claude-crap 0.1.2

package/scripts/bug-report.mjs

@@ -0,0 +1,328 @@
+// @ts-check
+/**
+ * `claude-crap bug-report` — generate a diagnostic bundle for triage.
+ *
+ * Inspired by claude-mem's `npm run bug-report`. Collects every piece
+ * of information a maintainer typically asks for when triaging an
+ * issue and writes it to a single Markdown file under the current
+ * workspace (or stdout with `--stdout`).
+ *
+ * The report never contains secrets — we redact every environment
+ * variable whose name looks sensitive (`*TOKEN`, `*KEY`, `*PASSWORD`,
+ * etc.) before writing it. The user should still skim the file before
+ * pasting it into a public issue, but the defaults are safe.
+ *
+ * Contents of the report:
+ *
+ *   1. Header — timestamp, plugin version, Node version, OS
+ *   2. Plugin file presence (same 9 files the doctor checks)
+ *   3. Resolved CLAUDE_PLUGIN_OPTION_* env vars (redacted)
+ *   4. Build state — `dist/index.js` mtime and size
+ *   5. `doctor` output — we run the doctor subcommand and capture its stdout
+ *   6. Recent SARIF report summary if one exists
+ *   7. Hook script permission bits
+ *
+ * Usage:
+ *
+ *   node ./scripts/bug-report.mjs            # writes ./claude-crap-bug-report-<ts>.md
+ *   node ./scripts/bug-report.mjs --stdout   # prints to stdout instead
+ *   node ./scripts/bug-report.mjs -o foo.md  # explicit output path
+ *
+ * Exits 0 on success regardless of individual check outcomes —
+ * collecting the report is the goal, not passing every probe.
+ *
+ * @module scripts/bug-report
+ */
+
+import { spawnSync } from "node:child_process";
+import { promises as fs } from "node:fs";
+import { createRequire } from "node:module";
+import { arch, platform, release, userInfo } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PLUGIN_ROOT = resolve(HERE, "..");
+
+const REQUIRED_FILES = [
+  "package.json",
+  "plugin/.claude-plugin/plugin.json",
+  "plugin/.mcp.json",
+  "plugin/CLAUDE.md",
+  "plugin/hooks/hooks.json",
+  "plugin/hooks/pre-tool-use.mjs",
+  "plugin/hooks/post-tool-use.mjs",
+  "plugin/hooks/stop-quality-gate.mjs",
+  "plugin/hooks/session-start.mjs",
+  "dist/index.js",
+  "plugin/bundle/mcp-server.mjs",
+];
+
+/**
+ * Regex identifying env var names that should be redacted. We never
+ * write the actual value for matches — just the name and `<redacted>`.
+ */
+const SENSITIVE_ENV_PATTERN = /(TOKEN|KEY|SECRET|PASSWORD|AUTH|COOKIE|CREDENTIAL|BEARER)/i;
+
+/**
+ * Entry point. When required as a module, use {@link generateBugReport}
+ * directly — this default export is just the CLI wrapper.
+ *
+ * @param {{pluginRoot: string, argv: string[]}} ctx
+ * @returns {Promise<number>}
+ */
+export default async function bugReportCommand(ctx) {
+  const argv = ctx.argv;
+  const useStdout = argv.includes("--stdout");
+  const outIdx = argv.indexOf("-o");
+  const explicitOut = outIdx >= 0 ? argv[outIdx + 1] : undefined;
+
+  const report = await generateBugReport(ctx.pluginRoot);
+
+  if (useStdout) {
+    process.stdout.write(report);
+    return 0;
+  }
+
+  const outPath =
+    explicitOut ??
+    join(process.cwd(), `claude-crap-bug-report-${timestampSlug()}.md`);
+  await fs.writeFile(outPath, report, "utf8");
+  process.stdout.write(`claude-crap: bug report written to ${outPath}\n`);
+  return 0;
+}
+
+/**
+ * Build the full Markdown bug report string. Pure-ish — reads env and
+ * filesystem but does not write anywhere. Exported so other scripts
+ * (or tests) can embed it without shelling out.
