ccsniff 1.1.20 → 1.1.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccsniff",
-  "version": "1.1.20",
+  "version": "1.1.22",
   "description": "Watch Claude Code JSONL output files and emit structured events as a Node.js EventEmitter",
   "type": "module",
   "main": "./src/index.js",

package/src/cli.js

@@ -2,6 +2,7 @@
 import { JsonlReplayer, rollup, vault } from './index.js';
 import { toUnslothMessages, toShareGPT } from './unsloth.js';
 import { parseTime, compileRegexes, buildFilter } from './filters.js';
+import { stripQuoted, targetsOutsideCwd, targetsSingleFile } from './discipline-helpers.js';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
@@ -30,7 +31,7 @@ const FLAGS = {
   string: ['since', 'until', 'before', 'after', 'grep', 'igrep', 'cwd', 'project', 'role', 'type', 'tool', 'session', 'sid', 'sess', 'parent', 'rollup', 'format', 'sort', 'unsloth', 'unsloth-format', 'exclude-sess', 'exclude-sid', 'exclude-cwd', 'exclude-project'],
   multi: ['grep', 'igrep', 'role', 'type', 'tool', 'session', 'sid', 'project', 'cwd', 'exclude-sess', 'exclude-sid', 'exclude-cwd', 'exclude-project'],
   number: ['limit', 'head', 'tail-n', 'ctx', 'truncate', 'days'],
-  bool: ['json', 'ndjson', 'tail', 'f', 'full', 'reverse', 'invert', 'no-subagents', 'only-subagents', 'no-meta', 'only-meta', 'list-sessions', 'list-projects', 'list-tools', 'bash-discipline', 'git-discipline', 'search-discipline', 'glyph-discipline', 'continuation-discipline', 'learning-xref', 'include-subagents', 'stats', 'count', 'help', 'h'],
+  bool: ['json', 'ndjson', 'tail', 'f', 'full', 'reverse', 'invert', 'no-subagents', 'only-subagents', 'no-meta', 'only-meta', 'list-sessions', 'list-projects', 'list-tools', 'bash-discipline', 'git-discipline', 'search-discipline', 'glyph-discipline', 'continuation-discipline', 'verb-bypass-discipline', 'spool-discipline', 'learning-xref', 'include-subagents', 'stats', 'count', 'help', 'h'],
 };
 
 function parseArgs(argv) {
@@ -73,6 +74,11 @@ USAGE
   ccsniff --continuation-discipline [--stats]  assistant turn that ends in prose with no tool call:
                                         a summary, or deferred intent ("Let me X" / "I'll X" / "Now to")
                                         as the final sentence — the toolless-turn stop (paper §38)
+  ccsniff --verb-bypass-discipline [--stats]   a platform-native tool used where a plugkit verb exists:
+                                        WebFetch/WebSearch->fetch, Task-search->codesearch,
+                                        raw puppeteer/chrome->browser, platform-memory Write->memorize-fire
+  ccsniff --spool-discipline [--stats]  a spool request written to in/<verb>/ but never read back from
+                                        out/ (the Write-alone-is-not-a-dispatch non-dispatch)
   ccsniff --stats [filters]
 
 TIME (any ISO date, epoch ms, or relative Ns/Nm/Nh/Nd/Nw)
@@ -374,6 +380,96 @@ if (opts['git-discipline']) {
   process.exit(0);
 }
 
