shakers-cli 0.0.0-stage → 0.14.0

package/src/scope-signals.js

@@ -0,0 +1,148 @@
+'use strict';
+
+const { collectGitActivity } = require('./git-activity');
+const { collectWorkStreams } = require('./work-streams');
+const { collectDetectionEvidence } = require('./detection-evidence');
+
+function round2(n) {
+  return Math.round(n * 100) / 100;
+}
+
+function maxOrNull(a, b) {
+  if (a === null || a === undefined) return b ?? null;
+  if (b === null || b === undefined) return a;
+  return Math.max(a, b);
+}
+
+function minOrNull(a, b) {
+  if (a === null || a === undefined) return b ?? null;
+  if (b === null || b === undefined) return a;
+  return Math.min(a, b);
+}
+
+function mergeGitActivity(list) {
+  const present = list.filter(Boolean);
+  if (present.length === 0) return null;
+  const filesByType = {};
+  let commitCount = 0;
+  let authoredCommitCount = 0;
+  let linesAdded = 0;
+  let linesDeleted = 0;
+  let spanDays = 0;
+  for (const g of present) {
+    commitCount += g.commitCount;
+    authoredCommitCount += g.authoredCommitCount;
+    linesAdded += g.linesAdded;
+    linesDeleted += g.linesDeleted;
+    spanDays = Math.max(spanDays, g.spanDays);
+    for (const [ext, c] of Object.entries(g.filesByType || {})) {
+      filesByType[ext] = (filesByType[ext] || 0) + c;
+    }
+  }
+  return {
+    commitCount,
+    authoredCommitCount,
+    linesAdded,
+    linesDeleted,
+    filesByType,
+    velocity: round2(commitCount / Math.max(spanDays, 1)),
+    spanDays,
+  };
+}
+
+function mergeWorkStreams(list) {
+  const present = list.filter(Boolean);
+  if (present.length === 0) return null;
+  let streamCount = 0;
+  let multiDayStreams = 0;
+  let maxStreamSpanDays = 0;
+  let sumAvg = 0;
+  for (const w of present) {
+    streamCount += w.streamCount;
+    multiDayStreams += w.multiDayStreams;
+    maxStreamSpanDays = Math.max(maxStreamSpanDays, w.maxStreamSpanDays);
+    sumAvg += w.avgCommitsPerSession;
+  }
+  return {
+    streamCount,
+    multiDayStreams,
+    avgCommitsPerSession: round2(sumAvg / present.length),
+    maxStreamSpanDays,
+  };
+}
+
+function mergeCandidate(existing, incoming) {
+  existing.authoredFileCount += incoming.authoredFileCount;
+  existing.totalFileCount += incoming.totalFileCount;
+  existing.authorshipKnown = existing.authorshipKnown || incoming.authorshipKnown;
+  existing.depth = maxOrNull(existing.depth, incoming.depth);
+  existing.recencyDays = minOrNull(existing.recencyDays, incoming.recencyDays);
+  existing.vendored = existing.vendored && incoming.vendored;
+}
+
+function agentKey(a) {
+  return `${a.name}|${(a.tools || []).join(',')}|${a.model || ''}`;
+}
+
+function mergeProvenance(a, b) {
+  if (!b) return a;
+  if (!a) return { ...b };
+  return {
+    fork: a.fork || b.fork,
+    forkSignal: a.forkSignal || b.forkSignal || null,
+    boilerplate: a.boilerplate || b.boilerplate,
+    boilerplateMarker: a.boilerplateMarker || b.boilerplateMarker || null,
+  };
+}
+
+function mergeDetectionEvidence(list) {
+  const present = list.filter(Boolean);
+  if (present.length === 0) return null;
+  const skillsByTech = new Map();
+  const agentsByKey = new Map();
+  let provenance = null;
+  for (const de of present) {
+    for (const s of de.skills || []) {
+      const existing = skillsByTech.get(s.tech);
+      if (!existing) skillsByTech.set(s.tech, { ...s });
+      else mergeCandidate(existing, s);
+    }
+    for (const a of de.agents || []) {
+      const k = agentKey(a);
+      const existing = agentsByKey.get(k);
+      if (!existing) agentsByKey.set(k, { ...a });
+      else mergeCandidate(existing, a);
+    }
+    provenance = mergeProvenance(provenance, de.provenance);
+  }
+  return {
+    skills: [...skillsByTech.values()],
+    agents: [...agentsByKey.values()],
+    provenance,
+  };
+}
+
+function collectScopedGitActivity(toplevels, verifiedEmail) {
+  return mergeGitActivity(
+    toplevels.map((root) => collectGitActivity(root, verifiedEmail)),
+  );
+}
+
+function collectScopedWorkStreams(toplevels) {
+  return mergeWorkStreams(toplevels.map((root) => collectWorkStreams(root)));
+}
+
+function collectScopedDetectionEvidence(toplevels, verifiedEmail, report) {
+  return mergeDetectionEvidence(
+    toplevels.map((root) => collectDetectionEvidence(root, verifiedEmail, report)),
+  );
+}
+
+module.exports = {
+  mergeGitActivity,
+  mergeWorkStreams,
+  mergeDetectionEvidence,
+  collectScopedGitActivity,
+  collectScopedWorkStreams,
+  collectScopedDetectionEvidence,
+};

