nearly-cli 0.1.11 → 0.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nearly-cli",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "A pull request tells you what changed. Nearly tells you what nearly happened: the commands a human refused, the pushes policy blocked, the turns rolled back.",
   "type": "module",
   "bin": {

package/scripts/build-recap.mjs

@@ -98,7 +98,14 @@ function parseRecording(path) {
 // belongs to nobody.
 function samePath(a, b) {
   if (!a || !b) return false;
-  const real = (p) => { try { return realpathSync(resolve(p)); } catch { return resolve(p); } };
+  const real = (p) => {
+    let r;
+    try { r = realpathSync(resolve(p)); } catch { r = resolve(p); }
+    // Windows spells the same directory more than one way and means the same
+    // place. Comparing those as strings loses every session on that machine,
+    // the same way /var against /private/var did on this one.
+    return process.platform === 'win32' ? r.toLowerCase() : r;
+  };
   return real(a) === real(b);
 }
 

package/scripts/doctor.mjs

@@ -61,6 +61,50 @@ const gated = ADAPTERS.filter((a) => {
 if (gated.length) say(true, 'agents gated here', gated.map((a) => a.name).join(', '));
 else say(false, 'agents gated here', 'none', 'run `nearly` in this repo to turn it on');
 
+// Configured is not the same as working, and the difference is invisible.
+// Hooks fail open on purpose — a broken one must never wedge an agent — so a
+// command that cannot be found produces silence, and silence looks exactly like
+// a session nobody ran. Everything above can be green while nothing is gated.
+//
+// So run the hook this repo actually has, the way the agent runs it, and see
+// whether an answer comes back.
+if (gated.length) {
+  const cc = gated.find((a) => a.id === 'claude-code') || gated[0];
+  let cmd = null;
+  try {
+    const cfg = JSON.parse(readFileSync(join(repo, cc.config), 'utf8'));
+    const walk = (o) => {
+      if (!o || typeof o !== 'object') return;
+      if (typeof o.command === 'string' && /nearly/i.test(o.command) && /pre-tool/.test(o.command)) cmd = o.command;
+      for (const v of Object.values(o)) walk(v);
+    };
+    walk(cfg);
+  } catch { /* unreadable config */ }
+
+  if (!cmd) {
+    say(null, 'hooks actually fire', 'could not find the pre-tool hook to try');
+  } else {
+    const probe = JSON.stringify({
+      session_id: `nearly-doctor-${Date.now()}`, cwd: repo,
+      hook_event_name: 'PreToolUse', tool_name: 'Read',
+      tool_input: { file_path: join(repo, 'nearly-doctor-probe') }, tool_use_id: 'doctor',
+    });
+    // shell: true because the agent runs these through a shell, and on Windows
+    // the installed command is a .cmd that will not spawn any other way.
+    const r = spawnSync(cmd, { input: probe, shell: true, encoding: 'utf8', timeout: 30_000 });
+    const decided = /permissionDecision|"decision"|"permission"/.test(r.stdout || '');
+    if (decided) {
+      say(true, 'hooks actually fire', 'the gate answered a test call');
+    } else {
+      const why = (r.error && r.error.message)
+        || (r.stderr || '').trim().split('\n')[0]
+        || (r.status !== 0 ? `the hook command exited ${r.status}` : 'the hook ran but answered nothing');
+      say(false, 'hooks actually fire', why,
+        `the hook command in ${cc.config} does not work here, so nothing is gated and nothing is recorded — check that \`nearly\` runs in a plain shell, then re-run \`nearly\` to rewrite the hooks`);
+    }
+  }
+}
+
 // 3 — the server, and whether it is this build
 let health = null;
 try {
@@ -93,7 +137,11 @@ if (!health) {
 // them, so this cannot disagree with it.
 const recDir = paths.recordings();
 let runs = 0, otherBranches = new Set();
-const real = (p) => { try { return realpathSync(resolve(p)); } catch { return resolve(p); } };
+const real = (p) => {
+  let r;
+  try { r = realpathSync(resolve(p)); } catch { r = resolve(p); }
+  return process.platform === 'win32' ? r.toLowerCase() : r;   // same place, spelled differently
+};
 try {
   for (const f of readdirSync(recDir).filter((f) => f.endsWith('.jsonl'))) {
     let created = null;

package/server/adapters.mjs

@@ -362,11 +362,18 @@ export const ADAPTERS = [
       const cfg = { version: 1, hooks: {} };
       for (const [their, ours] of Object.entries(this.events)) {
         const run = cmdFor(ours);
-        // `command` is the cross-platform fallback; `bash` and `powershell` are
-        // what the runtime picks per OS. Writing all three means a Windows
-        // machine finds one whichever property it prefers — and Windows is
-        // exactly where somebody with no other option is running this.
-        cfg.hooks[their] = [{ type: 'command', command: run, bash: run, powershell: run, timeoutSec: holdFor(ours) }];
+        // Two products read this file and disagree about the key. Copilot CLI
+        // takes `bash` and `powershell`; VS Code's agent mode takes `windows`,
+        // `linux` and `osx` as per-platform overrides and does not document the
+        // other two at all. Writing both sets costs a few bytes. Guessing wrong
+        // means the hook never runs, and a hook that never runs looks exactly
+        // like a week in which nobody did any work.
+        cfg.hooks[their] = [{
+          type: 'command', command: run,
+          bash: run, powershell: run,
+          windows: run, linux: run, osx: run,
+          timeoutSec: holdFor(ours), timeout: holdFor(ours),
+        }];
       }
       writeJson(file, cfg);        // our own file; nobody else's entries to keep
       return { file };

package/server/index.mjs

@@ -351,7 +351,12 @@ function decide(sid, id, decision, why, scope = 'once') {
   clearTimeout(p.timer);
   s.pending.delete(id);
   if (scope === 'always') rules.set(p.key, decision === 'allow' ? 'log' : 'never');
-  p.respond(decision, why);
+  // One call can arrive down more than one hook — VS Code reads both
+  // .claude/settings.local.json and .github/hooks/*.json, so a repo wired for
+  // Claude Code and Copilot fires twice for the same tool_use_id. Everyone who
+  // asked gets the same answer; answering only the last one left the first hook
+  // hanging until the agent's own timeout, which looks like the agent freezing.
+  for (const r of p.responders) r(decision, why);
   record(sid, { type: 'decision', id, decision, why, scope, tool: p.tool, key: p.key, waitedMs: Date.now() - p.at });
   if (s.pending.size === 0 && s.state === 'waiting') s.state = 'working';
   broadcast({ type: 'session-state', session: sid, state: s.state });
@@ -440,7 +445,11 @@ const server = http.createServer(async (req, res) => {
       // else gets to decide by not answering.
       const asked = Number(url.searchParams.get('hold')) || 0;
       const holdMs = asked > 0 ? Math.min(asked, ASK_TIMEOUT_MS) : ASK_TIMEOUT_MS;
-      const item = { id, sid, tool: shown, input: hook.tool_input, tier, reason, key: ruleKey(hook), at: Date.now(), holdMs, respond };
+      // Same call, second hook: join the question already being asked rather
+      // than replacing it, so the person is not asked twice about one thing.
+      const already = s.pending.get(id);
+      if (already) { already.responders.push(respond); return; }
+      const item = { id, sid, tool: shown, input: hook.tool_input, tier, reason, key: ruleKey(hook), at: Date.now(), holdMs, responders: [respond] };
       item.timer = setTimeout(() => decide(sid, id, 'deny',
         `no human answer in ${Math.round(holdMs / 1000)}s; nearly fails closed`), holdMs);
       s.pending.set(id, item);