toga-ai 1.0.968 → 1.0.970

package/scripts/hooks/session-files.js

@@ -0,0 +1,144 @@
+'use strict';
+/* session-files.js — remembers which files THIS Claude Code session edited, per git repo.
+ *
+ * PostToolUse (Edit|Write|MultiEdit|NotebookEdit): appends one JSON line to
+ *   <gitdir>/claude-sessions/<sessionId>.jsonl  — read later by skills/commit (commit-helper.js).
+ *   Silent on stdout. No child processes (fires on every edit — must stay fast).
+ * UserPromptSubmit: when the prompt starts with "/commit", prints the session id + transcript
+ *   path so the /commit skill knows which list is its own.
+ *
+ * Never denies, never crashes, always exits 0. Disable: TOGA_SESSION_FILES_DISABLED=1.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const PRUNE_AFTER_DAYS = 14;
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+const MAX_SESSION_ID_LENGTH = 64;
+const SESSIONS_DIR_NAME = 'claude-sessions';
+const COMMIT_PROMPT_RE = /^\/(?:[\w-]+:)?commit(\s|$)/;
+
+/* A closed pipe (EPIPE) on stdout must never crash the hook. */
+process.stdout.on('error', () => {});
+
+function readInput() {
+  try {
+    const raw = fs.readFileSync(0, 'utf8');
+    if (!raw || !raw.trim()) return null;
+    return JSON.parse(raw);
+  } catch (e) {
+    return null;
+  }
+}
+
+function safeSessionId(id) {
+  return String(id || '').replace(/[^A-Za-z0-9_-]/g, '').slice(0, MAX_SESSION_ID_LENGTH);
+}
+
+/* Walk up from `start` looking for .git. Returns { repoRoot, gitDir } or null. */
+function findRepo(start) {
+  let dir = start;
+  for (;;) {
+    const dotGit = path.join(dir, '.git');
+    let st = null;
+    try { st = fs.statSync(dotGit); } catch (e) { st = null; }
+    if (st && st.isDirectory()) return { repoRoot: dir, gitDir: dotGit };
+    if (st && st.isFile()) {
+      try {
+        const m = fs.readFileSync(dotGit, 'utf8').match(/^gitdir:\s*(.+)\s*$/m);
+        if (m) return { repoRoot: dir, gitDir: path.resolve(dir, m[1].trim()) };
+      } catch (e) { /* unreadable .git file — keep walking */ }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function hasHeadFile(gitDir) {
+  try { return fs.statSync(path.join(gitDir, 'HEAD')).isFile(); } catch (e) { return false; }
+}
+
+function readBranch(gitDir) {
+  try {
+    const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim();
+    const m = head.match(/^ref:\s*refs\/heads\/(.+)$/);
+    if (m) return m[1];
+    return head.slice(0, 7);
+  } catch (e) {
+    return null;
+  }
+}
+
+function isInside(child, parent) {
+  const rel = path.relative(parent, child);
+  return rel === '' || (!!rel && !rel.startsWith('..') && !path.isAbsolute(rel));
+}
+
+function pruneOld(dir, keepFile) {
+  const cutoff = Date.now() - PRUNE_AFTER_DAYS * MS_PER_DAY;
+  let names = [];
+  try { names = fs.readdirSync(dir); } catch (e) { return; }
+  for (const name of names) {
+    const full = path.join(dir, name);
+    if (full === keepFile || !name.endsWith('.jsonl')) continue;
+    try {
+      if (fs.statSync(full).mtimeMs < cutoff) fs.unlinkSync(full);
+    } catch (e) { /* another session may have removed it — fine */ }
+  }
+}
+
+function handlePostToolUse(input) {
+  const sessionId = safeSessionId(input.session_id);
+  if (!sessionId) return;
+  const ti = input.tool_input || {};
+  const rawPath = ti.file_path || ti.notebook_path;
+  if (!rawPath) return;
+
+  const filePath = path.resolve(input.cwd || process.cwd(), String(rawPath));
+  const repo = findRepo(path.dirname(filePath));
+  if (!repo) return;
+  if (!hasHeadFile(repo.gitDir)) return; /* not a real git dir — write nothing */
+  if (isInside(filePath, repo.gitDir) || isInside(filePath, path.join(repo.repoRoot, '.git'))) return;
+
+  const sessionsDir = path.join(repo.gitDir, SESSIONS_DIR_NAME);
+  const listFile = path.join(sessionsDir, sessionId + '.jsonl');