+ *
+ * @param {string} pluginRoot Absolute plugin root.
+ * @returns {Promise<string>}
+ */
+export async function generateBugReport(pluginRoot) {
+  const lines = [];
+
+  // --- header ---
+  lines.push(`# claude-crap bug report`);
+  lines.push("");
+  lines.push(`_Generated: ${new Date().toISOString()}_`);
+  lines.push("");
+
+  const version = await readPackageVersion(pluginRoot);
+  lines.push(`| Field | Value |`);
+  lines.push(`| --- | --- |`);
+  lines.push(`| claude-crap version | \`${version}\` |`);
+  lines.push(`| Node.js | \`${process.versions.node}\` |`);
+  lines.push(`| npm | \`${tryExec("npm", ["-v"])}\` |`);
+  lines.push(`| Platform | \`${platform()} ${release()} ${arch()}\` |`);
+  lines.push(`| Shell | \`${process.env.SHELL ?? "unknown"}\` |`);
+  lines.push(`| User (login) | \`${safeUser()}\` |`);
+  lines.push(`| CWD | \`${process.cwd()}\` |`);
+  lines.push(`| Plugin root | \`${pluginRoot}\` |`);
+  lines.push("");
+
+  // --- plugin files ---
+  lines.push(`## Plugin files`);
+  lines.push("");
+  lines.push(`| File | Present |`);
+  lines.push(`| --- | :---: |`);
+  for (const rel of REQUIRED_FILES) {
+    const full = join(pluginRoot, rel);
+    const present = await exists(full);
+    lines.push(`| \`${rel}\` | ${present ? "✅" : "❌"} |`);
+  }
+  lines.push("");
+
+  // --- build state ---
+  lines.push(`## Build state`);
+  lines.push("");
+  const distEntry = join(pluginRoot, "dist", "index.js");
+  try {
+    const stat = await fs.stat(distEntry);
+    lines.push(`- npm entry: \`${distEntry}\``);
+    lines.push(`  - Size: ${stat.size} bytes`);
+    lines.push(`  - Modified: ${new Date(stat.mtimeMs).toISOString()}`);
+  } catch {
+    lines.push(`- npm entry: \`${distEntry}\` is missing. Run \`npm run build\`.`);
+  }
+  const gitEntry = join(pluginRoot, "plugin", "bundle", "mcp-server.mjs");
+  try {
+    const stat = await fs.stat(gitEntry);
+    lines.push(`- git entry: \`${gitEntry}\``);
+    lines.push(`  - Size: ${stat.size} bytes`);
+    lines.push(`  - Modified: ${new Date(stat.mtimeMs).toISOString()}`);
+  } catch {
+    lines.push(`- git entry: \`${gitEntry}\` is missing. Run \`npm run build:plugin\`.`);
+  }
+  lines.push("");
+
+  // --- env vars (redacted) ---
+  lines.push(`## Environment (CLAUDE_* + CLAUDE_PLUGIN_OPTION_*, redacted)`);
+  lines.push("");
+  const relevantEnv = Object.entries(process.env)
+    .filter(([k]) => k.startsWith("CLAUDE"))
+    .sort(([a], [b]) => a.localeCompare(b));
+  if (relevantEnv.length === 0) {
+    lines.push(`_No claude-crap env vars set._`);
+  } else {
+    lines.push("```");
+    for (const [k, v] of relevantEnv) {
+      const value =
+        SENSITIVE_ENV_PATTERN.test(k) && v && v.length > 0 ? "<redacted>" : String(v ?? "");
+      lines.push(`${k}=${value}`);
+    }
+    lines.push("```");
+  }
+  lines.push("");
+
+  // --- doctor output ---
+  lines.push(`## \`claude-crap doctor\` output`);
+  lines.push("");
+  lines.push("```");
+  const doctorBin = join(pluginRoot, "bin", "claude-crap.mjs");
+  const doctor = spawnSync(process.execPath, [doctorBin, "doctor"], {
+    env: { ...process.env, NO_COLOR: "1" },
+    encoding: "utf8",
+  });
+  lines.push(stripAnsi(doctor.stdout ?? ""));
+  if (doctor.stderr) lines.push(stripAnsi(doctor.stderr));
+  lines.push(`[exit code: ${doctor.status ?? "null"}]`);
+  lines.push("```");
+  lines.push("");
+
