feat(claude-code-history-files-finder): extract-user-messages script (Core Operation 5, v1.39.0)

.claude-plugin/marketplace.json

@@ -103,7 +103,7 @@
       "description": "Claude Code operations suite that bundles archive-aware local conversation discovery across Claude Code and Codex, internal-timestamp full-event session search and recovery, interrupted-work continuation, plugin/skill troubleshooting, CLAUDE.md progressive disclosure optimization, statusline configuration, exported .txt repair, full claude.ai conversation extraction with tool-call rendering and file download, plugin marketplace development, writing/testing/debugging Claude Code hooks, multi-provider profile isolation for running Kimi/GLM/DeepSeek/StepFun/Anthropic in separate windows, local source sync for Claude/Codex skill installs, personal-memory migration into tool-agnostic AGENTS.md reference docs, and terminal-output-to-PNG rendering for visual CLI verification under one shared namespace. Install once to get the full Claude Code power-user toolkit.",
       "source": "./daymade-claude-code",
       "strict": false,
-      "version": "1.38.0",
+      "version": "1.39.0",
       "category": "suite",
       "keywords": [
         "suite",

CHANGELOG.md

@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- **claude-code-history-files-finder** (`daymade-claude-code` v1.39.0): new **Core Operation 5 — Extract Verbatim User Messages** (`scripts/extract_user_messages.py` + 10 unit tests), producing a reading page (HTML + Markdown) of what the user actually typed across every home and archive. The extractor operationalizes v1.38.0's contamination taxonomy: command envelopes (XML wrapper and bare `/cmd`, args preserved) and hook/loop-injected boilerplate route to appendices — the boilerplate detector is generic (identical long text at >= `--min-dup` occurrences, no hardcoded patterns) and covers both the standalone and the tail-appended shapes; `[Image #N]` placeholders strip; whole-document pastes split off by the >=2000-chars-AND->=60%-ASCII rule; agent-voiced re-injection subtracts only against assistant texts *earlier* than the record (a later agent echo never eats the user's original). Mid-work input is recovered from `attachment.queued_command` (string and list payload variants) with a 120 s de-dupe window against delivered user records. A real-corpus run over a heavy multi-profile history reproduced the hand-built reference extraction from the incident session, with every remaining delta accounted for (sliding 7-day window between runs; the single user-confirmed agent-voiced entry a generic tool cannot know about).
 - **claude-code-history-files-finder** (`daymade-claude-code` v1.38.0): `session_file_format.md` gains two sections, both grounded in a real extraction incident where a "what the user actually said" archive shipped contaminated output through three rounds of user correction. (1) **`attachment` records: queued mid-work user input** — text typed while the assistant is still working never lands as a `type == "user"` record; it lives in `attachment.queued_command.prompt` (a string, with an observed list-of-blocks variant), and `attachment.origin.kind` separates `human` (the user) from `peer` (another agent/session) from absent (harness notifications). An extractor reading only user records dropped 153 messages over a 7-day window — exactly the interruption corrections. (2) **A user-role record is not necessarily user-authored text** — `promptSource: "typed"` / `origin.kind: "human"` prove only that text entered through the input box, not who wrote it. Five contamination classes with the splitters that worked: command envelopes (XML wrapper and bare `/cmd` — keep args, they carry real words); hook/loop-injected boilerplate (standalone records AND appended to the tail of the user's own sentence — a prefix-only filter misses the second shape); `[Image #N]` placeholders inside `text` blocks; whole-document pastes (normalized length ≥ 2000 chars AND ≥ 60% ASCII held up without misfiring on long Chinese voice dictations); and agent-voiced re-injection — undetectable from record fields, catchable only by content matching against assistant texts *earlier* than the record, and only in verbatim form (a partial rewrite with a verbatim title defeats exact-match and prefix matching alike). Also records the structurally-safe drop list: `system`/`sdk` promptSource, `isMeta`, `tool_result`, interrupt markers, compact-summary continuations.
