claude-code-log 1.4.0__tar.gz → 1.6.0__tar.gz

claude_code_log-1.6.0/.claude/skills/foldyard/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: foldyard
+description: Orient yourself in a foldyard dev box and drive it — the host/box split, what the box structurally cannot do, posture modes for credentials, egress and the proxy, worktrees, and why a config or compose change might not have taken effect. Use whenever `fy`/`foldyard` commands appear, when something needs a credential or network access it doesn't have, when a change "doesn't take", or when asked to work on the dev environment itself.
+---
+
+# Working in (and on) a foldyard dev box
+
+Foldyard runs this project inside a **rootless VM that mounts only this repo**. You are almost
+certainly *in the box* — a container in that VM — and the person you're working with is on the
+**host** (their Mac). That split explains nearly everything below.
+
+Check where you are: `fy mode` prints the posture and says which side it's reading from.
+`fy verify` proves the boundary (it exits non-zero if any of it is false).
+
+## The four facts that will save you the most time
+
+1. **You cannot push.** No credential to the git remote reaches the box, by design. Read and
+   commit locally; the human pushes. Don't try to work around it — there is nothing to find.
+2. **You hold no real secrets, and can't grant yourself any.** Posture state lives in the host's
+   home, outside the mount. `fy mode` *shows* posture anywhere; *setting* it is host-only.
+3. **Your egress goes through the host's proxy** and may be allow-listed or walled. A blocked
+   host is a decision, not a bug — ask; don't route around it.
+4. **The engine socket you have is real** and bounded to this VM. `docker`/`podman` commands
+   work and act on the live dev stack — including anything a test suite's mocks let slip.
+
+## Ask the tool, don't guess
+
+Foldyard is introspectable, and its own output is always current — prefer it over any summary
+(including this one):
+
+| question | command |
+| --- | --- |
+| what can this environment do right now? | `fy mode` (posture), `fy state` (desired vs observed) |
+| what's broken / missing? | `fy doctor` — one line per check, each with its fix |
+| is the isolation intact? | `fy verify` |
+| what does this verb do? | `fy --help`, `fy <verb> --help` |
+| the manual, offline, by topic | `fy docs` — then `fy docs <topic>` |
+| what does the config let the host do? | `fy config widenings` |
+
+`fy docs` serves **this install's** documentation, so it can't drift from the code you're running.
+Start with `fy docs quickstart`, `fy docs modes`, `fy docs networking`, `fy docs security`; the
+ADRs (`fy docs adr-0001` …) carry the reasoning behind each design decision.
+
+## Daily verbs
+
+`fy up | ps | logs [svc] | shell | down` drive the compose stack; `fy box shell | ps` the dev box
+itself; `fy verify` proves the cage. A consumer repo usually wraps these in its own `just`
+recipes — check the repo's justfile and CLAUDE.md before reaching for `fy` directly.
+
+## When you need something you don't have
+
+**A credential** (a cloud token, an API key): you can't grant it. Name the exact command the human
+should run on their Mac and why. Postures are per-axis — `fy mode` lists the axes this project
+declares and their rungs, and high-privilege rungs expire on a timer by design. Detail:
+[posture-and-credentials.md](references/posture-and-credentials.md).
+
+**A host through the network wall**: `fy allow add <host> --level session` — **on the host**. Tell
+them the hostname and what needs it. Detail:
+[egress-and-capture.md](references/egress-and-capture.md).
+
+**A tool in the box**: it belongs in the project's `foldyard.toml` (`[[box.tools]]`) so it survives
+a box rebuild, not in an ad-hoc `apt install` that the next `fy box down` throws away. The
+`bootstrap-devbox` skill covers growing that config from inside the box.
+
+## "I changed it and nothing happened"
+
+The most common class of confusion here. Full table:
+[when-a-change-doesnt-take.md](references/when-a-change-doesnt-take.md). The three big ones:
+
+- **`foldyard.toml`** — the host runs the copy it **adopted**, not your working tree. Your edit is
+  inert until the human answers the prompt at the next `fy up`/`fy host` (or runs `fy config
+  adopt`). Check with `fy config status`; see what changed with `fy config diff`.
+- **Compose files** — read from the **primary checkout**, so an edit inside a worktree changes
+  nothing until it reaches that checkout.
+- **A running container** — keeps the command and env it was created with. A config change needs a
+  recreate (`fy up`), not a restart.
+
+## Working on foldyard itself
+
+Read `fy docs` first — it's the installed version's own manual. The source lives at
+<https://github.com/twistco/foldyard>. Don't clone it into the box to "check how it works": you'd
+get a different version than the one running here, which is the exact confusion this design goes
+out of its way to prevent. The supported way to develop against it is the **co-dev mount**
+(`fy docs adr-0020`), which mounts the real checkout and installs it editable.

