chainlesschain 0.162.162 → 0.162.164

package/src/commands/context.js

@@ -66,22 +66,21 @@ export function registerContextCommand(program) {
     .argument("[id]", "Session ID (omit for the most-recent headless session)")
     .option("--model <model>", "Size against this model's context window")
     .option("--provider <provider>", "Provider (for the window default)")
+    .option(
+      "--sources",
+      "Also break tokens down by source (project-memory instruction files + message classes)",
+    )
     .option("--json", "Output as JSON")
     .action(async (id, options) => {
-      const {
-        rebuildMessages,
-        getLastSessionId,
-        sessionExists,
-        readEvents,
-      } = await import("../harness/jsonl-session-store.js");
-      const { estimateTokens, getContextWindow } = await import(
-        "../harness/prompt-compressor.js"
-      );
+      const { rebuildMessages, getLastSessionId, sessionExists, readEvents } =
+        await import("../harness/jsonl-session-store.js");
+      const { estimateTokens, getContextWindow } =
+        await import("../harness/prompt-compressor.js");
 
       const sessionId = id || getLastSessionId();
       if (!sessionId) {
         logger.error(
-          'No session found. Run a headless agent with `--session <id>` first, or pass a session id.',
+          "No session found. Run a headless agent with `--session <id>` first, or pass a session id.",
         );
         process.exitCode = 1;
         return;
@@ -121,6 +120,55 @@ export function registerContextCommand(program) {
       const used = window > 0 ? total / window : 0;
       const remaining = Math.max(0, window - total);
 
+      // --sources (opt-in): attribute the project-memory instruction files that
+      // WOULD load for the current cwd (same instructionExcludes the agent
+      // honors), folded in with the session's message-role buckets. The base
+      // view is byte-for-byte unchanged when the flag is absent.
+      let sourceReport = null;
+      if (options.sources) {
+        try {
+          const { loadProjectInstructions } =
+            await import("../lib/project-instructions.js");
+          const { breakdownInstructionSources, rankContextSources } =
+            await import("../lib/context-breakdown.js");
+          const cwd = process.cwd();
+          let instructionExcludes;
+          try {
+            const { readStringArraySetting } =
+              await import("../lib/settings-loader.cjs");
+            instructionExcludes = readStringArraySetting(
+              "instructionExcludes",
+              {
+                cwd,
+              },
+            );
+          } catch {
+            instructionExcludes = undefined; // fail-open — load everything
+          }
+          const loaded = loadProjectInstructions({ cwd, instructionExcludes });
+          const instr = breakdownInstructionSources(
+            loaded.files,
+            estimateTokens,
+            cwd,
+          );
+          const ranked = rankContextSources({
+            instructionTotal: instr.total,
+            buckets,
+            counts,
+          });
+          sourceReport = {
+            cwd,
+            instructions: instr.sources,
+            instructionTokens: instr.total,
+            ranked: ranked.sources,
+            combinedTotal: ranked.total,
+          };
+        } catch {
+          // Best-effort — a source breakdown must never break the base view.
+          sourceReport = null;
+        }
+      }
+
       if (options.json) {
         console.log(
           JSON.stringify(
@@ -136,6 +184,15 @@ export function registerContextCommand(program) {
               breakdown: buckets,
               counts,
               overflows: total > window,
+              ...(sourceReport
+                ? {
+                    sources: sourceReport.ranked,
+                    instructions: sourceReport.instructions,
+                    instructionTokens: sourceReport.instructionTokens,
+                    combinedTotal: sourceReport.combinedTotal,
+                    cwd: sourceReport.cwd,
+                  }
+                : {}),
             },
             null,
             2,
@@ -144,7 +201,9 @@ export function registerContextCommand(program) {
         return;
       }
 
-      logger.log(chalk.bold(`Context — session ${chalk.gray(sessionId.slice(0, 28))}`));
+      logger.log(
+        chalk.bold(`Context — session ${chalk.gray(sessionId.slice(0, 28))}`),
+      );
       logger.log(
         chalk.gray(
           `  model ${model || "(default)"} · provider ${provider} · ` +
@@ -172,17 +231,69 @@ export function registerContextCommand(program) {
 