+  // --- SARIF report (if any) ---
+  lines.push(`## Consolidated SARIF report`);
+  lines.push("");
+  const sarifPath = join(process.cwd(), ".claude-crap", "reports", "latest.sarif");
+  if (await exists(sarifPath)) {
+    try {
+      const raw = await fs.readFile(sarifPath, "utf8");
+      const doc = JSON.parse(raw);
+      const findings =
+        Array.isArray(doc?.runs) && Array.isArray(doc.runs[0]?.results)
+          ? doc.runs[0].results.length
+          : 0;
+      lines.push(`- Path: \`${sarifPath}\``);
+      lines.push(`- SARIF version: \`${doc.version ?? "unknown"}\``);
+      lines.push(`- Findings: ${findings}`);
+    } catch (err) {
+      lines.push(`- Could not parse \`${sarifPath}\`: ${/** @type {Error} */ (err).message}`);
+    }
+  } else {
+    lines.push(`_No consolidated SARIF report at \`${sarifPath}\` yet._`);
+  }
+  lines.push("");
+
+  // --- footer ---
+  lines.push(`## How to file this`);
+  lines.push("");
+  lines.push(
+    `1. Review this file for anything sensitive that slipped past the redactor.`,
+  );
+  lines.push(`2. Open a new issue at the plugin repository.`);
+  lines.push(`3. Paste this entire file as the issue body, or attach it directly.`);
+  lines.push("");
+
+  return lines.join("\n") + "\n";
+}
+
+/**
+ * Read the plugin version from `package.json`.
+ *
+ * @param {string} pluginRoot
+ * @returns {Promise<string>}
+ */
+async function readPackageVersion(pluginRoot) {
+  try {
+    const require_ = createRequire(import.meta.url);
+    const pkg = require_(join(pluginRoot, "package.json"));
+    return String(pkg.version ?? "unknown");
+  } catch {
+    return "unknown";
+  }
+}
+
+/**
+ * Run a shell command and return its trimmed stdout, or `"unknown"`
+ * when it fails. Used for optional diagnostics like `npm -v` that
+ * should never fail the report.
+ *
+ * @param {string}   cmd
+ * @param {string[]} args
+ * @returns {string}
+ */
+function tryExec(cmd, args) {
+  try {
+    const r = spawnSync(cmd, args, { encoding: "utf8" });
+    return (r.stdout ?? "unknown").trim();
+  } catch {
+    return "unknown";
+  }
+}
+
+/**
+ * Return the current login name, defaulting to `"unknown"` when we
+ * cannot read it (sandboxed environments, non-interactive runs).
+ *
+ * @returns {string}
+ */
+function safeUser() {
+  try {
+    return userInfo().username;
+  } catch {
+    return "unknown";
+  }
+}
+
+/**
+ * `true` when `path` exists on disk.
+ *
+ * @param {string} path
+ * @returns {Promise<boolean>}
+ */
+async function exists(path) {
+  try {
+    await fs.access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Strip ANSI color escapes from a string. The doctor command inherits
+ * `NO_COLOR=1` so its output should already be plain, but we defend
+ * against pino loggers or npm wrappers that inject colors anyway.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function stripAnsi(input) {
+  // eslint-disable-next-line no-control-regex
+  return input.replace(/\x1b\[[0-9;]*m/g, "");
+}
+
+/**
+ * Filesystem-safe ISO timestamp suitable for a filename (no colons).
+ *
+ * @returns {string}
+ */
+function timestampSlug() {
+  return new Date().toISOString().replace(/[:.]/g, "-").replace(/Z$/, "");
+}
+
+// When run directly via `node ./scripts/bug-report.mjs`, delegate to
+// the CLI wrapper. When imported by bin/claude-crap.mjs, the default
+// export is consumed instead.