package/src/secret-prompt.js

@@ -0,0 +1,72 @@
+'use strict';
+
+// SECRET PROMPT — reads a secret WITHOUT painting it (issue 102).
+
+const CTRL_C = '\u0003';
+const CTRL_D = '\u0004';
+const BACKSPACE = /[\u0008\u007f]/;
+
+// Reads a secret from a RAW tty.
+function readSecretRaw({ input, output, mask = '' } = {}) {
+  return new Promise((resolve, reject) => {
+    let value = '';
+    let done = false;
+
+    const restore = () => {
+      if (done) return;
+      done = true;
+      // Order matters: stop listening BEFORE leaving raw mode, so a keystroke that
+      // arrives during teardown is not delivered to a half-restored terminal.
+      try { input.removeListener('data', onData); } catch { /* already gone */ }
+      if (input.setRawMode) { try { input.setRawMode(false); } catch { /* not a TTY any more */ } }
+    };
+
+    function onData(chunk) {
+      const s = String(chunk);
+      for (const ch of s) {
+        if (ch === '\r' || ch === '\n') {
+          restore();
+          output.write('\n');
+          resolve(value);
+          return;
+        }
+        if (ch === CTRL_C || ch === CTRL_D) {
+          // Restore FIRST, then report the cancellation: whatever the caller does
+          // with it (exit, retry), the terminal is already usable.
+          restore();
+          output.write('\n');
+          resolve(null);
+          return;
+        }
+        if (BACKSPACE.test(ch)) {
+          if (value.length) {
+            value = value.slice(0, -1);
+            // Only erase on screen if something was drawn there.
+            if (mask) output.write('\b \b');
+          }
+          continue;
+        }
+        // Ignore the rest of the C0 controls (arrows arrive as escape sequences and
+        // would otherwise land inside the secret).
+        if (ch < ' ') continue;
+        value += ch;
+        if (mask) output.write(mask);
+      }
+    }
+
+    try {
+      if (input.setRawMode) input.setRawMode(true);
+      if (input.resume) input.resume();
+      input.on('data', onData);
+    } catch (err) {
+      restore();
+      reject(err);
+    }
+  });
+}
+
+function canPromptSecretly(input) {
+  return !!(input && input.isTTY && typeof input.setRawMode === 'function');
+}
+
+module.exports = { readSecretRaw, canPromptSecretly };

package/src/session-gate.js

@@ -0,0 +1,30 @@
+'use strict';
+
+// Whether a non-exempt command may run: an active session, or a durable cookie
+// that can mint a fresh hub JWT right now. Reject only when neither holds.
+
+const { loadAuthSession, sessionStatus } = require('./auth-session-store');
+const { ensureFreshSession } = require('./session-refresh');
+
+function jwtUsable(session, now) {
+  const exp = Date.parse(String((session && session.accessTokenExpiresAt) || ''));
+  return Number.isFinite(exp) && exp > now;
+}
+
+async function hasUsableSession(env = process.env, deps = {}) {
+  const {
+    loadAuthSession: load = loadAuthSession,
+    ensureFreshSession: refresh = ensureFreshSession,
+    now = Date.now(),
+  } = deps;
+
+  const session = load(env);
+  if (sessionStatus(session, now) === 'active') return true;
+  if (!session || !session.cookie) return false;
+
+  let refreshed = null;
+  try { refreshed = await refresh(env, { now }); } catch { refreshed = null; }
+  return jwtUsable(refreshed || load(env), now);
+}
+
+module.exports = { hasUsableSession, jwtUsable };

