ccsniff 1.1.25 → 1.1.26

package/README.md

@@ -56,8 +56,13 @@ npx ccsniff -f                     # tail new events live
 npx ccsniff --rollup out.ndjson --since 7d
 npx ccsniff --unsloth train.jsonl --since 7d --no-subagents
 npx ccsniff --unsloth train.jsonl --unsloth-format sharegpt --since 7d
+npx ccsniff --git-discipline --since 7d --project myrepo
+npx ccsniff --search-discipline --since 7d
+npx ccsniff --glyph-discipline --since 24h
 ```
 
+Discipline audits: `--git-discipline` flags `git push` without a prior separate `git status --porcelain` Bash event and raw git push/commit inside gm (spool-dispatching) sessions; `--search-discipline` flags Grep/Glob discovery events inside gm sessions; `--glyph-discipline` flags decorative non-ASCII glyphs in assistant text (code blocks excluded). All compose with `--project`/`--since`.
+
 ### Unsloth training export
 
 `--unsloth <out>` writes one JSONL line per Claude Code session, ready for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccsniff",
-  "version": "1.1.25",
+  "version": "1.1.26",
   "description": "Watch Claude Code JSONL output files and emit structured events as a Node.js EventEmitter",
   "type": "module",
   "main": "./src/index.js",

package/src/cli.js

@@ -30,7 +30,7 @@ const FLAGS = {
   string: ['since', 'until', 'before', 'after', 'grep', 'igrep', 'cwd', 'project', 'role', 'type', 'tool', 'session', 'sid', 'sess', 'parent', 'rollup', 'format', 'sort', 'unsloth', 'unsloth-format', 'exclude-sess', 'exclude-sid', 'exclude-cwd', 'exclude-project'],
   multi: ['grep', 'igrep', 'role', 'type', 'tool', 'session', 'sid', 'project', 'cwd', 'exclude-sess', 'exclude-sid', 'exclude-cwd', 'exclude-project'],
   number: ['limit', 'head', 'tail-n', 'ctx', 'truncate', 'days'],
-  bool: ['json', 'ndjson', 'tail', 'f', 'full', 'reverse', 'invert', 'no-subagents', 'only-subagents', 'no-meta', 'only-meta', 'list-sessions', 'list-projects', 'list-tools', 'text', 'full-history', 'stats', 'count', 'help', 'h'],
+  bool: ['json', 'ndjson', 'tail', 'f', 'full', 'reverse', 'invert', 'no-subagents', 'only-subagents', 'no-meta', 'only-meta', 'list-sessions', 'list-projects', 'list-tools', 'text', 'full-history', 'stats', 'count', 'help', 'h', 'git-discipline', 'search-discipline', 'glyph-discipline'],
 };
 
 function parseArgs(argv) {
@@ -109,6 +109,11 @@ OUTPUT
   --unsloth <out>        write Unsloth training JSONL (one conversation per session per line)
   --unsloth-format <fmt> messages (OpenAI/ChatML, default) | sharegpt
 
+AUDIT
+  --git-discipline       flag git push without prior separate porcelain event; raw git push/commit in gm sessions
+  --search-discipline    flag Grep/Glob discovery events inside gm (spool-dispatching) sessions
+  --glyph-discipline     flag decorative non-ASCII glyphs in assistant text (code blocks excluded)
+
 LIMITS
   by default, output caps at the 500 most recent matching events (after --limit/--tail-n/--ctx apply)
   --full-history         disable the default 500-event cap and dump everything matched
@@ -244,6 +249,17 @@ if (opts.tail) {
 // ---------- one-shot collection (everything else needs the full set)
 const { stats, all } = collect(opts, since);
 
+// ---------- discipline audits
+if (opts['git-discipline'] || opts['search-discipline'] || opts['glyph-discipline']) {
+  const { gitDiscipline, searchDiscipline, glyphDiscipline } = await import('./discipline.js');
+  const rows = all.filter(filter);
+  if (opts['git-discipline']) gitDiscipline(rows);
+  if (opts['search-discipline']) searchDiscipline(rows);
+  if (opts['glyph-discipline']) glyphDiscipline(rows);
+  process.stderr.write(`# ${stats.events} events / ${stats.files} files / ${rows.length} in scope\n`);
+  process.exit(0);
+}
+
 // ---------- list-projects
 if (opts['list-projects']) {
   const projects = new Map();

package/src/discipline.js

@@ -0,0 +1,115 @@
+import path from 'path';
+
+const GM_SPOOL_RE = /\.gm[\\\/]exec-spool[\\\/]in[\\\/]/;
+const GIT_PUSH_RE = /\bgit\s+push\b/;
+const GIT_COMMIT_RE = /\bgit\s+(commit|push)\b/;
+const PORCELAIN_RE = /git\s+status\s+--porcelain/;
+const GLYPH_RE = /[\u{2190}-\u{21FF}\u{2500}-\u{25FF}\u{2600}-\u{27BF}\u{1F000}-\u{1FAFF}]/gu;
+
+function groupSessions(rows) {
+  const sessions = new Map();
+  for (const ev of rows) {