claude_code_log-1.6.0/.claude/skills/foldyard/references/egress-and-capture.md

@@ -0,0 +1,50 @@
+# Egress, capture and the wall — why a request failed, and who can unblock it
+
+All of the box's internet traffic routes through a proxy **on the host**. That's how credential
+injection works, and it's the observation point for everything leaving the yard. Three separate
+controls sit on that path; they get conflated constantly, so name the right one when you ask.
+
+| control | question it answers | who changes it |
+| --- | --- | --- |
+| **routing** | does traffic go through the proxy at all? | baked in at box creation (always on) |
+| **the wall** | can traffic *ignore* the proxy and go direct? | project config, at VM provisioning |
+| **the allowlist** | which hosts may the proxy reach? | `fy allow …` on the host, live |
+| **capture** | is traffic decrypted and logged? | `fy mode capture=on` / `fy mode capture=off`, on the host, live |
+
+## Diagnosing a failed request
+
+- **`403` from the proxy / "blocked by the egress wall"** — the allowlist refused the host. It's a
+  decision. Ask the human for `fy allow add <host> --level session` (or `--level permanent` if it's
+  a permanent dependency of the project). Grants live in the host's home, outside the mount, so
+  there is deliberately no way to grant one from here. If the host is a real dependency of the
+  PROJECT (not just this task), also add it to `[proxy] recommend` in `foldyard.toml` with a
+  one-line `why`: that commits the recommendation for the whole team — each operator is OFFERED
+  it per host (after reviewing your edit at the adoption gate) instead of rediscovering the
+  block, and nothing is granted without their yes.
+- **Connection refused / hangs on everything** — the host proxy probably isn't running. `fy doctor`
+  names it; the fix is `fy up` or `fy host` on the Mac.
+- **TLS/certificate errors** — the proxy re-signs decrypted traffic with a CA the box trusts, so a
+  tool with its own hardcoded trust store (or one that pins) can fail here. Point it at the box's
+  combined CA bundle rather than disabling verification.
+- **Works for a while, then dies ~60s in** — that's an idle-connection reset from the upstream,
+  not the proxy. Streaming or keepalives fix it; the proxy doesn't.
+
+## Capture is not filtering
+
+`capture=on` decrypts and logs requests so the human can *see* what the yard talks to. It doesn't
+block anything, and hosts on the project's `passthrough` list are tunnelled without decryption —
+often a couple of hundred of them, since one `@bundle` reference expands to a whole toolchain.
+`fy config widenings` prints the real count.
+
+Conversely the wall (`[machine] wall = true`) is the enforcing control: traffic that ignores the
+proxy environment is *rejected*, not silently allowed. Without it, routing is cooperative — it
+bounds what is **logged**, not what can leave. `fy verify` probes this directly.
+
+## Don't route around it
+
+Unsetting `HTTPS_PROXY`, adding `--insecure`, or hunting for a direct path defeats the observation
+the human relies on — and under the wall it simply fails. If a task genuinely needs a host, say
+which host and why; that's a one-command grant for them.
+
+Depth: `fy docs networking`, `fy docs security`, `fy docs adr-0009` (why monitoring is called
+monitoring and not filtering).