package/src/session-normalizers.js

@@ -0,0 +1,174 @@
+'use strict';
+
+// Input normalizers: map a RAW session record into the Claude-shaped internal object model
+// that session-scan harvest + transcript-turns already consume
+// ({ cwd, timestamp, type, message:{ role, content:[{type:'text'|'tool_use', ...}] } }).
+// They ONLY translate input shape — downstream redaction/upload (share.js#derivePayload
+// -> POST usage/reports) is unchanged; no field is read that the Claude path didn't expose.
+// FAIL-CLOSED: every normalizer returns null / [] when a record does not match the expected
+// shape — it never fabricates or guesses fields. A documented format that differs from the
+// real one yields "no data for that tool", never wrong data.
+
+function str(v) {
+  return typeof v === 'string' && v ? v : null;
+}
+
+function textFromParts(parts) {
+  if (typeof parts === 'string') return parts.trim() || null;
+  if (!Array.isArray(parts)) return null;
+  const out = [];
+  for (const p of parts) {
+    if (typeof p === 'string') out.push(p);
+    else if (p && typeof p === 'object' && typeof p.text === 'string') out.push(p.text);
+  }
+  const joined = out.join('').trim();
+  return joined || null;
+}
+
+// --- Codex (~/.codex/sessions/**/rollout-*.jsonl) ---
+// Reads timestamp, cwd (session_meta), user text, and shell commands; a record matching none
+// of those passes through only its own real timestamp/cwd, else is dropped.
+function codexCommand(args) {
+  let a = args;
+  if (typeof a === 'string') {
+    try { a = JSON.parse(a); } catch { return a.trim() || null; }
+  }
+  if (!a || typeof a !== 'object') return null;
+  const cmd = a.command ?? a.cmd ?? a.commandLine;
+  if (Array.isArray(cmd)) return cmd.map(String).join(' ').trim() || null;
+  return str(cmd);
+}
+
+function normalizeCodexRecord(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const payload = raw.payload && typeof raw.payload === 'object' ? raw.payload : null;
+  const item = payload || raw;
+  const out = {};
+  const ts = str(raw.timestamp) || str(item.timestamp);
+  if (ts) out.timestamp = ts;
+  const cwd = str(raw.cwd) || str(item.cwd);
+  if (cwd) out.cwd = cwd;
+
+  const role = str(item.role);
+  if (role === 'user') {
+    const text = textFromParts(item.content);
+    if (text) {
+      out.type = 'user';
+      out.message = { role: 'user', content: [{ type: 'text', text }] };
+      return out;
+    }
+  }
+
+  const type = str(raw.type) || str(item.type);
+  const name = str(item.name) || (type === 'function_call' ? 'shell' : null);
+  if (name && /shell|exec|bash|terminal|command/i.test(name)) {
+    const command = codexCommand(item.arguments ?? item.input ?? item.args);
+    if (command) {
+      out.message = { content: [{ type: 'tool_use', name: 'Shell', input: { command } }] };
+      return out;
+    }
+  }
+
+  return out.timestamp || out.cwd ? out : null;
+}
+
+// --- Gemini CLI (~/.gemini/tmp/<project-hash>/chats/logs.json | session-*.jsonl) ---
+// logs.json = JSON array of { type:'user'|'model', message, timestamp }; session-*.jsonl =
+// per-line { role, parts }. No cwd is recorded (the dir is a one-way SHA-256 hash), so cwd
+// stays null — global session/time metrics still count; per-repo scoping can't.
+function normalizeGeminiRecord(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const out = {};
+  const ts = str(raw.timestamp) || str(raw.time);
+  if (ts) out.timestamp = ts;
+
+  const isUser = str(raw.type) === 'user' || str(raw.role) === 'user';
+  if (isUser) {
+    const text = str(raw.message) || textFromParts(raw.parts) || textFromParts(raw.content);
+    if (text) {
+      out.type = 'user';
+      out.message = { role: 'user', content: [{ type: 'text', text }] };
+      return out;
+    }
+  }
+  return out.timestamp ? out : null;
+}
+
+// --- Continue (continue.dev) ~/.continue/sessions/*.json ---
+// Each file is one session object; expand its history into per-turn objects, carrying
+// workspaceDirectory as cwd (good repo attribution).
+function normalizeContinueRecord(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const cwd = str(raw.workspaceDirectory) || str(raw.workspace) || str(raw.cwd);
+  const history = Array.isArray(raw.history) ? raw.history
+    : (Array.isArray(raw.messages) ? raw.messages : (Array.isArray(raw.conversation) ? raw.conversation : null));
+  // A single message object (not a session) — handle defensively too.
+  if (!history) {
+    const msg = raw.message && typeof raw.message === 'object' ? raw.message : raw;
+    if (str(msg.role) === 'user') {
+      const text = typeof msg.content === 'string' ? msg.content.trim() : textFromParts(msg.content);
+      if (text) return oneUser(text, cwd, str(raw.timestamp) || str(raw.createdAt));
+    }
+    return null;
+  }
+  const out = [];
+  for (const entry of history) {
+    const msg = entry && entry.message && typeof entry.message === 'object' ? entry.message : entry;
+    if (!msg || typeof msg !== 'object') continue;
+    const ts = str(entry.timestamp) || str(entry.createdAt) || str(msg.timestamp);
+    // Only emit on a real user turn (with text) or a record carrying a real timestamp.
+    if (str(msg.role) === 'user') {
+      const text = typeof msg.content === 'string' ? msg.content.trim() : textFromParts(msg.content);
+      if (text) { out.push(oneUser(text, cwd, ts)); continue; }
+    }
+    if (ts) out.push(cwd ? { cwd, timestamp: ts } : { timestamp: ts });
+  }
+  return out.length ? out : null;
+}
+
+// --- Cline / Roo Code: VS Code globalStorage .../tasks/<id>/api_conversation_history.json ---
+// One JSON array of Anthropic messages (role/content); no cwd and no timestamp in this file
+// (ui_messages.json has ts) → cwd/time attribution absent. Emits only real user turns.
+function normalizeClineRecord(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  if (str(raw.role) !== 'user') return null;
+  const text = typeof raw.content === 'string' ? raw.content.trim() : textFromParts(raw.content);
+  return text ? oneUser(text, null, null) : null;
+}
+
+// --- Aider: per-repo .aider.chat.history.md (markdown) ---
+// Repo-level source → cwd is the repo toplevel (good attribution). Markdown parse:
+// '# aider chat started at <ts>' sets the session time; '#### <text>' lines are user
+// instructions. A file matching neither pattern yields 0 records.
+function parseAiderHistory(text, cwd) {
+  if (typeof text !== 'string' || !text) return [];
+  const out = [];
+  let ts = null;
+  for (const line of text.split('\n')) {
+    const started = /^#\s*aider chat started at\s+(.+?)\s*$/i.exec(line);
+    if (started) {
+      const t = Date.parse(started[1].replace(' ', 'T'));
+      ts = Number.isFinite(t) ? new Date(t).toISOString() : null;
+      if (ts) out.push(cwd ? { cwd, timestamp: ts } : { timestamp: ts });
+      continue;
+    }
+    const user = /^####\s+(.*)$/.exec(line);
+    if (user && user[1].trim()) out.push(oneUser(user[1].trim(), cwd, ts));
+  }
+  return out;
+}
+
+function oneUser(text, cwd, ts) {
+  const o = { type: 'user', message: { role: 'user', content: [{ type: 'text', text }] } };
+  if (cwd) o.cwd = cwd;
+  if (ts) o.timestamp = ts;
+  return o;
+}
+
+module.exports = {
+  normalizeCodexRecord,
+  normalizeGeminiRecord,
+  normalizeContinueRecord,
+  normalizeClineRecord,
+  parseAiderHistory,
+};