+    const sid = ev.conversation?.id || '?';
+    if (!sessions.has(sid)) sessions.set(sid, []);
+    sessions.get(sid).push(ev);
+  }
+  for (const evs of sessions.values()) evs.sort((a, b) => (a.timestamp || 0) - (b.timestamp || 0));
+  return sessions;
+}
+
+function isGmSession(evs) {
+  for (const ev of evs) {
+    const b = ev.block || {};
+    if (b.type !== 'tool_use') continue;
+    if (b.name === 'Skill' && b.input?.skill === 'gm') return true;
+    if (b.name === 'Write' && GM_SPOOL_RE.test(String(b.input?.file_path || ''))) return true;
+    if (b.name === 'Bash' && GM_SPOOL_RE.test(String(b.input?.command || ''))) return true;
+  }
+  return false;
+}
+
+function sample(ev, detail) {
+  const sid = (ev.conversation?.id || '?').slice(0, 8);
+  const iso = new Date(ev.timestamp || 0).toISOString().slice(0, 19).replace('T', ' ');
+  const repo = path.basename(ev.conversation?.cwd || '');
+  const text = String(detail).replace(/\s+/g, ' ').slice(0, 160);
+  return `  [${iso}] [${repo}] ${sid}  ${text}\n`;
+}
+
+function report(label, findings, maxSamples) {
+  process.stdout.write(`# ${label}: ${findings.length} finding(s)\n`);
+  for (const f of findings.slice(0, maxSamples)) process.stdout.write(f);
+  if (findings.length > maxSamples) process.stdout.write(`  ... ${findings.length - maxSamples} more\n`);
+}
+
+export function gitDiscipline(rows, maxSamples = 10) {
+  const sessions = groupSessions(rows);
+  const pushNoPorcelain = [];
+  const gmRawGit = [];
+  let bashGit = 0;
+  for (const evs of sessions.values()) {
+    const gm = isGmSession(evs);
+    let porcelainSeen = false;
+    for (const ev of evs) {
+      const b = ev.block || {};
+      if (b.type !== 'tool_use' || b.name !== 'Bash') continue;
+      const cmd = String(b.input?.command || '');
+      if (!/\bgit\b/.test(cmd)) continue;
+      bashGit++;
+      if (PORCELAIN_RE.test(cmd) && !GIT_PUSH_RE.test(cmd)) porcelainSeen = true;
+      if (GIT_PUSH_RE.test(cmd) && !porcelainSeen) pushNoPorcelain.push(sample(ev, cmd));
+      if (gm && GIT_COMMIT_RE.test(cmd)) gmRawGit.push(sample(ev, cmd));
+      if (GIT_PUSH_RE.test(cmd)) porcelainSeen = false;
+    }
+  }
+  process.stdout.write(`# git-discipline: ${sessions.size} sessions, ${bashGit} raw git Bash events\n`);
+  report('push without prior separate porcelain event', pushNoPorcelain, maxSamples);
+  report('raw git push/commit inside gm session (spool bypass)', gmRawGit, maxSamples);
+  return pushNoPorcelain.length + gmRawGit.length;
+}
+
+export function searchDiscipline(rows, maxSamples = 10) {
+  const sessions = groupSessions(rows);
+  const findings = [];
+  let gmSessions = 0;
+  for (const evs of sessions.values()) {
+    if (!isGmSession(evs)) continue;
+    gmSessions++;
+    for (const ev of evs) {
+      const b = ev.block || {};
+      if (b.type !== 'tool_use') continue;
+      if (b.name !== 'Grep' && b.name !== 'Glob') continue;
+      const detail = `${b.name} ${b.input?.pattern || ''}`;
+      findings.push(sample(ev, detail));
+    }
+  }
+  process.stdout.write(`# search-discipline: ${sessions.size} sessions, ${gmSessions} gm sessions\n`);
+  report('Grep/Glob discovery inside gm session', findings, maxSamples);
+  return findings.length;
+}
+
+function stripCode(text) {
+  return text.replace(/```[\s\S]*?```/g, '').replace(/`[^`\n]*`/g, '');
+}
+
+export function glyphDiscipline(rows, maxSamples = 10) {
+  const findings = [];
+  let scanned = 0;
+  let glyphTotal = 0;
+  for (const ev of rows) {
+    const b = ev.block || {};
+    if (ev.role !== 'assistant' || b.type !== 'text') continue;
+    scanned++;
+    const text = stripCode(String(b.text || ''));
+    const matches = text.match(GLYPH_RE);
+    if (!matches || !matches.length) continue;
+    glyphTotal += matches.length;
+    const uniq = [...new Set(matches)].slice(0, 8).join(' ');
+    const ctxIdx = text.search(GLYPH_RE);
+    const ctx = text.slice(Math.max(0, ctxIdx - 40), ctxIdx + 40);
+    findings.push(sample(ev, `${matches.length}x [${uniq}] ...${ctx}...`));
+  }
+  process.stdout.write(`# glyph-discipline: ${scanned} assistant text blocks scanned, ${glyphTotal} decorative glyphs\n`);
+  report('assistant text with decorative non-ASCII glyphs', findings, maxSamples);
+  return findings.length;
+}