claude_code_log-1.6.0/.claude/skills/foldyard/references/posture-and-credentials.md

@@ -0,0 +1,54 @@
+# Posture and credentials — how the box gets access, and why you can't grant it
+
+The yard's resting state is **zero secrets**: no key files, no token env vars, no credential
+helpers. Nothing to lift, so nothing to leak. Access is a *posture* the human declares on the host,
+and it reaches you as capability, never as a secret you hold.
+
+## Axes and rungs
+
+Posture is a set of independent **axes**, each at a **rung**. Which axes exist is per project —
+`fy mode` prints them with a one-line blurb per rung; there is no fixed list to memorise. Typical
+shapes: an off/on injector for one API, or a ladder like `off → logs → sa → user` where each rung
+grants more.
+
+- **Rung 0 is always the secretless one.** An axis at rest costs nothing and grants nothing.
+- **High-privilege rungs are TTL-bound.** "Act as me" rungs expire (default an hour) and revert to
+  the default rung on their own. If something worked earlier and now 401s, check `fy mode` first —
+  a lapse looks exactly like a broken credential.
+- `fy mode` also renders **DEGRADED**: the rung is set, but the host's capability probe says the
+  chain behind it isn't working right now (an expired grant, revoked access). That's the difference
+  between "not asked for" and "asked for, not currently working".
+
+## How a credential reaches you (and doesn't)
+
+The real token is minted **on the host** and injected into your request in flight by the egress
+proxy. The box holds a dummy value at most. So:
+
+- reading the env var gives you a placeholder — that's expected, not a misconfiguration;
+- the access only exists while the axis is on, and only against the host it's scoped to;
+- a fully compromised box can *use* the access during that window but can never *hold* it.
+
+Some services in the stack instead get an identity from a local metadata emulator — same idea:
+the container is handed short-lived capability, not a key.
+
+## What to do when you need access
+
+You cannot set posture from the box (`fy mode <axis>=<rung>` refuses here — the authoritative state
+is in the host's home, outside the mount). So:
+
+1. Run `fy mode` and read the axis blurbs; work out the exact rung you need.
+2. Ask for it explicitly, with the reason and the command:
+   *"To read staging logs I need `fy mode gcp=logs` on your Mac (expires in an hour)."*
+3. If a **secret** is missing rather than a posture — the host may need to capture it once
+   (`fy box up` prompts on a TTY, storing it host-side at 0600). `fy doctor` on the host names
+   which one.
+
+## Reading the current grant surface
+
+`fy config widenings` inventories what this project's config asks the host to allow: which hosts
+are exempt from traffic capture, where each mechanism delivers a credential (armed *and* declared
+but not yet armed), which agent prompts are shared with the team vs personal, and any config key
+that reads as a control but is no longer honoured.
+
+Depth: `fy docs modes`, `fy docs security`, `fy docs adr-0005` (why axes are data), `fy docs
+adr-0007` (injection at the proxy), `fy docs adr-0008` (keyless agent auth).

claude_code_log-1.6.0/.claude/skills/foldyard/references/when-a-change-doesnt-take.md

