sphica 0.5.0 → 0.5.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "sphica",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Records Claude Code and Codex sessions on your machine and keeps past implementation and decisions, with their sources, for your agent to find.",
   "author": {
     "name": "iroha924",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sphica",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Records Claude Code and Codex sessions on your machine and keeps past implementation and decisions, with their sources, for your agent to find.",
   "author": {
     "name": "iroha924",

package/README.md

@@ -99,12 +99,12 @@ Without being asked, Sphica adds a few past records to what the agent sees, each
 
 - At session start: the current work and project-wide constraints.
 - On a prompt that names a recorded code symbol, file path, or option.
-- Before the agent reads or edits a file a decision applies to. A read shows each record once per session.
+- Before the agent reads or edits a file a decision applies to, and before a shell command that names such a file (naming it is not proof the command reads it). A read shows each record once per session.
 - Before a review. When you run your own review command (any name containing `review`, or a name listed in the `SPHICA_REVIEW_COMMANDS`
   environment variable, comma-separated), it gets the decisions your local change touches. `/sphica:review` checks them itself. Claude Code only.
 
 In Codex the same happens at session start, on a prompt, before an `apply_patch` edit, and before a shell command that names such a file.
-Edits made through shell commands are not covered, and there is no review hook: run `$sphica:review`.
+There is no review hook in Codex: run `$sphica:review`.
 
 The agent searches with Sphica's `search` and opens full records with `read`. `status` tells it how much of the history has been traced, so an empty search is not mistaken for "never decided".
 
@@ -125,10 +125,10 @@ The agent searches with Sphica's `search` and opens full records with `read`. `s
 - **Network.** Sphica has no account, no hosted service, and no telemetry, and makes no network connections itself. `/sphica:harvest` and `/sphica:glean` run `gh api` with your credentials to read pull requests and issues, and `sphica doctor` runs `npm` and `claude` to check installed versions.
 - **Text written by others.** Pull request and issue text may come from anyone. It is kept as a source and passed to the agent as data, never as instructions, and only the owner's or a maintainer's words can adopt a decision.
 
-## Limits in 0.5.0
+## Limits in 0.5.1
 
 - Structured records exist only for what you traced, harvested, or gleaned. Everything else is searchable only as captured text (`search` with `sources: true`).
-- In Codex, a shell command that names a file gets its decisions even when the command does not read it, and edits made through shell commands get none.
+- A shell command that names a file gets its decisions even when it does not read the file. A shell command that edits a file gets them only as a command naming it, not as an edit (in Codex, a patch passed to `apply_patch` through the shell still counts as an edit). In Claude Code this covers the Bash tool; commands run through its PowerShell tool (Windows without Git Bash) get no delivery.
 - In Codex, `$sphica:trace`, `$sphica:harvest`, and `$sphica:glean` write only when Codex tells Sphica which directory the session is in. Codex 0.157.1 does, through an experimental MCP capability; if a later Codex stops, they stop with a message and write nothing.
 - Showing a record does not make the agent follow it. In our evaluation Codex received and found an earlier decision against a request, and still carried out the request as asked.
 - A code location in a record is checked against your working tree when it is read ("located", "moved", "missing"). A located symbol does not prove the decision still holds.

package/dist/capture.js

@@ -3,7 +3,6 @@
 // server/src/capture.ts
 import { spawn } from "node:child_process";
 import fs4 from "node:fs";
-import os3 from "node:os";
 import path5 from "node:path";
 
 // server/node_modules/kysely/dist/util/object-utils.js
@@ -10815,7 +10814,8 @@ import path from "node:path";
 import { constants as C, DatabaseSync } from "node:sqlite";
 var SCHEMA_GENERATION = 2;
 var SCHEMA_REVISION = 1;
-var dbFile = () => process.env.SPHICA_DB || path.join(os.homedir(), ".sphica", "sphica.db");
+var sphicaHome = () => process.env.SPHICA_HOME || path.join(os.homedir(), ".sphica");
+var dbFile = () => process.env.SPHICA_DB || path.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
   const proto = DatabaseSync.prototype;
   if (typeof proto.setAuthorizer !== "function" || typeof proto.enableDefensive !== "function")
@@ -11287,7 +11287,6 @@ var plain2 = (s) => visible(stripVTControlCharacters(s.replace(STRING_SEQUENCE,
 // server/src/project.ts
 import { execFileSync } from "node:child_process";
 import fs2 from "node:fs";
-import os2 from "node:os";
 import path3 from "node:path";
 