package/src/session-refresh.js

@@ -0,0 +1,51 @@
+'use strict';
+
+// On-demand hub-JWT minting for an email (better-auth) session.
+
+const REFRESH_MARGIN_MS = 120 * 1000;
+
+function jwtStillFresh(accessTokenExpiresAt, now, marginMs) {
+  const exp = Date.parse(String(accessTokenExpiresAt || ''));
+  if (!Number.isFinite(exp)) return false;
+  return exp - now > marginMs;
+}
+
+async function ensureFreshSession(env = process.env, deps = {}) {
+  const {
+    loadAuthSession = require('./auth-session-store').loadAuthSession,
+    saveAuthSession = require('./auth-session-store').saveAuthSession,
+    getAuthTokenEndpoint = require('./config').getAuthTokenEndpoint,
+    requestAuthToken = require('./auth-client').requestAuthToken,
+    now = Date.now(),
+    marginMs = REFRESH_MARGIN_MS,
+  } = deps;
+
+  const session = loadAuthSession(env);
+  if (!session) return null;
+  if (!session.cookie) return session;
+  if (session.accessToken && jwtStillFresh(session.accessTokenExpiresAt, now, marginMs)) return session;
+
+  const endpoint = getAuthTokenEndpoint(env);
+  if (!endpoint) return session;
+
+  const tok = await requestAuthToken({ cookie: session.cookie }, { endpoint });
+  if (!tok.ok) return session;
+
+  try {
+    saveAuthSession(
+      {
+        ...session,
+        accessToken: tok.accessToken,
+        hubAccessToken: tok.accessToken,
+        accessTokenExpiresAt: tok.expiresAt,
+        cookieExpiresAt: session.expiresAt,
+      },
+      env,
+    );
+  } catch {
+    return session;
+  }
+  return loadAuthSession(env);
+}
+
+module.exports = { ensureFreshSession, jwtStillFresh, REFRESH_MARGIN_MS };