+// ---------- verb-bypass-discipline (a platform-native capability used where a plugkit verb exists)
+// The class rule: every platform-native tool that has a plugkit verb is forbidden in favor of the
+// verb — WebFetch/WebSearch -> the `fetch` verb; a Task/Agent search subagent -> `codesearch`; raw
+// puppeteer/playwright/chrome -> the `browser` verb; a Write into a platform memory dir -> `memorize-fire`.
+// High-precision per-tool patterns; each violation names the verb it should have used.
+if (opts['verb-bypass-discipline']) {
+  const includeSubagents = opts['include-subagents'];
+  const MEM_PATH = /[\/\\]\.(?:claude[\/\\]projects[\/\\].*[\/\\]memory|codex[\/\\]memory|cursor)[\/\\]/i;
+  const RAW_BROWSER = /\b(?:puppeteer|playwright|chromium|chrome\.exe|google-chrome|chrome-headless)\b|--headless\b/i;
+  const TASK_SEARCH = /\b(?:where is|what calls|locate the|search the (?:code|repo|codebase|tree)|grep the|explore the (?:code|repo|tree|codebase)|find (?:the )?(?:definition|usages?|references?|callers?|where))\b/i;
+  const violations = [];
+  for (const ev of all) {
+    if (!filter(ev)) continue;
+    if (ev.block?.type !== 'tool_use') continue;
+    if (!includeSubagents && ev.conversation?.isSubagent) continue;
+    const name = ev.block?.name || '';
+    const input = ev.block?.input || {};
+    let kind = null, should = null, detail = '';
+    if (name === 'WebFetch') { kind = 'webfetch-not-fetch-verb'; should = 'fetch'; detail = String(input.url || '').slice(0, 120); }
+    else if (name === 'WebSearch') { kind = 'websearch-not-fetch-verb'; should = 'fetch'; detail = String(input.query || '').slice(0, 120); }
+    else if ((name === 'Task' || name === 'Agent') && TASK_SEARCH.test(stripQuoted(JSON.stringify(input)).slice(0, 600))) { kind = 'task-search-not-codesearch'; should = 'codesearch'; detail = String(input.description || input.prompt || '').slice(0, 120); }
+    else if (name === 'Bash' && RAW_BROWSER.test(stripQuoted(input.command || ''))) { kind = 'raw-browser-not-browser-verb'; should = 'browser'; detail = String(input.command || '').slice(0, 120); }
+    else if ((name === 'Write' || name === 'Edit' || name === 'NotebookEdit') && MEM_PATH.test(input.file_path || input.path || input.notebook_path || '')) { kind = 'platform-memory-not-memorize'; should = 'memorize-fire'; detail = String(input.file_path || input.path || input.notebook_path || '').slice(0, 120); }
+    if (!kind) continue;
+    violations.push({ ts: ev.timestamp, sid: ev.conversation.id, project: path.basename(ev.conversation.cwd || ''), kind, should, detail });
+  }
+  const byKind = new Map();
+  for (const v of violations) byKind.set(v.kind, (byKind.get(v.kind) || 0) + 1);
+  if (opts.stats || opts.count) {
+    if (opts.count) { process.stdout.write(`${violations.length}\n`); process.exit(0); }
+    process.stdout.write(`# ${violations.length} verb-bypass-discipline violations\n`);
+    for (const [k, c] of [...byKind.entries()].sort((a, b) => b[1] - a[1])) process.stdout.write(`  ${String(c).padStart(6)}  ${k}\n`);
+    const byProj = new Map();
+    for (const v of violations) byProj.set(v.project, (byProj.get(v.project) || 0) + 1);
+    process.stdout.write(`# by project\n`);
+    for (const [p, c] of [...byProj.entries()].sort((a, b) => b[1] - a[1])) process.stdout.write(`  ${String(c).padStart(6)}  ${p}\n`);
+    process.exit(0);
+  }
+  for (const v of violations) {
+    process.stdout.write(`${new Date(v.ts).toISOString().slice(0, 19)}  ${v.sid.slice(0, 8)}  ${v.kind.padEnd(28)} [${v.project}]  use:${v.should}  ${v.detail}\n`);
+  }
+  process.stderr.write(`# ${violations.length} violations (${[...byKind.entries()].map(([k, c]) => `${k}:${c}`).join(' ')})\n`);
+  process.exit(0);
+}
+
+// ---------- spool-discipline (a session that dispatches spool requests but reads NO responses)
+// "The Write alone is not a dispatch." A session that writes `.gm/exec-spool/in/<verb>/<N>.txt`
+// requests and reads ZERO `out/<...>.json` responses is fabricating the chain from prose — it never
+// observed a single plugkit response. Session-level by design: batching (write many, read the
+// first/last) is endorsed, so reading even one out/ response clears the session. Only a session that
+// reads none of its responses is flagged — high precision, no batching false-positive.
+if (opts['spool-discipline']) {
+  const includeSubagents = opts['include-subagents'];
+  const SPOOL_IN_WRITE = /(?:>\s*[^>|]*|file_path["'\s:]+["']?[^"']*)\.gm[\/\\]exec-spool[\/\\]in[\/\\][a-z0-9_-]+[\/\\]\d+\./i;
+  const SPOOL_OUT = /\.gm[\/\\]exec-spool[\/\\]out[\/\\]/i;
+  const sess = new Map();
+  for (const ev of all) {
+    if (!filter(ev)) continue;
+    if (ev.block?.type !== 'tool_use') continue;
+    if (!includeSubagents && ev.conversation?.isSubagent) continue;
+    const sid = ev.conversation.id;
+    if (!sess.has(sid)) sess.set(sid, { writes: 0, reads: 0, project: path.basename(ev.conversation.cwd || ''), firstTs: ev.timestamp, lastTs: ev.timestamp });
+    const s = sess.get(sid);
+    s.lastTs = ev.timestamp;
+    const b = ev.block, inp = b.input || {};
+    const blob = b.name === 'Write' ? (inp.file_path || '') : (b.name === 'Bash' ? (inp.command || '') : '');