 // server/src/anchors.ts
@@ -11296,7 +11295,7 @@ var MAX_BYTES = 2 * 1024 * 1024;
 var leaves = (rel) => rel === ".." || rel.startsWith(`..${path2.sep}`) || path2.isAbsolute(rel);
 
 // server/src/project.ts
-var localFile = () => path3.join(os2.homedir(), ".sphica", "projects.json");
+var localFile = () => path3.join(sphicaHome(), "projects.json");
 var LOCAL_KEY = /^[a-z0-9][a-z0-9._-]*$/;
 function normalizeRemote(url) {
   const raw = String(url ?? "").trim();
@@ -11439,13 +11438,13 @@ function changed(root, before, after) {
 }
 
 // server/src/capture.ts
-var spoolDir = () => path5.join(os3.homedir(), ".sphica", "spool");
-var stateFile = () => path5.join(os3.homedir(), ".sphica", "capture.json");
+var spoolDir = () => path5.join(sphicaHome(), "spool");
+var stateFile = () => path5.join(sphicaHome(), "capture.json");
 var rejectedDir = () => path5.join(spoolDir(), "rejected");
 var unregisteredDir = () => path5.join(spoolDir(), "unregistered");
 var HOLD_DAYS = 30;
 var HOLD_MAX = 1000;
-var baselineDir = () => path5.join(os3.homedir(), ".sphica", "worktree");
+var baselineDir = () => path5.join(sphicaHome(), "worktree");
 function current(raw) {
   const r = raw;
   if (r.v === 2)

package/dist/cli.js

@@ -93,7 +93,6 @@ var require_src = __commonJS(function(exports, module) {
 
 // server/src/cli.ts
 import fs8 from "node:fs";
-import os5 from "node:os";
 import path9 from "node:path";
 
 // server/node_modules/@clack/core/dist/index.mjs
@@ -14181,7 +14180,8 @@ import path2 from "node:path";
 import { constants as C, DatabaseSync } from "node:sqlite";
 var SCHEMA_GENERATION = 2;
 var SCHEMA_REVISION = 1;
-var dbFile = () => process.env.SPHICA_DB || path2.join(os.homedir(), ".sphica", "sphica.db");
+var sphicaHome = () => process.env.SPHICA_HOME || path2.join(os.homedir(), ".sphica");
+var dbFile = () => process.env.SPHICA_DB || path2.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
   const proto = DatabaseSync.prototype;
   if (typeof proto.setAuthorizer !== "function" || typeof proto.enableDefensive !== "function")
@@ -14522,7 +14522,6 @@ var leaves = (rel) => rel === ".." || rel.startsWith(`..${path4.sep}`) || path4.
 // server/src/capture.ts
 import { spawn } from "node:child_process";
 import fs6 from "node:fs";
-import os3 from "node:os";
 import path7 from "node:path";
 
 // server/src/knowledge.ts
@@ -14533,7 +14532,7 @@ import { execFileSync } from "node:child_process";
 import fs4 from "node:fs";
 import os2 from "node:os";
 import path5 from "node:path";
-var localFile = () => path5.join(os2.homedir(), ".sphica", "projects.json");
+var localFile = () => path5.join(sphicaHome(), "projects.json");
 var LOCAL_KEY = /^[a-z0-9][a-z0-9._-]*$/;
 function normalizeRemote(url) {
   const raw = String(url ?? "").trim();
@@ -14726,13 +14725,13 @@ function changed(root, before, after) {
 }
 