 - **macos-cleaner** v1.2.1 → v1.3.0: new **Step 2D — Root-Cause Fix**, for when a Docker resource type keeps refilling across sessions instead of being a one-time backlog (usually a CI/CD or dev-loop script tagging a new image every build and never cleaning up the old ones). Covers diagnosing the source (group images by repository — a single repo with hundreds of tags and one active container is the tell), confirming the repository is only consumed locally before automating anything (a registry-backed multi-host pipeline needs registry-side retention instead), and a reproducible-builds caveat (Bazel/Nix/some BuildKit configs can pin `.Created` to a fixed value, so sort-by-creation-time alone can misidentify a fresh image as the oldest). Explicitly requires the user's sign-off *before* writing automated deletion logic into their build pipeline — Core Principles 1 and 9 are about unattended deletion, not which Docker subcommand runs, so avoiding `prune` alone doesn't satisfy them. Also adds: an OrbStack VM disk-usage verification method (`docker run -v /var/lib/docker:/x:ro alpine sh -c "df -h /x; du -d 1 -h /x"`, plus the BusyBox `du -d N` vs GNU `--max-depth=N` gotcha) — an earlier draft of this recommended `nsenter --privileged --pid=host` instead, on the mistaken belief that a plain read-only bind mount couldn't reach the real VM filesystem; a same-session independent review caught it, and a direct A/B test on a live OrbStack install showed both approaches report byte-identical numbers, so the unprivileged form is what shipped; a reminder that the Docker object list is live data on an actively-building machine and must be re-pulled immediately before executing a deletion plan, not reused from an earlier dry-run; and a rule that the database-volume content-inspection requirement also applies to anonymous volumes with no name to pattern-match — a real sample of 10 anonymous volumes found 5 held live, intact PostgreSQL data despite being unreferenced by any current container.
 - **claude-code-hooks** (`daymade-claude-code` v1.37.0): new **rule 9 — fixtures cannot tell you the false-positive rate; replay a real command corpus before you register**, plus a matching build-order step placed *before* symlink/registration (so the replay driver isn't self-blocked). Rule 1 ranks which error is worse and rule 2 makes you test at all; neither measures how large the false-block surface is, and the test table structurally cannot — its inputs come from the same mental model that produced the detector. Measured 2026-08-06: a PreToolUse/Bash guard passed a 26-case table with 5 mutations and was registered; replayed against 11,903 deduplicated real commands from 60 recent transcripts it blocked 46, of which **10 were wrong — 21.7% of everything it blocked**, and it had blocked 3 real sessions within 39 minutes before being removed. The rule ships the four-step method with the concrete anchors an agent actually needs (where transcripts live, the exact command-extraction path — `.message.content[]` `tool_use`/`Bash` → `.input.command`, *not* the hook event's `.tool_input.command`; why the pre-filter must be the shipped detector sliced out verbatim; scratch `TMPDIR` so rule 7 receipts don't write into real sessions or silence the guard mid-measurement; Pattern B's forced-decline path for human-gated hooks), a decision rule for the resulting number, and a cross-reference to pitfall #11, which prescribes the same instrument in the under-firing direction. **rule 6 gains a qualifier from the same incident**: a checkable fact can still be the wrong fact — `test -f SKILL.md` is true in a downloads folder, and an unanchored ancestor walk looking for exactly that swallowed a whole home directory and told a real session to load a skill that cannot exist. Known gap, stated rather than hidden: no `scripts/replay_corpus.sh` ships yet, so this is currently the only rule in the file that mandates a procedure without a bundled artifact.

daymade-claude-code/claude-code-history-files-finder/.security-scan-passed

@@ -1,4 +1,4 @@
 Security scan passed
-Scanned at: 2026-08-06T05:27:57.067473+00:00
+Scanned at: 2026-08-06T07:28:09.497153+00:00
 Tool: gitleaks + pattern-based validation
-Content hash: 2eb08473e960352a96b8bc95fc4e1599b4e9eb8fa2e23d0ef9d2c460e9f907c1
+Content hash: 5b110ca6bd776199f86a42f002f92b955e7c8a2ed4c78ed481e1bf4d0f47c136

daymade-claude-code/claude-code-history-files-finder/SKILL.md

@@ -296,6 +296,71 @@ Reports:
 
 Optional: `--show-files` to list all file operations.
 