+    if (blob && SPOOL_IN_WRITE.test(blob)) s.writes++;
+    const rblob = b.name === 'Read' ? (inp.file_path || '') : (b.name === 'Bash' ? (inp.command || '') : '');
+    if (rblob && SPOOL_OUT.test(rblob)) s.reads++;
+  }
+  const violations = [];
+  for (const [sid, s] of sess) {
+    if (s.writes >= 1 && s.reads === 0) violations.push({ ts: s.lastTs, sid, project: s.project, writes: s.writes });
+  }
+  if (opts.stats || opts.count) {
+    if (opts.count) { process.stdout.write(`${violations.length}\n`); process.exit(0); }
+    process.stdout.write(`# ${violations.length} spool-discipline violations (session dispatched spool writes but read 0 responses)\n`);
+    const byProj = new Map();
+    for (const v of violations) byProj.set(v.project, (byProj.get(v.project) || 0) + 1);
+    process.stdout.write(`# by project\n`);
+    for (const [p, c] of [...byProj.entries()].sort((a, b) => b[1] - a[1])) process.stdout.write(`  ${String(c).padStart(6)}  ${p}\n`);
+    process.exit(0);
+  }
+  for (const v of violations) {
+    process.stdout.write(`${new Date(v.ts).toISOString().slice(0, 19)}  ${v.sid.slice(0, 8)}  spool-writes-no-reads  [${v.project}]  writes:${v.writes} reads:0\n`);
+  }
+  process.stderr.write(`# ${violations.length} sessions dispatched spool writes but read 0 responses\n`);
+  process.exit(0);
+}
+
 // ---------- search-discipline (flag native search that should have been codesearch/recall)
 // A native-search bypass (Grep/Glob, the Explore/Task search subagent, or bash grep/rg/find/ag)
 // emits NO plugkit deviation because it never touches the spool — it is invisible to gmsniff and
@@ -383,26 +479,10 @@ if (opts['git-discipline']) {
 if (opts['search-discipline']) {
   const includeSubagents = opts['include-subagents'];
   const BASH_SEARCH = /(^|[|&;]|\s)(rg|grep|find|ag|ack|fd|fgrep|egrep)\s/;
-  // A search-tool token inside a quoted string (echo/printf/node -e payloads) is text, not a shell
-  // invocation; blank quoted bodies before matching, like git-discipline strips commit-message bodies.
-  const stripQuoted = (s) => s.replace(/"(?:\\.|[^"\\])*"/g, '""').replace(/'(?:\\.|[^'\\])*'/g, "''");
-  // codesearch indexes ONLY the conversation's own cwd (the gm repo). A search whose target is a
-  // sibling repo outside cwd has NO codesearch index to route through, so the agent is forced to
-  // native search and flagging it is a false positive. Exempt a line that targets an absolute path
-  // or cd's into a directory that is not under the conversation cwd.
-  const normPath = (p) => String(p || '').replace(/\\/g, '/').replace(/\/+$/, '').toLowerCase();
-  const targetsOutsideCwd = (line, cwd) => {
-    const cwdN = normPath(cwd);
-    if (!cwdN) return false;
-    const stripped = stripQuoted(line);
-    // explicit `cd <dir>` to a path outside cwd
-    const cdM = stripped.match(/(?:^|[|&;]\s*)cd\s+([^\s|&;]+)/i);
-    if (cdM) { const d = normPath(cdM[1]); if (d.startsWith('/') || /^[a-z]:/.test(d)) { if (!d.startsWith(cwdN)) return true; } }
-    // absolute path argument to the search tool that is outside cwd
-    const absArgs = stripped.match(/(?:^|\s)((?:[a-z]:)?\/[^\s|&;"']+)/gi) || [];
-    for (const a of absArgs) { const d = normPath(a.trim()); if ((d.startsWith('/') || /^[a-z]:/.test(d)) && !d.startsWith(cwdN)) return true; }
-    return false;
-  };
+  // stripQuoted, targetsOutsideCwd (cwd-override + cross-repo exemption), and targetsSingleFile
+  // (single-file read-filter exemption) live in discipline-helpers.js so they are unit-testable
+  // without running the CLI. codesearch indexes only the conversation cwd, so a cross-repo or
+  // single-file grep has no index to route through and flagging it is a false positive.
   const violations = [];
   for (const ev of all) {
     if (!filter(ev)) continue;
@@ -433,11 +513,13 @@ if (opts['search-discipline']) {
       // not searching the codebase tree — codesearch has no equivalent for that and it is not the
       // bypass the rule targets. Flag only a search tool that STARTS a pipeline segment (reads the
       // tree directly), never one immediately downstream of a pipe.
-      const isTreeSearchLine = (line) => BASH_SEARCH.test(stripQuoted(line).split('|')[0]);
+      // A line whose first non-space token is `#` is a shell comment, not a command — never a search.
+      const isTreeSearchLine = (line) => !/^\s*#/.test(line) && BASH_SEARCH.test(stripQuoted(line).split('|')[0]);
       const hitLine = cmd.split('\n').find(isTreeSearchLine);
       // Exempt a tree-search line that targets a sibling repo outside cwd (no codesearch index exists
-      // for it). Each command may `cd` first, so evaluate the cd context on the same line.
-      if (hitLine && !targetsOutsideCwd(hitLine, ev.conversation?.cwd)) {
+      // for it), or that greps ONE explicit file (a read-filter codesearch cannot serve). Each
+      // command may cd/git -C first, so evaluate the context on the same line.
+      if (hitLine && !targetsOutsideCwd(hitLine, ev.conversation?.cwd) && !targetsSingleFile(hitLine)) {
         kind = 'native-search-bash';
         detail = (hitLine.split('|')[0]).trim().slice(0, 120);
       }