 // server/src/capture.ts
-var spoolDir = () => path7.join(os3.homedir(), ".sphica", "spool");
-var stateFile = () => path7.join(os3.homedir(), ".sphica", "capture.json");
+var spoolDir = () => path7.join(sphicaHome(), "spool");
+var stateFile = () => path7.join(sphicaHome(), "capture.json");
 var rejectedDir = () => path7.join(spoolDir(), "rejected");
 var unregisteredDir = () => path7.join(spoolDir(), "unregistered");
 var HOLD_DAYS = 30;
 var HOLD_MAX = 1000;
-var baselineDir = () => path7.join(os3.homedir(), ".sphica", "worktree");
+var baselineDir = () => path7.join(sphicaHome(), "worktree");
 function current(raw) {
   const r2 = raw;
   if (r2.v === 2)
@@ -15252,7 +15251,7 @@ async function withDb(role, fn) {
 // server/src/plugin.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import fs7 from "node:fs";
-import os4 from "node:os";
+import os3 from "node:os";
 import path8 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var MANIFEST = path8.join(".claude-plugin", "plugin.json");
@@ -15381,7 +15380,7 @@ function observe(cwdRoot) {
   } catch {
     claude = "unknown";
   }
-  let codexHome = process.env.CODEX_HOME ?? path8.join(os4.homedir(), ".codex");
+  let codexHome = process.env.CODEX_HOME ?? path8.join(os3.homedir(), ".codex");
   try {
     codexHome = fs7.realpathSync(codexHome);
   } catch {}
@@ -15460,7 +15459,7 @@ function report(s, now = new Date) {
   const lines = [];
   const issues = [];
   const todo = new Set;
-  const home = os4.homedir();
+  const home = os3.homedir();
   const short = (p) => p.startsWith(`${home}/`) ? `~${p.slice(home.length)}` : p;
   const say2 = (m, label, text) => {
     if (m === "warn" || m === "fail")
@@ -15738,7 +15737,7 @@ async function init(flags) {
   });
 }
 async function uninstall(yes) {
-  const home = path9.join(os5.homedir(), ".sphica");
+  const home = sphicaHome();
   const inHome = (p) => {
     const rel = path9.relative(home, path9.resolve(p));
     return rel === "" || !leaves(rel);
@@ -15748,6 +15747,8 @@ async function uninstall(yes) {
     ...process.env.SPHICA_DB && !inHome(process.env.SPHICA_DB) ? [process.env.SPHICA_DB] : []
   ];
   await boxed("sphica uninstall", async () => {
+    if (process.env.SPHICA_HOME)
+      throw new Error("SPHICA_HOME is set; uninstall deletes only ~/.sphica. Unset SPHICA_HOME and run it again");
     if (!fs8.existsSync(home))
       console.log(indent(`${mark("none")} ${home} does not exist`));
     else {

package/dist/deliver.js

@@ -16,7 +16,7 @@ var __export = (target, all) => {
 
 // server/src/deliver.ts
 import fs6 from "node:fs";
-import os4 from "node:os";
+import os2 from "node:os";
 import path7 from "node:path";
 
 // server/src/anchors.ts
@@ -27,7 +27,6 @@ var leaves = (rel) => rel === ".." || rel.startsWith(`..${path.sep}`) || path.is
 // server/src/capture.ts
 import { spawn } from "node:child_process";
 import fs4 from "node:fs";
-import os3 from "node:os";
 import path5 from "node:path";
 
 // server/node_modules/kysely/dist/util/object-utils.js
@@ -10839,7 +10838,8 @@ import path2 from "node:path";
 import { constants as C, DatabaseSync } from "node:sqlite";
 var SCHEMA_GENERATION = 2;
 var SCHEMA_REVISION = 1;
-var dbFile = () => process.env.SPHICA_DB || path2.join(os.homedir(), ".sphica", "sphica.db");
+var sphicaHome = () => process.env.SPHICA_HOME || path2.join(os.homedir(), ".sphica");
+var dbFile = () => process.env.SPHICA_DB || path2.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
   const proto = DatabaseSync.prototype;
   if (typeof proto.setAuthorizer !== "function" || typeof proto.enableDefensive !== "function")
@@ -11336,9 +11336,8 @@ var inline = (s) => plain2(s).replace(/[\n\t]+/g, " ");
 // server/src/project.ts
 import { execFileSync } from "node:child_process";
 import fs2 from "node:fs";
-import os2 from "node:os";
 import path3 from "node:path";
-var localFile = () => path3.join(os2.homedir(), ".sphica", "projects.json");
+var localFile = () => path3.join(sphicaHome(), "projects.json");
 var LOCAL_KEY = /^[a-z0-9][a-z0-9._-]*$/;
 function normalizeRemote(url) {
   const raw = String(url ?? "").trim();
@@ -11485,13 +11484,13 @@ function changed(root, before, after) {
 }
 