+  const isNew = !fs.existsSync(listFile);
+  fs.mkdirSync(sessionsDir, { recursive: true });
+
+  const entry = {
+    ts: new Date().toISOString(),
+    sessionId: String(input.session_id),
+    transcriptPath: input.transcript_path || null,
+    repoRoot: repo.repoRoot,
+    branch: readBranch(repo.gitDir),
+    file: path.relative(repo.repoRoot, filePath).split(path.sep).join('/'),
+    tool: input.tool_name || null,
+  };
+  if (input.agent_id) entry.agentId = input.agent_id;
+  fs.appendFileSync(listFile, JSON.stringify(entry) + '\n');
+
+  if (isNew) pruneOld(sessionsDir, listFile);
+}
+
+function handleUserPromptSubmit(input) {
+  const prompt = String(input.prompt || '').trim();
+  if (!COMMIT_PROMPT_RE.test(prompt)) return;
+  process.stdout.write('TOGA session id: ' + (input.session_id || 'unknown') +
+    ' (transcript: ' + (input.transcript_path || 'unknown') + ')\n');
+}
+
+function main() {
+  if (process.env.TOGA_SESSION_FILES_DISABLED === '1') return;
+  const input = readInput();
+  if (!input) return;
+  if (input.hook_event_name === 'UserPromptSubmit') return handleUserPromptSubmit(input);
+  if (input.hook_event_name === 'PostToolUse') return handlePostToolUse(input);
+}
+
+try {
+  main();
+} catch (e) {
+  /* Never block or break a session over bookkeeping. */
+}
+process.exitCode = 0; /* not process.exit() — let stdout flush */

package/skills/commit/SKILL.md

@@ -0,0 +1,124 @@
+---
+name: commit
+description: Commit ONLY the files this Claude Code session changed, in every repo it touched, and write the session's notes (why the task exists, what was found, approach, turned-down options, who decided) into the commit message so the PR reviewer can build the PR summary from it. Safe when several sessions work on the same branch in the same checkout. Never pushes. Trigger on "/commit", "commit this", "commit my changes".
+---
+
+# /commit — commit this session's files, with the session's notes
+
+Helper: `node "$CLAUDE_PROJECT_DIR/.claude/skills/commit/scripts/commit-helper.js" <command>`
+(below: `helper <command>`). It prints JSON. The edit lists come from the
+`session-files.js` hook, stored in `<repo>/.git/claude-sessions/<sessionId>.jsonl`.
+
+## Step 0 — Rules
+
+- Running `/commit` IS the developer's explicit commit authorization — **for these commits only**.
+- Never push. Never `git add -A` or `git add .`. Never `--no-verify`. Never `--amend`.
+  Never switch branches. Never commit a file the developer did not approve.
+
+## Step 1 — Find your own session id
+
+- Look in context for the line `TOGA session id: <id> (transcript: <path>)` — the hook adds it
+  when the prompt starts with `/commit`. Use that id and transcript path.
+- If it is missing: run `helper sessions`. Show the developer each list (repo, branch, file
+  count, first/last time, first message). Ask which one is theirs. Use its `transcriptPath`.
+
+## Step 2 — See what will be committed
+
+Run `helper status --session=<id>`. For each repo, tell the developer in plain words:
+
+1. **Will commit:** the `toCommit` files.
+2. **Other changed files, not from this session:** the `otherChanged` files (hand edits,
+   lockfiles, generated code, files changed by shell commands). Include them **only if the
+   developer says so**. Note any included ones under "Manual changes".
+3. **Overlap warning** for each `overlaps` file: "`X` was also changed by another session —
+   committing it includes their changes too." Ask before including it.
+4. **Branch mismatch:** `branchMismatch` files were last edited on another branch
+   (`entryBranch`). They are NOT in `toCommit`. If the list is not empty, **stop** for that
+   repo: say which files were edited on which branch, and ask the developer to switch
+   branches themselves.