       logger.log("");
       const pct = (used * 100).toFixed(1);
-      const color = used > 0.9 ? chalk.red : used > 0.7 ? chalk.yellow : chalk.green;
+      const color =
+        used > 0.9 ? chalk.red : used > 0.7 ? chalk.yellow : chalk.green;
       logger.log(
         `  ${chalk.bold("total".padEnd(11))} ${String(total).padStart(7)}  ` +
           `${color(bar(used))} ${color(`${pct}% of window`)}`,
       );
       logger.log(
-        chalk.gray(`  headroom      ${String(remaining).padStart(7)} tokens remaining`),
+        chalk.gray(
+          `  headroom      ${String(remaining).padStart(7)} tokens remaining`,
+        ),
       );
       if (total > window) {
         logger.log(
-          chalk.red("  ⚠ exceeds the model context window — compaction required"),
+          chalk.red(
+            "  ⚠ exceeds the model context window — compaction required",
+          ),
+        );
+      }
+
+      if (sourceReport) {
+        logger.log("");
+        logger.log(
+          chalk.bold("By source") +
+            chalk.gray(`  (project memory for ${sourceReport.cwd})`),
+        );
+        if (sourceReport.instructions.length) {
+          for (const s of sourceReport.instructions) {
+            logger.log(
+              chalk.gray(`  · ${String(s.scope).padEnd(7)} `) +
+                `${String(s.tokens).padStart(7)}  ${s.source}` +
+                (s.truncated ? chalk.yellow("  (truncated)") : ""),
+            );
+          }
+          logger.log(
+            chalk.gray("    project-memory subtotal ") +
+              `${String(sourceReport.instructionTokens).padStart(7)} tokens`,
+          );
+        } else {
+          logger.log(
+            chalk.gray("  (no project-memory instruction files for this cwd)"),
+          );
+        }
+        logger.log("");
+        for (const s of sourceReport.ranked) {
+          logger.log(
+            `  ${String(s.source).padEnd(30)} ${String(s.tokens).padStart(7)}  ` +
+              `${chalk.cyan(bar(s.share))} ${String(Math.round(s.share * 100)).padStart(3)}%`,
+          );
+        }
+        logger.log(
+          chalk.gray(
+            "  note: instructions reflect the current cwd (what a new run here",
+          ),
+        );
+        logger.log(
+          chalk.gray(
+            "  would load); messages are this session's stored turns. Skill / MCP",
+          ),
+        );
+        logger.log(
+          chalk.gray(
+            "  tool schemas load at runtime and are not counted here.",
+          ),
         );
       }
     });

package/src/commands/doctor.js

@@ -1,12 +1,80 @@
 import chalk from "chalk";
+import { existsSync, readdirSync, writeFileSync } from "node:fs";
+import { join as pathJoin } from "node:path";
 import logger from "../lib/logger.js";
-import { collectDoctorReport } from "../runtime/diagnostics.js";
+import {
+  collectDoctorReport,
+  collectWorktrees,
+  buildDoctorDiagnosticInput,
+} from "../runtime/diagnostics.js";
+import { getHomeDir } from "../lib/paths.js";
+import { exportDiagnosticBundle } from "../lib/diagnostic-bundle.js";
 import {
   collectCheckupSections,
   runCheckupFixes,
   unsafeFixCommands,
 } from "../lib/doctor-checkup.js";
 
+/** Best-effort top-level `*.lock` files under the config home dir. */
+function collectLockfiles() {
+  try {
+    const home = getHomeDir();
+    if (!home || !existsSync(home)) return [];
+    return readdirSync(home)
+      .filter((f) => f.endsWith(".lock"))
+      .map((f) => pathJoin(home, f));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Assemble a de-identified diagnostic bundle from the live doctor report and
+ * run the mandatory secret-scan gate. On a clean gate, writes JSON to `outPath`
+ * (or prints it) and returns `{ ok: true }`. If the gate blocks (residual
+ * secret — defense-in-depth, should not happen post-redaction), prints the leak
+ * locations and returns `{ ok: false }` without exporting.
+ */
+export async function runExportBundle(report, outPath) {
+  const input = buildDoctorDiagnosticInput(report, {
+    env: process.env,
+    worktrees: collectWorktrees(),
+    lockfiles: collectLockfiles(),
+  });
+  const { ok, bundle, findings } = exportDiagnosticBundle(input);
+
+  if (!ok) {
+    logger.log(
+      chalk.red(
+        "\n  ✖ Diagnostic bundle blocked by secret scan (not exported).",
+      ),
+    );
+    for (const f of findings) {
+      logger.log(chalk.gray(`    ${f.path || "?"}: ${f.category || "secret"}`));
+    }
+    process.exitCode = 1;
+    return { ok: false };
+  }
+
+  const json = JSON.stringify(bundle, null, 2);
+  if (outPath) {
+    writeFileSync(outPath, json, "utf-8");
+    logger.log(
+      chalk.green(
+        `\n  ✔ De-identified diagnostic bundle written to ${outPath}`,
+      ),
+    );
+    logger.log(
+      chalk.gray(
+        "    Excludes source, API keys, cookies, env values and terminal output.",
+      ),
+    );
+  } else {
+    console.log(json);
+  }
+  return { ok: true };
+}
+
 const LEVEL_ICON = {
   ok: () => chalk.green("✔"),
   warn: () => chalk.yellow("⚠"),
@@ -21,8 +89,24 @@ export function registerDoctorCommand(program) {
     .description("Diagnose your ChainlessChain environment (alias: checkup)")
     .option("--json", "Output as machine-readable JSON")
     .option("--fix", "Apply safe fixes (stale job files, git worktree prune)")
+    .option(
+      "--export-bundle [path]",
+      "Export a de-identified diagnostic bundle (secret-scanned; excludes source/keys/env values). Writes to <path>, or stdout when no path is given.",
+    )
     .action(async (options) => {
       const report = await collectDoctorReport();
+
+      // One-click de-identified diagnostic bundle. Bypasses the human-readable
+      // render entirely: it is a support artifact, not a terminal read-out.
+      if (options.exportBundle !== undefined) {
+        const outPath =
+          typeof options.exportBundle === "string"
+            ? options.exportBundle
+            : null;
+        await runExportBundle(report, outPath);
+        return;
+      }
+
       const sections = await collectCheckupSections({ cwd: process.cwd() });
       const fixResults = options.fix ? await runCheckupFixes(sections) : null;
 

