ccsniff 1.1.10 → 1.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccsniff",
-  "version": "1.1.10",
+  "version": "1.1.12",
   "description": "Watch Claude Code JSONL output files and emit structured events as a Node.js EventEmitter",
   "type": "module",
   "main": "./src/index.js",

package/src/cli.js

@@ -30,7 +30,7 @@ const FLAGS = {
   string: ['since', 'until', 'before', 'after', 'grep', 'igrep', 'cwd', 'project', 'role', 'type', 'tool', 'session', 'sid', 'sess', 'parent', 'rollup', 'format', 'sort', 'unsloth', 'unsloth-format', 'exclude-sess', 'exclude-sid', 'exclude-cwd', 'exclude-project'],
   multi: ['grep', 'igrep', 'role', 'type', 'tool', 'session', 'sid', 'project', 'cwd', 'exclude-sess', 'exclude-sid', 'exclude-cwd', 'exclude-project'],
   number: ['limit', 'head', 'tail-n', 'ctx', 'truncate', 'days'],
-  bool: ['json', 'ndjson', 'tail', 'f', 'full', 'reverse', 'invert', 'no-subagents', 'only-subagents', 'no-meta', 'only-meta', 'list-sessions', 'list-projects', 'list-tools', 'bash-discipline', 'git-discipline', 'learning-xref', 'include-subagents', 'stats', 'count', 'help', 'h'],
+  bool: ['json', 'ndjson', 'tail', 'f', 'full', 'reverse', 'invert', 'no-subagents', 'only-subagents', 'no-meta', 'only-meta', 'list-sessions', 'list-projects', 'list-tools', 'bash-discipline', 'git-discipline', 'search-discipline', 'learning-xref', 'include-subagents', 'stats', 'count', 'help', 'h'],
 };
 
 function parseArgs(argv) {
@@ -66,6 +66,7 @@ USAGE
   ccsniff --bash-discipline [--stats]   Bash calls that should have used Read/Glob/Grep
   ccsniff --learning-xref [--sess <id>] [--days N]   join transcript turns to rs-learn recall/memorize
   ccsniff --git-discipline [--stats]    git push from a dirty/unwitnessed tree
+  ccsniff --search-discipline [--stats] native search (Grep/Glob/Explore/find) instead of codesearch/recall
                                         (excludes subagents by default — --include-subagents to opt in;
                                          excludes 'echo > .gm/exec-spool/in/...' as canonical spool-write)
   ccsniff --stats [filters]
@@ -369,6 +370,62 @@ if (opts['git-discipline']) {
   process.exit(0);
 }
 
+// ---------- search-discipline (flag native search that should have been codesearch/recall)
+// A native-search bypass (Grep/Glob, the Explore/Task search subagent, or bash grep/rg/find/ag)
+// emits NO plugkit deviation because it never touches the spool — it is invisible to gmsniff and
+// the watcher ledger. ccsniff reads the tool-call stream directly, so it is the only surface that
+// can catch the SKILL.md class-rule violation: code/file/symbol search routes through codesearch,
+// prior-knowledge through recall, never a host-native search tool.
+if (opts['search-discipline']) {
+  const includeSubagents = opts['include-subagents'];
+  const BASH_SEARCH = /(^|[|&;]|\s)(rg|grep|find|ag|ack|fd|fgrep|egrep)\s/;
+  const violations = [];
+  for (const ev of all) {
+    if (!filter(ev)) continue;
+    if (ev.block?.type !== 'tool_use') continue;
+    if (!includeSubagents && ev.conversation?.isSubagent) continue;
+    const name = ev.block?.name || '';
+    const project = path.basename(ev.conversation?.cwd || '');
+    const ts = ev.timestamp, sid = ev.conversation?.id || '';
+    let kind = null, detail = '';
+    if (name === 'Grep' || name === 'Glob') {
+      kind = `native-search-${name.toLowerCase()}`;
+      detail = (ev.block?.input?.pattern || ev.block?.input?.query || '').slice(0, 120);
+    } else if (name === 'Task' || name === 'Agent') {
+      const sub = (ev.block?.input?.subagent_type || ev.block?.input?.description || '').toLowerCase();
+      if (/explore|search|general-purpose/.test(sub)) {
+        kind = 'native-search-subagent';
+        detail = sub.slice(0, 120);
+      }
+    } else if (name === 'Bash') {
+      const cmd = ev.block?.input?.command || '';
+      if (BASH_SEARCH.test(cmd)) {
+        kind = 'native-search-bash';
+        // show the line that actually invokes the search tool, not line 1 (often a cd)
+        const hit = cmd.split('\n').find(l => BASH_SEARCH.test(l)) || cmd;
+        detail = hit.trim().slice(0, 120);
+      }
+    }
+    if (kind) violations.push({ ts, sid, project, kind, detail });
+  }
+  if (opts.stats || opts.count) {
+    if (opts.count) { process.stdout.write(`${violations.length}\n`); process.exit(0); }
+    process.stdout.write(`# ${violations.length} search-discipline violations (native search instead of codesearch/recall)\n`);
+    const byKind = new Map(), byProj = new Map();
+    for (const v of violations) { byKind.set(v.kind, (byKind.get(v.kind) || 0) + 1); byProj.set(v.project, (byProj.get(v.project) || 0) + 1); }
+    process.stdout.write(`# by kind\n`);
+    for (const [k, c] of [...byKind.entries()].sort((a, b) => b[1] - a[1])) process.stdout.write(`  ${String(c).padStart(6)}  ${k}\n`);
+    process.stdout.write(`# by project\n`);
+    for (const [p, c] of [...byProj.entries()].sort((a, b) => b[1] - a[1])) process.stdout.write(`  ${String(c).padStart(6)}  ${p}\n`);
+    process.exit(0);
+  }
+  for (const v of violations) {
+    process.stdout.write(`${new Date(v.ts).toISOString().slice(0, 19)}  ${v.sid.slice(0, 8)}  ${v.kind.padEnd(24)} [${v.project}]  ${v.detail}\n`);
+  }
+  process.stderr.write(`# ${violations.length} violations — use codesearch (code/file/symbol) or recall (prior knowledge) instead\n`);
+  process.exit(0);
+}
+
 // ---------- learning-xref (join transcript turns to gm-log rs_learn signals)
 if (opts['learning-xref']) {
   const days = opts.days || 1;

