inspect".split(" "),
+    systemctl: ["status"],
+};
+/** Path rules for these need a path ccdesk should not guess. */
+const PATH_TOOLS = new Set(["Read", "Edit", "Write", "NotebookEdit", "Glob", "Grep", "LSP"]);
+/**
+ * The allow rule that would have covered a call, in the form Claude Code's "don't ask again"
+ * writes: a Bash program on the allowlists above, with its subcommand where it has them, a fetch's
+ * domain, or the tool. None for compound commands, other programs and subcommands, a leading
+ * variable assignment (an allow rule does not match past most of them, docs:
+ * permissions#process-wrappers) and file tools. A rule takes no other words from a command, so
+ * arguments never leave the server.
+ */
+function ruleFor(tool, command, host) {
+    if (tool === "Bash") {
+        if (command === undefined || /[`$<>(){}]/.test(command))
+            return null;
+        if (/^\s*\w+=/.test(command))
+            return null;
+        const parts = subcommands(command);
+        if (parts.length !== 1)
+            return null;
+        const [program, ...rest] = (parts[0] ?? "").split(/\s+/);
+        if (!program)
+            return null;
+        if (SAFE_PROGRAMS.has(program))
+            return `Bash(${program} *)`;
+        const sub = SUBCOMMANDS[program]?.find((words) => words.split(" ").every((word, i) => rest[i] === word));
+        return sub ? `Bash(${program} ${sub} *)` : null;
+    }
+    if (tool === "WebFetch")
+        return host ? `WebFetch(domain:${host})` : null;
+    if (PATH_TOOLS.has(tool) || tool === "PowerShell" || tool === "Monitor")
+        return null;
+    return tool;
+}
+const SEPARATORS = /&&|\|\||\|&|[;|&\n]/;
+/** docs: permissions#process-wrappers */
+const WRAPPERS = new Set([
+    "timeout",
+    "time",
+    "nice",
+    "nohup",
+    "stdbuf",
+    "command",
+    "builtin",
+    "noglob",
+]);
+const KEYWORDS = new Set(["if", "then", "else", "elif", "do", "while", "until", "!"]);
+/** A command's parts as Claude Code splits them for allow rules: at shell operators, wrappers stripped. */
+function subcommands(command) {
+    return command
+        .split(SEPARATORS)
+        .map((part) => withoutWrappers(part.trim()))
+        .filter(Boolean);
+}
+/**
+ * Every command a rule might see in a call: the whole text, its parts, and commands nested in a
+ * subshell, a substitution or a loop body, which deny and ask rules also reach (docs:
+ * permissions#compound-commands), each also without its redirections, which Claude Code checks
+ * apart from the rule (docs: permissions#redirections). Generous on purpose, so a rule counted as
+ * covering no call really covered none.
+ */
+function everyCommandIn(command) {
+    const variants = [command, withoutRedirections(command)];
+    return [
+        ...new Set(variants.flatMap((text) => {
+            const parts = text
+                .replace(/\$\(|[`(){}]/g, "\n")
+                .split(SEPARATORS)
+                .map((part) => {
+                const words = part.trim().split(/\s+/);
+                while (KEYWORDS.has(words[0] ?? ""))
+                    words.shift();
+                return withoutWrappers(words.join(" "));
+            });
+            return [withoutWrappers(text.trim()), ...parts];
+        })),
+    ].filter(Boolean);
+}
+/** `2>&1`, `> out.txt`, `&>> log`, `< in`: removed with their target, before `&` is taken for a separator. */
+function withoutRedirections(command) {
+    return command.replace(/\s*(?:\d*>>?\|?|&>>?|\d*<)&?\s*(?:'[^']*'|"[^"]*"|[^\s;&|]*)/g, "");
+}
+function withoutWrappers(command) {
+    const words = command.split(/\s+/);
+    for (;;) {
+        const first = words[0] ?? "";
+        if (/^\w+=/.test(first))
+            words.shift();
+        else if (first === "xargs" && words.length > 1 && !(words[1] ?? "").startsWith("-"))
+            words.shift();
+        else if (WRAPPERS.has(first) &&
+            words.length > 1 &&
+            !(first === "command" && words[1] === "-v")) {
+            words.shift();
+            while (/^(-\S+|\d+(\.\d+)?[smhd]?)$/.test(words[0] ?? ""))
+                words.shift();
+        }
+        else
+            break;
+    }
+    return words.join(" ");
+}
+/** How many calls a rule covers, or null for kinds ccdesk does not match (paths, parameters, PowerShell). */
+function matchCount(rule, calls) {
+    const matches = matcherFor(rule);
+    return matches ? calls.filter(matches).length : null;
+}
+/** Whether a rule covers a call, erring towards yes; null for kinds ccdesk does not match. */
+function matcherFor({ list, rule }) {
+    const { tool, specifier } = parseRule(rule);
+    if (specifier === null) {
+        if (tool.startsWith("mcp__") && tool.split("__").length === 2)
+            return (c) => c.tool.startsWith(`${tool}__`);
+        // Monitor runs commands under the Bash rules (docs: tools-reference#configure-tools-with-permission-rules-and-hooks).
+        return (c) => namesTool(list, tool, c.tool) || (c.tool === "Monitor" && namesTool(list, tool, "Bash"));
+    }
+    if (tool === "Bash") {
+        const pattern = bashPattern(specifier);
+        if (pattern === null)
+            return null;
+        return (c) => c.commands?.some(pattern) === true;
+    }
+    if (tool === "WebFetch" && specifier.startsWith("domain:")) {
+        const host = wildcard(specifier.slice(7).replace(/\.$/, ""), "i");
+        return (c) => c.host !== undefined && host.test(c.host);
+    }
+    return null;
+}
+/** A Bash rule's command pattern (docs: permissions#wildcard-patterns); null for a parameter rule. */
+function bashPattern(specifier) {
+    let pattern = specifier;
+    if (pattern.endsWith(":*") && !pattern.slice(0, -2).includes("*"))
+        pattern = `${pattern.slice(0, -2)} *`;
+    else if (/^[A-Za-z_]+:/.test(pattern))
+        return null;
+    const star = pattern.indexOf("*");
+    if (pattern.endsWith(" *") && star === pattern.length - 1) {
+        const prefix = pattern.slice(0, -2);
+        return (command) => command === prefix || command.startsWith(`${prefix} `);
+    }
+    const regex = wildcard(pattern, "s");
+    return (command) => regex.test(command);
+}