package/src/commands/hook.js

@@ -101,10 +101,7 @@ export function registerHookCommand(program) {
           }
           const events = Object.keys(settingsHooks);
           if (events.length > 0) {
-            const n = events.reduce(
-              (a, e) => a + settingsHooks[e].length,
-              0,
-            );
+            const n = events.reduce((a, e) => a + settingsHooks[e].length, 0);
             logger.log(chalk.bold(`\n.claude/settings.json hooks (${n}):`));
             for (const ev of events) {
               if (options.event && ev !== options.event) continue;
@@ -145,7 +142,8 @@ export function registerHookCommand(program) {
           settingsFile: options.settings,
         });
         const matched = collectHooks(hooks, event, tool);
-        const toolInput = args && args.length ? { command: args.join(" "), args } : {};
+        const toolInput =
+          args && args.length ? { command: args.join(" "), args } : {};
         const payload = {
           hook_event_name: event,
           tool_name: tool,
@@ -156,14 +154,18 @@ export function registerHookCommand(program) {
 
         if (!options.run) {
           if (options.json) {
-            console.log(JSON.stringify({ event, tool, matched, payload }, null, 2));
+            console.log(
+              JSON.stringify({ event, tool, matched, payload }, null, 2),
+            );
           } else if (matched.length === 0) {
             logger.log(
               chalk.gray(`no settings.json hooks match ${event} / ${tool}`),
             );
           } else {
             logger.log(
-              chalk.bold(`${matched.length} hook(s) would fire for ${event} / ${tool}:`),
+              chalk.bold(
+                `${matched.length} hook(s) would fire for ${event} / ${tool}:`,
+              ),
             );
             for (const h of matched) logger.log(`  ${chalk.gray(h.command)}`);
             logger.log(chalk.dim("  (use --run to execute and see decisions)"));
@@ -201,6 +203,178 @@ export function registerHookCommand(program) {
       }
     });
 