package/src/discipline-helpers.js

@@ -0,0 +1,29 @@
+export const normPath = (p) => String(p || '').replace(/\\/g, '/').replace(/^\/([a-z])\//i, '$1:/').replace(/\/+$/, '').toLowerCase();
+
+export const stripQuoted = (s) => s.replace(/"(?:\\.|[^"\\])*"/g, '""').replace(/'(?:\\.|[^'\\])*'/g, "''");
+
+const isAbs = (d) => d.startsWith('/') || /^[a-z]:/.test(d);
+
+export function targetsOutsideCwd(line, cwd) {
+  const cwdN = normPath(cwd);
+  if (!cwdN) return false;
+  const stripped = stripQuoted(line);
+  const ctxM = stripped.match(/(?:^|[|&;]\s*)(?:cd|pushd)\s+([^\s|&;]+)/i) || stripped.match(/\bgit\s+-C\s+([^\s|&;]+)/i);
+  if (ctxM) { const d = normPath(ctxM[1]); if (isAbs(d) && !d.startsWith(cwdN)) return true; }
+  const absArgs = stripped.match(/(?:^|\s)((?:[a-z]:)?\/[^\s|&;"']+)/gi) || [];
+  for (const a of absArgs) { const d = normPath(a.trim()); if (isAbs(d) && !d.startsWith(cwdN)) return true; }
+  return false;
+}
+
+export function targetsSingleFile(line) {
+  let s = stripQuoted(line).split('|')[0];
+  s = s.replace(/\d*>>?\s*&?\s*\S+/g, ' ').replace(/<\s*\S+/g, ' ');
+  if (!/\b(grep|egrep|fgrep|rg|ag|ack)\b/.test(s)) return false;
+  if (/\s-[a-z]*[rR]\b|--recursive/.test(s)) return false;
+  const toks = s.trim().split(/\s+/);
+  const last = toks[toks.length - 1];
+  if (!last || last.startsWith('-')) return false;
+  if (/[*?{}\[\]]/.test(last)) return false;
+  if (last.endsWith('/')) return false;
+  return /\.[a-z0-9]{1,6}$/i.test(last) && !last.includes('|');
+}