@@ -0,0 +1,32 @@
+# "I changed it and nothing happened"
+
+Every entry below is a place where the thing you edited is **not** the thing that's running. They
+share one root cause: state that the box can write is never authoritative for what the host does,
+and containers freeze parts of their config at creation. Work down the table before assuming a bug.
+
+| you edited | why it didn't take | what makes it take |
+| --- | --- | --- |
+| `foldyard.toml` / `foldyard.local.toml` | the host reconciles from the copy it **adopted**, outside the mount — your edit is inert by design | the human answers the adopt/revert/ignore prompt at the next `fy up`/`fy host`, or runs `fy config adopt`. `fy config status` / `fy config diff` show where you are |
+| a block you deleted from `foldyard.toml` | `foldyard.local.toml` wins the merge and may still declare it (that file is gitignored, so it's invisible in `git status`) | `fy config widenings` names the file behind each one; a local `disabled = true` is how one person opts out of a block the team keeps |
+| a compose file, inside a worktree | compose runs from the **primary checkout**, not your worktree | the edit has to reach the primary checkout |
+| a compose file, anywhere | a running container keeps the command + env it was CREATED with | `fy up` (recreates on a config change) — a `restart` is not enough |
+| an env var in the stack's env file | same: baked at container creation | recreate the service |
+| posture (`fy mode …`) | setting is host-only; from the box it refuses | ask the human, then re-check `fy mode` |
+| an egress allow / the wall | grants live in the host's home | `fy allow add <host>` on the host |
+| a code file, expecting hot reload | the watcher may not see host-side writes across the VM's shared filesystem — but **edits made in the box do** propagate | make the edit in the box (you're already there); if a host-side edit was the trigger, touch the file from here |
+| foldyard's own source (vendored consumers only) | a running supervisor holds the code it started with | the next host-side `fy up` bounces it and adopts the new code |
+| a bundled skill / docs | they ship inside the installed package | reinstall foldyard, or run from the source checkout |
+
+## Diagnosing, in order
+
+1. `fy config status` — is the config the host runs the one you edited?
+2. `fy state` — desired vs observed, per tier (files, daemons, capability, stack, box). It exits
+   non-zero on drift, so it's the fastest "is anything out of sync" check.
+3. `fy doctor` — one line per check with its fix; the row that's warning usually is the answer.
+4. `fy ps` / `fy logs <svc>` — is the container even the one you think? Check when it was created.
+
+## The general rule
+
+If a change would let the **box** widen what the **host** does — its credentials, its egress, its
+capture — assume it needs a host-side act, and say which one. That's not an obstacle to route
+around; it's the property that makes it safe to run an agent here with permissions skipped.