+  // hook replay — replay a recorded hook delivery by event id (P2 event bus).
+  // Dry-run by default; --run executes observe-only hooks. A DECISION hook can
+  // re-gate control flow, so its replay is refused without an explicit sandbox
+  // (and, since a real sandbox executor is not yet available, is never executed
+  // — only its dry-run plan is shown).
+  hook
+    .command("replay <event-id>")
+    .description(
+      "Replay a recorded hook delivery (needs CC_HOOK_EVENT_LOG); dry-run by default, --run executes observe-only hooks",
+    )
+    .option("--run", "Execute the replayed hooks (observe-only events only)")
+    .option(
+      "--sandbox",
+      "Assert an explicit sandbox for a decision-hook replay",
+    )
+    .option("--file <path>", "Read from a specific hook event log file")
+    .option("--json", "Output as JSON")
+    .action(async (eventId, options) => {
+      try {
+        const { findHookEvent } = await import("../lib/hook-event-log.cjs");
+        const { planHookReplay } = await import("../lib/hook-event-bus.cjs");
+        const envelope = findHookEvent(eventId, { filePath: options.file });
+        if (!envelope) {
+          logger.error(
+            `hook event "${eventId}" not found` +
+              (options.file
+                ? ""
+                : " (enable recording with CC_HOOK_EVENT_LOG=1)"),
+          );
+          process.exitCode = 1;
+          return;
+        }
+        const plan = planHookReplay(envelope, {
+          sandbox: Boolean(options.sandbox),
+        });
+        if (!plan.ok) {
+          if (options.json) {
+            console.log(JSON.stringify(plan, null, 2));
+          } else {
+            logger.error(`cannot replay: ${plan.reason}`);
+          }
+          process.exitCode = 1;
+          return;
+        }
+        // Decision events re-gate flow; a real sandbox executor is still owed,
+        // so we never EXECUTE them — the dry-run plan is shown instead.
+        if (options.run && plan.requiresSandbox) {
+          const note =
+            "decision-hook execution needs a real sandbox executor (not yet available); showing dry-run plan";
+          if (options.json) {
+            console.log(
+              JSON.stringify({ ...plan, executed: false, note }, null, 2),
+            );
+          } else {
+            logger.warn(`${note}:`);
+            logger.log(JSON.stringify(plan.payload, null, 2));
+          }
+          return;
+        }
+        if (!options.run) {
+          if (options.json) {
+            console.log(JSON.stringify({ ...plan, executed: false }, null, 2));
+          } else {
+            logger.log(
+              chalk.bold(
+                `replay (dry-run) of ${plan.event_type} [${plan.event_id}]`,
+              ),
+            );
+            if (plan.requiresSandbox)
+              logger.log(chalk.dim("  (decision event — sandboxed)"));
+            logger.log(JSON.stringify(plan.payload, null, 2));
+            logger.log(
+              chalk.dim("  (use --run to execute observe-only hooks)"),
+            );
+          }
+          return;
+        }
+        // observe-only + --run: re-collect and execute the matching hooks.
+        const { loadHooks, collectHooks } =
+          await import("../lib/settings-hooks.cjs");
+        const { runHooks } = await import("../lib/hook-runner.cjs");
+        const { hooks } = loadHooks({ cwd: process.cwd() });
+        const matched = collectHooks(
+          hooks,
+          plan.event_type,
+          plan.payload.tool_name || "",
+        );
+        const outcome = runHooks(matched, plan.payload, {
+          cwd: process.cwd(),
+          event: plan.event_type,
+        });
+        if (options.json) {
+          console.log(
+            JSON.stringify({ ...plan, executed: true, outcome }, null, 2),
+          );
+        } else {
+          logger.log(
+            chalk.bold(
+              `replayed ${plan.event_type} [${plan.event_id}] → ${outcome.results.length} hook(s)`,
+            ),
+          );
+          for (const r of outcome.results) {
+            logger.log(
+              `  ${chalk.gray(r.command)} → ${r.decision}` +
+                (r.exitCode != null ? ` (exit ${r.exitCode})` : ""),
+            );
+          }
+        }
+      } catch (err) {
+        logger.error(`hook replay failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
+  // hook events-log — list / verify the recorded hook delivery log.
+  hook
+    .command("events-log")
+    .description(
+      "List or verify the recorded hook delivery log (CC_HOOK_EVENT_LOG)",
+    )
+    .option("--limit <n>", "Max entries to show", "20")
+    .option("--verify", "Verify the hash chain instead of listing")
+    .option("--file <path>", "Read from a specific hook event log file")
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        const { listHookEvents, verifyHookEventChain, hookEventLogPath } =
+          await import("../lib/hook-event-log.cjs");
+        if (options.verify) {
+          const result = verifyHookEventChain({ filePath: options.file });
+          if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+          } else if (result.ok) {
+            logger.success(
+              `hook event log chain OK (${result.length} record(s))`,
+            );
+          } else {
+            logger.error(
+              `hook event log chain BROKEN at #${result.brokenAt}: ${result.reason}`,
+            );
+            process.exitCode = 1;
+          }
+          return;
+        }
+        const events = listHookEvents({
+          limit: parseInt(options.limit, 10) || 20,
+          filePath: options.file,
+        });
+        const logPath = options.file || hookEventLogPath();
+        if (options.json) {
+          console.log(JSON.stringify({ events, path: logPath }, null, 2));
+          return;
+        }
+        if (events.length === 0) {
+          logger.info(
+            `No recorded hook events (enable with CC_HOOK_EVENT_LOG=1). Log: ${logPath}`,
+          );
+          return;
+        }
+        logger.log(chalk.bold(`Recorded hook events (${events.length}):\n`));
+        for (const e of events) {
+          logger.log(
+            `  ${chalk.cyan(e.event_id)} ${chalk.yellow(e.event_type)}` +
+              (e.session_id ? ` session=${e.session_id}` : ""),
+          );
+        }
+      } catch (err) {
+        logger.error(`hook events-log failed: ${err.message}`);
+        process.exitCode = 1;
+      }
+    });
+
   // hook add
   hook
     .command("add")