 // server/src/capture.ts
-var spoolDir = () => path5.join(os3.homedir(), ".sphica", "spool");
-var stateFile = () => path5.join(os3.homedir(), ".sphica", "capture.json");
+var spoolDir = () => path5.join(sphicaHome(), "spool");
+var stateFile = () => path5.join(sphicaHome(), "capture.json");
 var rejectedDir = () => path5.join(spoolDir(), "rejected");
 var unregisteredDir = () => path5.join(spoolDir(), "unregistered");
 var HOLD_DAYS = 30;
 var HOLD_MAX = 1000;
-var baselineDir = () => path5.join(os3.homedir(), ".sphica", "worktree");
+var baselineDir = () => path5.join(sphicaHome(), "worktree");
 function current(raw) {
   const r = raw;
   if (r.v === 2)
@@ -31841,12 +31840,12 @@ function toldBefore(session, key) {
 function markOnce(kind, key) {
   const user = (() => {
     try {
-      return os4.userInfo().username;
+      return os2.userInfo().username;
     } catch {
       return String(process.getuid?.() ?? "user");
     }
   })();
-  const dir = path7.join(os4.tmpdir(), `sphica-${sha256(user).toString("hex").slice(0, 12)}`, kind);
+  const dir = path7.join(os2.tmpdir(), `sphica-${sha256(user).toString("hex").slice(0, 12)}`, kind);
   try {
     fs6.mkdirSync(dir, { recursive: true, mode: 448 });
     fs6.writeFileSync(path7.join(dir, sha256(key).toString("hex").slice(0, 24)), "", { flag: "wx" });
@@ -31883,7 +31882,7 @@ async function log(file2, projectId2, host, external2, event, plan, outcome, bra
 async function deliver(input2, host = "claude-code", file2 = dbFile()) {
   const name = input2.hook_event_name;
   const call = reviewCall(input2);
-  const event = call ? "review" : name === "SessionStart" ? "session_start" : name === "UserPromptSubmit" ? "prompt" : name === "PreToolUse" ? input2.tool_name === "Read" || host === "codex" && input2.tool_name === "Bash" && !shellPatch(input2) ? "pre_read" : "pre_edit" : null;
+  const event = call ? "review" : name === "SessionStart" ? "session_start" : name === "UserPromptSubmit" ? "prompt" : name === "PreToolUse" ? input2.tool_name === "Read" || input2.tool_name === "Bash" && !(host === "codex" && shellPatch(input2)) ? "pre_read" : "pre_edit" : null;
   if (!event || !input2.session_id)
     return "";
   if (event === "prompt" && !isOwnerTurn(input2))
@@ -31892,7 +31891,7 @@ async function deliver(input2, host = "claude-code", file2 = dbFile()) {
     return "";
   const ti = input2.tool_input ?? {};
   const patch = host === "codex" && input2.tool_name === "apply_patch" && typeof ti.command === "string" ? ti.command : host === "codex" ? shellPatch(input2) : null;
-  const shell = host === "codex" && input2.tool_name === "Bash" && !patch && typeof ti.command === "string" ? ti.command : null;
+  const shell = input2.tool_name === "Bash" && !patch && typeof ti.command === "string" ? ti.command : null;
   const targets = patch ? patchPaths2(patch) : [ti.file_path, ti.notebook_path].filter((p) => typeof p === "string").slice(0, 1);
   const onPath = event === "pre_edit" || event === "pre_read";
   if (onPath && !shell && (!(event === "pre_read" || patch || EDIT_TOOLS.has(input2.tool_name ?? "")) || !targets.length))

package/dist/mcp-record.js

@@ -45531,7 +45531,8 @@ import path from "node:path";
 import { constants as C, DatabaseSync } from "node:sqlite";
 var SCHEMA_GENERATION = 2;
 var SCHEMA_REVISION = 1;
-var dbFile = () => process.env.SPHICA_DB || path.join(os.homedir(), ".sphica", "sphica.db");
+var sphicaHome = () => process.env.SPHICA_HOME || path.join(os.homedir(), ".sphica");
+var dbFile = () => process.env.SPHICA_DB || path.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
   const proto = DatabaseSync.prototype;
   if (typeof proto.setAuthorizer !== "function" || typeof proto.enableDefensive !== "function")
@@ -45987,7 +45988,6 @@ import crypto2 from "node:crypto";
 // server/src/capture.ts
 import { spawn } from "node:child_process";
 import fs5 from "node:fs";
-import os3 from "node:os";
 import path5 from "node:path";
 