+5. **Possibly yours from before a resume:** list `sameBranchOtherSessions` (time, file count).
+   If the developer says one is theirs, run `status` with that id too and merge the lists.
+6. **Ticket:** use `ticket` from the branch name. If it is `null`, ask the developer for it.
+
+`alreadyClean` files have no change right now (committed, reverted, or stashed). Do not commit
+them. They stay in the list, so a `git stash pop` brings them back into `toCommit`.
+
+`repos[]` entries with an `error` field could not be read — tell the developer the error.
+
+## Step 3 — Checks before committing
+
+On the files you will commit:
+
+1. `php -l <file>` on every PHP file. If `php` is not on PATH, say so — do not skip silently.
+2. After staging, read `git -C <repo> diff --cached` and look for:
+   - secrets: keys, tokens, passwords, connection strings, `.env` files;
+   - absolute local paths (`C:\`, `D:\`, `/Users/`);
+   - commented-out code.
+3. Confirm the branch is the ticket branch.
+
+Fix what you can. If you cannot, unstage (`git -C <repo> restore --staged -- <files>`), stop,
+and tell the developer.
+
+## Step 4 — Get the developer's own words
+
+Run `helper devwords --transcript=<path>`. Use it to:
+
+- fill "Developer's words" with a short real quote;
+- decide honestly who made each decision. A decision is the **developer's** only if the
+  developer said it or approved it in their own message. Otherwise it is **Claude alone**.
+
+If you still do not know why the task exists, ask the developer once, in one plain question.
+
+## Step 5 — Write the message and commit, per repo
+
+Subject rules (api2 CI checks this; use it in every repo): `<TICKET>: <Subject>` — ticket from
+the branch (`^[A-Z]+-\d+`), subject starts with a capital letter, imperative ("Use", "Add",
+"Fix" — not "Used/Added/Fixed"), max 80 characters, no period at the end, more than one word.
+
+Write the message to a temp file **outside every repo** — the OS temp dir (`$TMPDIR`, `$TEMP`,
+or `os.tmpdir()`), named like `toga-commit-<session id>-<repo name>.txt`. Never inside the repo,
+so it can never be staged. Use this format EXACTLY:
+
+```
+TRUE-79868: Use client default tax code when invoice tax code is blank
+
+Why this exists: <problem + scope in 1-3 plain lines — why the ticket exists, what is and isn't in scope>
+Developer's words: "<short quote of how the developer described the task>"
+Found: <what was found, 1-3 lines>
+Approach: <what this commit does in THIS repo and why, 1-3 lines>
+Turned down: <options considered and rejected, and why — or "none">
+Decisions:
+- <decision> (decided by: developer | Claude alone)
+Manual changes: <files the developer changed by hand and asked to include — or "none">
+
+Claude-Notes: v1
+Claude-Session: <session id>
+```
+
+- Same "Why this exists" and "Developer's words" in every repo of the same ticket.
+  "Approach" and "Decisions" are specific to each repo.
+- 5-15 body lines. Plain everyday words. No jargon. No arrow chains.
+- Small follow-up commit on the same ticket: keep every heading; one line each is fine.
+
+`devwords` already replaces token shapes and `password=...` values with `[redacted]`. Still,
+before you commit, read the finished message and check it for:
+
+- secrets: API keys (`sk-ant-`, `ghp_`, `github_pat_`, `AKIA`), private keys, passwords,
+  tokens, connection strings — anything that looks like one, even `[redacted]` leftovers;
+- absolute local paths (`C:\`, `D:\`, `/Users/`, `/home/`).
+
+Remove or reword anything you find. The message goes into git history for good.
+
+Then, per repo:
+
+1. `git -C <repo> add -- <exact files>`
+2. `git -C <repo> commit -F <temp file>`
+3. Delete the temp file (also when the commit fails).
+
+## Step 6 — After each commit
+
+1. `helper forget --session=<id> --repo=<repo> --files=<committed files, comma-separated>`
+2. Report per repo: short hash, subject, file count.
+3. Say: "Push when ready — /commit never pushes."
+4. Say: changes made by hand outside Claude can still be committed the normal way in VS Code;
+   the PR reviewer will show those as manual changes.