+const isDirectInvocation =
+  import.meta.url === `file://${process.argv[1]}` ||
+  process.argv[1]?.endsWith("bug-report.mjs");
+if (isDirectInvocation) {
+  bugReportCommand({ pluginRoot: PLUGIN_ROOT, argv: process.argv.slice(2) })
+    .then((code) => process.exit(code ?? 0))
+    .catch((err) => {
+      process.stderr.write(`claude-crap bug-report: ${err?.message ?? err}\n`);
+      process.exit(1);
+    });
+}

package/scripts/build-fast.mjs

@@ -0,0 +1,130 @@
+// @ts-check
+/**
+ * `npm run build:fast` — fast dev build using esbuild.
+ *
+ * `tsc` remains the canonical build tool (it produces `.d.ts`
+ * declaration files, runs the full type checker, and is the one the
+ * CI pipeline + `np release` call) — but for the inner loop it is
+ * slow to feel. esbuild compiles the entire `src/` tree to `dist/`
+ * in under 100 ms on a modern laptop, which matters when you're
+ * rebuilding after every keystroke.
+ *
+ * Trade-offs vs. `tsc`:
+ *
+ *   - ✅ 10-20x faster
+ *   - ❌ No type checking (run `npm run typecheck` separately)
+ *   - ❌ No `.d.ts` files (so `exports` with `types` would not work)
+ *   - ❌ No declaration maps
+ *
+ * The script walks `src/` for all `.ts` files (excluding tests and
+ * declaration files), then hands them to esbuild as the entry point
+ * list so every file gets its own output mirror. That matches what
+ * `tsc` does and keeps the `exports` map working.
+ *
+ * This build mode is strictly for local dev feedback — never use it
+ * to publish an npm release. `prepublishOnly` always calls `tsc`.
+ *
+ * Skip this build with `CLAUDE_CRAP_SKIP_FAST_BUILD=1` to short-circuit.
+ *
+ * @module scripts/build-fast
+ */
+
+import { build } from "esbuild";
+import { promises as fs } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PLUGIN_ROOT = resolve(HERE, "..");
+const SRC_DIR = join(PLUGIN_ROOT, "src");
+const DIST_DIR = join(PLUGIN_ROOT, "dist");
+
+/**
+ * Recursively walk a directory and yield every `.ts` file path that
+ * should be compiled. Mirrors the `tsconfig.json` include/exclude
+ * lists so the two build modes produce the same output set.
+ *
+ * @param {string} dir Absolute directory to walk.
+ * @returns {AsyncGenerator<string>}
+ */
+async function* walkSources(dir) {
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      // Tests are compiled by tsc and run via tsx, never by esbuild.
+      if (entry.name === "tests") continue;
+      yield* walkSources(full);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    if (!entry.name.endsWith(".ts")) continue;
+    if (entry.name.endsWith(".d.ts")) continue;
+    if (entry.name.endsWith(".test.ts")) continue;
+    yield full;
+  }
+}
+
+/**
+ * Replace the trailing `.ts` of an absolute source path with `.js`
+ * and relocate it from `src/` to `dist/`. Mirrors exactly what `tsc`
+ * does with `outDir: "./dist"` and `rootDir: "./src"`.
+ *
+ * @param {string} srcPath Absolute path inside `src/`.
+ * @returns {string}
+ */
+function srcToDist(srcPath) {
+  const rel = relative(SRC_DIR, srcPath);
+  return join(DIST_DIR, rel).replace(/\.ts$/, ".js");
+}
+
+async function main() {
+  const started = Date.now();
+  const entryPoints = [];
+  for await (const src of walkSources(SRC_DIR)) {
+    entryPoints.push(src);
+  }
+
+  // Clean dist/ so stale output from a previous `tsc` run cannot
+  // mask a missing file in the fast build. Full-tree rebuild is
+  // still under 200 ms in total.
+  await fs.rm(DIST_DIR, { recursive: true, force: true });
+  await fs.mkdir(DIST_DIR, { recursive: true });
+
+  await build({
+    entryPoints,
+    outdir: DIST_DIR,
+    outbase: SRC_DIR,
+    bundle: false,
+    format: "esm",
+    platform: "node",
+    target: ["node20"],
+    sourcemap: "linked",
+    logLevel: "warning",
+    // Preserve the existing directory layout in dist/ so the
+    // `exports` field in package.json still resolves correctly.