package/src/index.js

@@ -124,17 +124,19 @@ export class JsonlWatcher extends EventEmitter {
     this.emit('streaming_complete', { conversationId: conv.id, conversation: conv, seq: this._seq(sid), timestamp: Date.now() });
   }
 
-  _push(conv, sid, block, role) {
-    this.emit('streaming_progress', { conversationId: conv.id, conversation: conv, block, role, seq: this._seq(sid), timestamp: Date.now() });
+  _push(conv, sid, block, role, eventTs) {
+    const ts = eventTs != null ? eventTs : Date.now();
+    this.emit('streaming_progress', { conversationId: conv.id, conversation: conv, block, role, seq: this._seq(sid), timestamp: ts });
   }
 
   _route(conv, sid, e) {
     if (e.type === 'queue-operation' || e.type === 'last-prompt') return;
+    const ets = e.timestamp ? Date.parse(e.timestamp) : null;
     if (e.type === 'user' && e.isMeta) {
       this._startStreaming(conv, sid);
       const content = e.message?.content;
       const text = typeof content === 'string' ? content : (Array.isArray(content) ? content.filter(b => b?.type === 'text').map(b => b.text).join('') : '');
-      if (text.trim()) this._push(conv, sid, { type: 'text', text, isMeta: true }, 'user');
+      if (text.trim()) this._push(conv, sid, { type: 'text', text, isMeta: true }, 'user', ets);
       return;
     }
 
@@ -147,7 +149,7 @@ export class JsonlWatcher extends EventEmitter {
       if (e.subtype === 'init') { this._startStreaming(conv, sid); return; }
       if (e.subtype === 'turn_duration' || e.subtype === 'stop_hook_summary') { this._endStreaming(conv, sid); return; }
       this._startStreaming(conv, sid);
-      this._push(conv, sid, { type: 'system', subtype: e.subtype, model: e.model, cwd: e.cwd, tools: e.tools }, 'system');
+      this._push(conv, sid, { type: 'system', subtype: e.subtype, model: e.model, cwd: e.cwd, tools: e.tools }, 'system', ets);
       return;
     }
 
@@ -158,7 +160,7 @@ export class JsonlWatcher extends EventEmitter {
       const newBlocks = e.message.content.slice(prev);
       if (newBlocks.length > 0) {
         this._emitted.set(key, e.message.content.length);
-        for (const b of newBlocks) if (b?.type) this._push(conv, sid, b, 'assistant');
+        for (const b of newBlocks) if (b?.type) this._push(conv, sid, b, 'assistant', ets);
       }
       if (e.message.stop_reason) this._emitted.delete(key);
       return;
@@ -168,19 +170,19 @@ export class JsonlWatcher extends EventEmitter {
       this._startStreaming(conv, sid);
       const content = e.message.content;
       if (typeof content === 'string') {
-        if (content.trim()) this._push(conv, sid, { type: 'text', text: content }, 'user');
+        if (content.trim()) this._push(conv, sid, { type: 'text', text: content }, 'user', ets);
       } else if (Array.isArray(content)) {
         for (const b of content) {
           if (!b || !b.type) continue;
-          if (b.type === 'tool_result') this._push(conv, sid, b, 'tool_result');
-          else this._push(conv, sid, b, 'user');
+          if (b.type === 'tool_result') this._push(conv, sid, b, 'tool_result', ets);
+          else this._push(conv, sid, b, 'user', ets);
         }
       }
       return;
     }
 
     if (e.type === 'result') {
-      this._push(conv, sid, { type: 'result', result: e.result, subtype: e.subtype, duration_ms: e.duration_ms, total_cost_usd: e.total_cost_usd, is_error: e.is_error || false }, 'result');
+      this._push(conv, sid, { type: 'result', result: e.result, subtype: e.subtype, duration_ms: e.duration_ms, total_cost_usd: e.total_cost_usd, is_error: e.is_error || false }, 'result', ets);
       this._endStreaming(conv, sid);
     }
   }