+### 5. Extract Verbatim User Messages
+
+Produce a reading page of what the user actually typed — every user message
+across all homes and archives, with harness noise routed to appendices:
+
+```bash
+python3 scripts/extract_user_messages.py /tmp/my-words --days 7
+```
+
+Writes `/tmp/my-words.html` (primary) and `/tmp/my-words.md`. Useful flags:
+`--group-by project|day` (default `project`), `--min-dup N` (boilerplate
+frequency threshold), `--home <path>` (exact scope, repeatable).
+
+The hard part of this task is not parsing, it is *authorship*: a `user` record
+is not necessarily user-authored. The extractor implements the five
+contamination classes in `references/session_file_format.md` — command
+envelopes, hook/loop-injected boilerplate (frequency-detected, both standalone
+and tail-appended shapes), `[Image #N]` placeholders, whole-document pastes,
+and agent-voiced re-injection (content-matched against earlier assistant
+texts) — and recovers mid-work input from `attachment.queued_command` records,
+de-duplicated against later-delivered user records. Read that reference section
+before modifying the filters.
+
+### 6. Triage Session Endings (Crash Recovery / Backlog Audit)
+
+Classify how sessions in a time window or project ended, with the full last
+assistant message printed for each — the tool for "which sessions did a
+reboot/crash cut off" or "which older sessions are still waiting on a reply,
+not actually done":
+
+```bash
+python3 scripts/analyze_sessions.py triage --all-projects \
+  --from-date 2026-08-05T12:30:00+00:00 --to-date 2026-08-05T13:05:00+00:00
+```
+
+Reports each in-scope session's session ID (always full, never truncated —
+copy it directly into any follow-up report), cwd, and one of five structural
+`kind`s: `interrupted_explicit` (the session's last relevant record is an
+explicit interruption marker), `net_error` (the last assistant turn died on
+an API/transport error), `stuck_no_result` (the last assistant turn is a tool
+call with no matching result anywhere in the file), `done` (the last
+assistant turn is a normal text reply), or `empty`.
+
+**`done` is a structural label, not a claim that nothing is outstanding.** A
+session can end in a clean `text` block precisely because the assistant
+surfaced a finding, a decision, or a question and never got a reply — telling
+"fully wrapped up" from "waiting on you" requires reading the printed
+`last_assistant_text`, which is why this command prints up to 4000 characters
+of it by default (`--tail-chars 0` for no cap) rather than a truncated title.
+See "Detect Session
+Interruption" in `references/session_file_format.md` for the full reasoning,
+including why this is a genuinely different axis from the `kind` field.
+
+Useful flags: `--kind KIND` (repeatable, restrict to specific kinds — e.g.
+`--kind stuck_no_result --kind interrupted_explicit` for "only the ones a
+crash could plausibly explain"); `--exclude-title-prefix TEXT` (repeatable —
+exclude sessions whose opening prompt starts with TEXT, for a project's own
+automation convention such as a code-review hook that always opens with the
+same fixed prompt; these otherwise dominate a triage pass because they end
+in a routine structured tool call, not an interruption); `--tail-chars N`
+(cap the printed last-assistant text; default 4000, 0 = unlimited). Shares
+`--from-date`/`--to-date`/`--home`/`--main-only`/`--history-sources` with
+`list`, and `--all-projects`/project-path/`--exclude-session` with both
+`list` and `search`.
+
 ## Workflow Examples
 
 For detailed workflow examples including file recovery, tracking file evolution, and batch operations, see `references/workflow_examples.md`.