+    // `outbase: SRC_DIR` is what makes this work.
+  });
+
+  const durationMs = Date.now() - started;
+  const outCount = entryPoints.length;
+  process.stdout.write(
+    `claude-crap: fast build complete (${outCount} files → ${srcToDist(entryPoints[0] ?? SRC_DIR)
+      .split("/")
+      .slice(-3, -1)
+      .join("/")}, ${durationMs}ms)\n`,
+  );
+  process.stdout.write(
+    `claude-crap: NOTE — this build skipped type checking and declaration files.\n` +
+      `  Run \`npm run typecheck\` before committing, and use \`npm run build\` for releases.\n`,
+  );
+}
+
+if (process.env.CLAUDE_CRAP_SKIP_FAST_BUILD) {
+  process.exit(0);
+}
+
+main().catch((err) => {
+  process.stderr.write(`claude-crap fast build failed: ${err?.message ?? err}\n`);
+  process.exit(1);
+});

package/scripts/bundle-plugin.mjs

@@ -0,0 +1,74 @@
+// scripts/bundle-plugin.mjs
+import { build } from "esbuild";
+import { cp, mkdir, rm } from "node:fs/promises";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = resolve(fileURLToPath(import.meta.url), "../..");
+const BUNDLE_DIR = resolve(ROOT, "plugin/bundle");
+
+async function main() {
+  await rm(BUNDLE_DIR, { recursive: true, force: true });
+  await mkdir(BUNDLE_DIR, { recursive: true });
+
+  // 1. MCP server entry — bundled, externalizing native/WASM deps
+  await build({
+    entryPoints: { "mcp-server": resolve(ROOT, "src/index.ts") },
+    outdir: BUNDLE_DIR,
+    outExtension: { ".js": ".mjs" },
+    bundle: true,
+    platform: "node",
+    format: "esm",
+    target: "node20",
+    sourcemap: "linked",
+    // web-tree-sitter uses Emscripten locateFile() to find .wasm,
+    // tree-sitter-wasms ships the grammars — both MUST stay external so
+    // the runtime `createRequire(import.meta.url).resolve(...)` finds
+    // them in plugin/node_modules/ at runtime.
+    // We also externalize pino, fastify and @modelcontextprotocol/sdk due to dynamic require/ESM issues.
+    external: [
+      "web-tree-sitter",
+      "tree-sitter-wasms",
+      "pino",
+      "fastify",
+      "@fastify/static",
+      "@modelcontextprotocol/sdk"
+    ],
+    banner: {
+      js: "// Generated by scripts/bundle-plugin.mjs — DO NOT EDIT",
+    },
+  });
+
+  // 2. TDR engine — bundled standalone so hooks/lib/quality-gate.mjs
+  //    has a single entry to import classifyTdr() from.
+  await build({
+    entryPoints: { "tdr-engine": resolve(ROOT, "src/metrics/tdr.ts") },
+    outdir: BUNDLE_DIR,
+    outExtension: { ".js": ".mjs" },
+    bundle: true,
+    platform: "node",
+    format: "esm",
+    target: "node20",
+    sourcemap: "linked",
+    // TDR module is self-contained today (no external deps beyond Node
+    // builtins). Keep this list empty but explicit so a future import
+    // that pulls in a heavy dep is caught by the bundle size diff in CI.
+    external: [],
+    banner: {
+      js: "// Generated by scripts/bundle-plugin.mjs — DO NOT EDIT",
+    },
+  });
+
+  // 3. Copy dashboard static assets into the bundle so resolvePublicRoot()
+  //    can find them relative to the bundle entry.
+  await cp(
+    resolve(ROOT, "src/dashboard/public"),
+    resolve(BUNDLE_DIR, "dashboard/public"),
+    { recursive: true },
+  );
+}
+
+main().catch((err) => {
+  process.stderr.write(`bundle-plugin failed: ${err}\n`);
+  process.exit(1);
+});