claude_code_log-1.6.0/.claude/skills/update-tools-coverage/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: update-tools-coverage
+description: Refresh dev-docs/tools-coverage.md against the upstream Claude Code tools reference and the Codex app-server item schema. Use when checkpointing tool-renderer/provider coverage, after adding/removing a renderer or Codex adapter, or when either upstream taxonomy may have changed.
+---
+
+# Update Tool Coverage
+
+Keeps [`dev-docs/tools-coverage.md`](../../../dev-docs/tools-coverage.md) in
+sync with the upstream contracts and our implementation:
+
+1. **Upstream** — the documented tool list at
+   <https://code.claude.com/docs/en/tools-reference>.
+2. **Us** — `TOOL_INPUT_MODELS` / `TOOL_OUTPUT_PARSERS` in
+   [`claude_code_log/factories/tool_factory.py`](../../../claude_code_log/factories/tool_factory.py).
+3. **Codex** — the installed version's generated app-server `ThreadItem`
+   schema, plus the rollout adapters in `providers/codex.py`,
+   `providers/codex_tools.py`, and `providers/codex_javascript.py`.
+
+The doc grades each documented tool **Full** (typed input + typed output),
+**Input only** (typed input, generic output), or **Generic** (no registry
+entry → params-table + raw-`<pre>` fallback), and separately lists tools we
+support that upstream no longer documents (renames like `Task`→`Agent`,
+supersessions like `MultiEdit`, legacy aliases, undocumented features).
+
+## Claude Code procedure
+
+1. **Fetch the upstream tool names.** WebFetch the reference and ask only
+   for the tool-table names (the page is ~80 KB; a targeted prompt keeps it
+   manageable):
+
+   > WebFetch `https://code.claude.com/docs/en/tools-reference` —
+   > "List the exact tool names in the main tools table, one per line.
+   > Names only, no descriptions."
+
+   Note any tool the page marks deprecated/renamed — that's a candidate for
+   the second table.
+
+2. **Compute the truth mechanically.** Feed those names to the bundled
+   helper (run from the repo root; `uv run` is required so `pydantic`
+   resolves — bare `python3` fails with `ModuleNotFoundError: pydantic`):
+
+   ```bash
+   printf 'Agent Artifact AskUserQuestion ... Write' \
+     | uv run python .claude/skills/update-tools-coverage/check_coverage.py
+   ```
+
+   It prints each tool's support level, the totals, the "we register but
+   upstream doesn't document" set, and — if the doc exists — a **drift
+   report** (missing / mismatched / stale rows). If it says `in sync [OK]` and
+   the upstream name set is unchanged, there is nothing to do.
+
+3. **Reconcile the doc.** Apply the helper's output to
+   `dev-docs/tools-coverage.md`:
+   - Move rows between the two tables as tools enter/leave the upstream list —
+     **never delete** a row for a tool we still register. A tool leaving the
+     reference moves to the "no longer documented" table (it's history a
+     transcript viewer must still render); it does not lose support.
+   - Fix any support-level the drift report flags.
+   - Update the **totals line** and the **snapshot date** in the intro
+     (`snapshot YYYY-MM-DD`).
+   - The **Notes column is hand-maintained** — carry notes forward; only the
+     support level is machine-derived.
+
+4. **Re-run the helper** to confirm `in sync [OK]`.
+
+## Codex procedure
+
+Codex function/MCP/plugin names are open-ended, so do not try to create a
+closed upstream function-name list. Check two separate tables instead:
+
+1. Generate the public semantic item schema for the installed Codex version:
+
+   ```bash
+   codex --version
+   codex app-server generate-json-schema --out /tmp/codex-app-server-schema
+   ```
+
+2. Read `definitions.ThreadItem.oneOf` in
+   `/tmp/codex-app-server-schema/codex_app_server_protocol.v2.schemas.json`.
+   Reconcile added/removed variants with "Codex provider coverage / Public
+   item families" and update its version, date, and totals.
+   Run the local drift checker after editing:
+
+   ```bash
+   uv run python .claude/skills/update-tools-coverage/check_codex_coverage.py \
+     /tmp/codex-app-server-schema/codex_app_server_protocol.v2.schemas.json
+   ```
+
+3. Reconcile concrete call mappings with `_canonicalize()` in
+   `providers/codex_tools.py`, result/batch reconstruction in
+   `providers/codex.py`, and the `test/test_codex_*` contracts.
+4. Reconcile the static-JavaScript list with the whitelisted transfer
+   functions in `providers/codex_javascript.py`. Never describe legacy-regex
+   support as production fallback: it is retained only as an explicit test
+   comparison baseline.
+
+The generated schema is version-specific and the rollout format is not a
+public wire contract. State both facts in the documentation snapshot.
+
+## Guardrails
+
+- **Generic is a feature, not a gap.** Unknown / `mcp__*` / plugin tools
+  *should* fall back to generic rendering. Only type a tool when it's common
+  or carries structure worth surfacing — see
+  [`implementing-a-tool-renderer.md`](../../../dev-docs/implementing-a-tool-renderer.md)
+  (or the `tool-renderer` skill) to actually add one.
+- **Undocumented ≠ obsolete.** The reference table isn't a full census of
+  what lands in a JSONL file (e.g. `TeamCreate`/`TeamDelete` are typed both
+  sides but never appeared upstream). Keep those under "no longer /never
+  documented" with a note, not removed.
+- **Dead models.** `GlobOutput` / `GrepOutput` exist in `models.py` but no
+  parser constructs them, so `Glob`/`Grep` are **Input only**. If a future
+  change wires up a parser, they graduate to Full automatically — the helper
+  will show the flip.