 // server/src/knowledge.ts
@@ -46023,7 +46023,6 @@ var inline = (s) => plain2(s).replace(/[\n\t]+/g, " ");
 // server/src/project.ts
 import { execFileSync } from "node:child_process";
 import fs3 from "node:fs";
-import os2 from "node:os";
 import path3 from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -46062,7 +46061,7 @@ function locate(root, rel, symbol2) {
 }
 
 // server/src/project.ts
-var localFile = () => path3.join(os2.homedir(), ".sphica", "projects.json");
+var localFile = () => path3.join(sphicaHome(), "projects.json");
 var LOCAL_KEY = /^[a-z0-9][a-z0-9._-]*$/;
 function normalizeRemote(url2) {
   const raw = String(url2 ?? "").trim();
@@ -46229,13 +46228,13 @@ function changed(root, before, after) {
 }
 
 // server/src/capture.ts
-var spoolDir = () => path5.join(os3.homedir(), ".sphica", "spool");
-var stateFile = () => path5.join(os3.homedir(), ".sphica", "capture.json");
+var spoolDir = () => path5.join(sphicaHome(), "spool");
+var stateFile = () => path5.join(sphicaHome(), "capture.json");
 var rejectedDir = () => path5.join(spoolDir(), "rejected");
 var unregisteredDir = () => path5.join(spoolDir(), "unregistered");
 var HOLD_DAYS = 30;
 var HOLD_MAX = 1000;
-var baselineDir = () => path5.join(os3.homedir(), ".sphica", "worktree");
+var baselineDir = () => path5.join(sphicaHome(), "worktree");
 function current(raw) {
   const r = raw;
   if (r.v === 2)

package/dist/mcp.js

@@ -45528,7 +45528,8 @@ import path from "node:path";
 import { constants as C, DatabaseSync } from "node:sqlite";
 var SCHEMA_GENERATION = 2;
 var SCHEMA_REVISION = 1;
-var dbFile = () => process.env.SPHICA_DB || path.join(os.homedir(), ".sphica", "sphica.db");
+var sphicaHome = () => process.env.SPHICA_HOME || path.join(os.homedir(), ".sphica");
+var dbFile = () => process.env.SPHICA_DB || path.join(sphicaHome(), "sphica.db");
 function requireRuntime() {
   const proto = DatabaseSync.prototype;
   if (typeof proto.setAuthorizer !== "function" || typeof proto.enableDefensive !== "function")
@@ -45794,7 +45795,6 @@ var HOST_MARKS = new Set([".orphaned_at", ".in_use"]);
 // server/src/project.ts
 import { execFileSync } from "node:child_process";
 import fs4 from "node:fs";
-import os2 from "node:os";
 import path4 from "node:path";
 
 // server/src/anchors.ts
@@ -45844,7 +45844,7 @@ function checkAnchor(root, a) {
 }
 
 // server/src/project.ts
-var localFile = () => path4.join(os2.homedir(), ".sphica", "projects.json");
+var localFile = () => path4.join(sphicaHome(), "projects.json");
 var LOCAL_KEY = /^[a-z0-9][a-z0-9._-]*$/;
 function normalizeRemote(url2) {
   const raw = String(url2 ?? "").trim();

package/hooks/hooks.json

@@ -65,7 +65,7 @@
     ],
     "PreToolUse": [
       {
-        "matcher": "Edit|Write|MultiEdit|NotebookEdit|Read|Skill",
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit|Read|Skill|Bash",
         "hooks": [
           {
             "type": "command",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sphica",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Records Claude Code and Codex sessions on your machine and keeps past implementation and decisions, with their sources, for your agent to find.",
   "license": "MIT",
   "type": "module",