package/dist/server/schema.js

@@ -0,0 +1,15 @@
+import { Ajv } from "ajv";
+export const ajv = new Ajv({ allErrors: true, strict: false });
+/**
+ * What `validate` found wrong with `value`, each led by where: `label` and the path inside it, such
+ * as `sandbox.network`.
+ */
+export function schemaErrors(validate, value, label) {
+    if (validate(value))
+        return [];
+    return (validate.errors ?? []).map((e) => {
+        const where = [label, ...e.instancePath.split("/")].filter(Boolean).join(".");
+        const allowed = e.keyword === "enum" ? `: ${e.params.allowedValues.join(", ")}` : "";
+        return `${where} ${e.message ?? "is invalid"}${allowed}`;
+    });
+}

package/dist/server/secrets.js

@@ -0,0 +1,63 @@
+import { isRecord, redactSecrets, shownUrl } from "./scan/files.js";
+/**
+ * Helpers for the values ccdesk hides. What is hidden is decided only by redactSecrets; these
+ * compare a value with its redacted form.
+ */
+/** A value as ccdesk shows it: JSON with hidden values as •••. */
+export function shown(value) {
+    return `${JSON.stringify(redactSecrets(value), null, 2)}\n`;
+}
+/** Every value redactSecrets changes, with where it is, what it is, and how it is shown. */
+function hiddenIn(value) {
+    const found = [];
+    // redactSecrets keeps every key and list length, so the two can be walked side by side.
+    const walk = (raw, shownValue, path) => {
+        if (Array.isArray(raw) && Array.isArray(shownValue)) {
+            for (const [i, inner] of raw.entries())
+                walk(inner, shownValue[i], [...path, i]);
+        }
+        else if (isRecord(raw) && isRecord(shownValue))
+            for (const [key, inner] of Object.entries(raw))
+                walk(inner, shownValue[key], [...path, key]);
+        else if (raw !== shownValue)
+            found.push({ path, raw, shown: shownValue });
+    };
+    walk(value, redactSecrets(value), []);
+    return found;
+}
+export function hasHiddenValues(value) {
+    return hiddenIn(value).length > 0;
+}
+/**
+ * A fingerprint of the hidden values in a JSON file, so a restore can tell whether they changed.
+ * Null for a file that is not valid JSON.
+ */
+export function hiddenValues(text) {
+    try {
+        const data = text === null ? null : JSON.parse(text);
+        return JSON.stringify(hiddenIn(data).map(({ path, raw }) => [path, raw]));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The secret text in a value, to take out of a message that may quote it: an env or header value
+ * or a hidden argument whole, the part after `=` of `--token=value`, and a URL's user name,
+ * password and query. Longest first, so a secret that contains another is taken out whole.
+ */
+export function secretTexts(value) {
+    const found = hiddenIn(value).flatMap(({ raw, shown }) => {
+        if (typeof raw !== "string")
+            return [];
+        if (shown === "•••")
+            return [raw];
+        if (typeof shown === "string" && shown.endsWith("=•••"))
+            return [raw.slice(raw.indexOf("=") + 1)];
+        if (shownUrl(raw) === raw)
+            return [];
+        const url = URL.parse(raw);
+        return [url?.username, url?.password, url?.search.slice(1)];
+    });
+    return found.filter((s) => !!s).sort((a, b) => b.length - a.length);
+}