claude_code_log-1.6.0/.claude/skills/update-tools-coverage/check_codex_coverage.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Check the documented Codex ThreadItem census against a generated schema."""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+
+DOC_PATH = Path(__file__).parents[3] / "dev-docs" / "tools-coverage.md"
+SECTION_START = "### Public item families"
+SECTION_END = "### Concrete Codex call adapters"
+ROW_RE = re.compile(
+    r"^\| `(?P<name>[^`]+)` \| "
+    r"(?P<status>Direct|Adapted|Partial|Missing) \|",
+    re.MULTILINE,
+)
+TOTAL_RE = re.compile(
+    r"\*\*Totals:\*\* (?P<direct>\d+) direct · "
+    r"(?P<adapted>\d+) adapted · (?P<partial>\d+) partial · "
+    r"(?P<missing>\d+) missing\."
+)
+
+
+def schema_items(path: Path) -> set[str]:
+    schema = json.loads(path.read_text(encoding="utf-8"))
+    variants = schema["definitions"]["ThreadItem"]["oneOf"]
+    return {variant["properties"]["type"]["enum"][0] for variant in variants}
+
+
+def documented_items() -> tuple[dict[str, str], Counter[str], Counter[str]]:
+    document = DOC_PATH.read_text(encoding="utf-8")
+    section = document.split(SECTION_START, 1)[1].split(SECTION_END, 1)[0]
+    rows = ROW_RE.findall(section)
+    names = Counter(name for name, _ in rows)
+    statuses = Counter(status.lower() for _, status in rows)
+    return dict(rows), names, statuses
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        print(f"Usage: {Path(sys.argv[0]).name} SCHEMA.json", file=sys.stderr)
+        return 2
+
+    expected = schema_items(Path(sys.argv[1]))
+    documented, name_counts, statuses = documented_items()
+    actual = set(documented)
+    errors: list[str] = []
+
+    if duplicates := sorted(name for name, count in name_counts.items() if count > 1):
+        errors.append(f"duplicate documented items: {', '.join(duplicates)}")
+    if missing := sorted(expected - actual):
+        errors.append(f"schema items missing from documentation: {', '.join(missing)}")
+    if stale := sorted(actual - expected):
+        errors.append(f"documented items absent from schema: {', '.join(stale)}")
+
+    document = DOC_PATH.read_text(encoding="utf-8")
+    total_match = TOTAL_RE.search(document)
+    if not total_match:
+        errors.append("Codex totals line is missing or malformed")
+    else:
+        totals = {name: int(value) for name, value in total_match.groupdict().items()}
+        if totals != statuses:
+            errors.append(
+                f"documented totals {totals} do not match table {dict(statuses)}"
+            )
+
+    if errors:
+        for error in errors:
+            print(f"[FAIL] {error}")
+        return 1
+
+    print(f"Codex ThreadItem census: {len(actual)} variants")
+    print(
+        "Coverage: "
+        + " / ".join(
+            f"{status.title()} {statuses[status]}"
+            for status in ("direct", "adapted", "partial", "missing")
+        )
+    )
+    print("Generated schema and documentation are in sync [OK]")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

claude_code_log-1.6.0/.claude/skills/update-tools-coverage/check_coverage.py

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""Compute tool-coverage status from the live factory registries.
+
+Run from the repo root via ``uv run`` (needs pydantic on the path):
+
+    # Feed the upstream documented tool names (whitespace/newline separated)
+    printf 'Agent Artifact ... Write' | uv run python .claude/skills/update-tools-coverage/check_coverage.py
+
+Emits, for the given upstream tool set:
+  * per-tool support level (Full / Input only / Generic),
+  * totals,
+  * tools we register that upstream does NOT list (obsolete / undocumented),
+  * drift vs. the committed dev-docs/tools-coverage.md table, if present.
+
+The classification here is the *source of truth*; the doc's Notes column is
+hand-maintained, so reconcile prose by hand after reading this output.
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+from claude_code_log.factories.tool_factory import (
+    TOOL_INPUT_MODELS,
+    TOOL_OUTPUT_PARSERS,
+)
+
+DOC = Path("dev-docs/tools-coverage.md")
+
+
+def support(tool: str) -> str:
+    has_in = tool in TOOL_INPUT_MODELS
+    has_out = tool in TOOL_OUTPUT_PARSERS
+    if has_in and has_out:
+        return "Full"
+    if has_in:
+        return "Input only"
+    return "Generic"
+
+
+def read_upstream() -> list[str]:
+    raw = " ".join(sys.argv[1:]) if len(sys.argv) > 1 else sys.stdin.read()
+    tools = raw.split()
+    if not tools:
+        sys.exit(
+            "No upstream tool names given.\n"
+            "Pass them as args or on stdin (whitespace/newline separated).\n"
+            "Get them by fetching https://code.claude.com/docs/en/tools-reference"
+        )
+    # de-dupe, preserve order
+    seen: dict[str, None] = {}
+    for t in tools:
+        seen.setdefault(t, None)
+    return list(seen)
+
+
+def main() -> None:
+    upstream = read_upstream()
+    print(f"UPSTREAM documented tools: {len(upstream)}\n")
+
+    print("=== Support level (source of truth) ===")
+    width = max(len(t) for t in upstream)
+    for t in sorted(upstream):
+        print(f"  {t:<{width}}  {support(t)}")
+
+    counts = Counter(support(t) for t in upstream)
+    print(
+        f"\n=== Totals === "
+        f"Full: {counts['Full']}  "
+        f"Input only: {counts['Input only']}  "
+        f"Generic: {counts['Generic']}"
+    )
+
+    registered = set(TOOL_INPUT_MODELS) | set(TOOL_OUTPUT_PARSERS)
+    extra = sorted(registered - set(upstream))
+    print("\n=== We register but upstream does NOT document ===")
+    print("(obsolete renames/supersessions, legacy aliases, or undocumented features)")
+    for t in extra:
+        sides = []
+        if t in TOOL_INPUT_MODELS:
+            sides.append("input")
+        if t in TOOL_OUTPUT_PARSERS:
+            sides.append("output")
+        print(f"  {t:<20} typed: {', '.join(sides)}")
+
+    # --- Drift check against the committed doc, if present ------------------
+    if not DOC.exists():
+        print(f"\n(no {DOC} yet — nothing to diff)")
+        return
+
+    doc_rows = dict(
+        re.findall(
+            r"^\| `(\w+)` \| (Full|Input only|Generic) \|",
+            DOC.read_text(encoding="utf-8"),
+            re.M,
+        )
+    )
+    print(f"\n=== Drift vs {DOC} ===")
+    problems = False
+    for t in upstream:
+        want, have = support(t), doc_rows.get(t)
+        if have is None:
+            print(f"  MISSING from doc: {t} (should be {want})")
+            problems = True
+        elif have != want:
+            print(f"  MISMATCH: {t} — doc says {have!r}, code says {want!r}")
+            problems = True
+    for t in doc_rows.keys() - set(upstream):
+        print(f"  STALE in doc (not in upstream list): {t}")
+        problems = True
+    if not problems:
+        print("  in sync [OK]")
+
+
+if __name__ == "__main__":
+    main()

claude_code_log-1.6.0/.editorconfig

@@ -0,0 +1,25 @@
+# EditorConfig — https://editorconfig.org
+# Baseline whitespace hygiene, observed by most editors/IDEs. See the
+# "Code Quality" section of CONTRIBUTING.md.
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# Markdown: a line ending in two spaces is a hard line break — trimming it
+# would silently rewrite content, so leave trailing whitespace alone here.
+[*.md]
+trim_trailing_whitespace = false
+
+# Syrupy snapshots: the serializer indents *every* line of the embedded block,
+# including blank ones, so blank lines legitimately carry trailing whitespace.
+# Never trim — regenerate with `pytest --snapshot-update -n0` instead.
+[*.ambr]
+trim_trailing_whitespace = false
+
+[*.py]
+indent_style = space
+indent_size = 4