feat: logs, env file, native Go replacements, tool-use hook

- Add ctm logs (list/view/tail) + hidden ctm log-tool-use PostToolUse hook
- Add ~/.config/ctm/env.sh — shell env sourced before claude (fixes NO_FLICKER)
- Replace google/uuid with crypto/rand newUUIDv4
- Replace pgrep with /proc walk, grep with filepath.WalkDir
- Okabe-Ito colorblind-safe status line with 3 thin bars + token counts
- Tmux: Alt-a prefix, Alt-[ direct copy-mode, OSC52 set-clipboard
- Security: log files 0600, session-id sanitization, flock on concurrent writes
- 164 tests, zero non-tmux runtime deps

Author: ctm

.gitignore

@@ -1 +1,15 @@
+# Built binary
 ctm
+
+# Go coverage / profiling
+*.out
+*.test
+coverage.*
+
+# IDE
+.idea/
+.vscode/
+*.swp
+
+# OS
+.DS_Store

README.md

@@ -10,9 +10,12 @@ Mobile-first session manager for [Claude Code](https://claude.com/claude-code) r
 - **Crash-safe state.** Atomic writes, flock-based locking, corruption recovery on `sessions.json`.
 - **Resume with fallback.** `claude --resume UUID || claude --session-id UUID` — recovers from missing session data.
 - **Claude overlay.** Drop a `claude-overlay.json` to apply ctm-only settings (statusline, theme, etc.) without touching your global `~/.claude/settings.json`.
+- **ctm-only shell env.** `~/.config/ctm/env.sh` is sourced before claude spawns — set env vars like `CLAUDE_CODE_NO_FLICKER=1` that claude reads during startup (too early for settings.json's `env` key).
+- **Tool-use logging.** Built-in PostToolUse hook (pure Go, no jq/bash deps) writes one JSONL entry per tool call to `~/.config/ctm/logs/<session>.jsonl`. View with `ctm logs`.
 - **YOLO mode.** Auto-commits a git checkpoint before bypassing permissions, so you can always roll back.
 - **Preflight health checks.** Env vars, PATH, workdir, tmux session, claude process — cached for 60s to keep mobile reconnects snappy.
 - **OSC52 clipboard sync.** Copy in tmux, paste anywhere.
+- **Zero non-tmux runtime dependencies.** Pure Go throughout — native UUID, `/proc` walk, `filepath.WalkDir`. No `jq`, `pgrep`, `grep`, or `uuidgen` required.
 
 ## Installation
 
@@ -88,12 +91,23 @@ This generates `~/.config/ctm/config.json` and `~/.config/ctm/tmux.conf` and set
 
 | Command | Description |
 |---|---|
-| `ctm overlay` | Show overlay status (active / missing). |
-| `ctm overlay init` | Create a sample `~/.config/ctm/claude-overlay.json` with statusline + theme examples. |
-| `ctm overlay edit` | Open the overlay in `$EDITOR` (creates sample if missing). |
+| `ctm overlay` | Show overlay status (active / missing) with paths to sidecar files. |
+| `ctm overlay init` | Create a sample `~/.config/ctm/claude-overlay.json` + `statusline.sh` + `env.sh` + hooks wiring. |
+| `ctm overlay edit` | Open the overlay in `$EDITOR` (creates sidecars if missing). |
 | `ctm overlay path` | Print the overlay file path. |
 
-When the overlay file exists, ctm-spawned claude invocations get `--settings <path>` automatically. Direct `claude` invocations outside ctm are untouched.
+When the overlay file exists, ctm-spawned claude invocations get `--settings <path>` automatically, and `env.sh` is sourced by the shell before claude starts. Direct `claude` invocations outside ctm are untouched.
+
+### Logs
+
+| Command | Description |
+|---|---|
+| `ctm logs` | List sessions with tool-use logs, sorted by most recent. |
+| `ctm logs <session-id>` | Dump a session's formatted tool-use log. |
+| `ctm logs <session-id> -f` | Tail the log in real time. Handles rotation and truncation. |
+| `ctm logs <session-id> --raw` | Print raw JSONL lines (pipe to `jq` for scripting). |
+
+Logs are populated by a PostToolUse hook registered in the overlay. Each entry contains the full Claude Code hook payload plus a UTC timestamp. File perms 0600, session-id sanitized to prevent path traversal, concurrent writes coordinated via advisory flock.
 
 ## Keybindings
 
@@ -125,7 +139,10 @@ Claude Code's TUI uses alt-screen and has no built-in scroll history. The app-in
 - `~/.config/ctm/config.json` — main config (scrollback lines, required env vars, default mode, health check timeout, yolo checkpoint toggle)
 - `~/.config/ctm/sessions.json` — session state (atomically written, flock-locked)
 - `~/.config/ctm/tmux.conf` — generated tmux config (mobile-optimized, don't edit)
-- `~/.config/ctm/claude-overlay.json` — optional claude settings overlay
+- `~/.config/ctm/claude-overlay.json` — optional claude settings overlay (statusline, theme, hooks)
+- `~/.config/ctm/statusline.sh` — custom statusline script referenced by the overlay
+- `~/.config/ctm/env.sh` — shell env sourced before claude spawns (for early-binding env vars like `CLAUDE_CODE_NO_FLICKER`)
+- `~/.config/ctm/logs/<session-id>.jsonl` — per-session tool-use logs (0600)
 
 ## Upgrading
 

cmd/attach.go

@@ -76,7 +76,7 @@ func createAndAttach(name, workdir, mode string, store *session.Store, tc *tmux.
 	out.Info("No session %q found — creating in %s", name, abs)
 
 	sess := session.New(name, abs, mode)
-	shellCmd := claude.BuildCommand(sess.UUID, mode, false, claude.OverlayPathIfExists(config.ClaudeOverlayPath()))
+	shellCmd := claude.BuildCommand(sess.UUID, mode, false, claude.OverlayPathIfExists(config.ClaudeOverlayPath()), claude.EnvFilePathIfExists(config.EnvFilePath()))
 
 	if err := tc.NewSession(name, abs, shellCmd); err != nil {
 		return fmt.Errorf("creating tmux session: %w", err)
@@ -134,7 +134,7 @@ func preflight(sess *session.Session, cfg config.Config, store *session.Store, t
 	tmuxResult := health.CheckTmuxSession(tc, sess.Name)
 	if !tmuxResult.Passed() {
 		out.Warn("tmux session %q missing — recreating", sess.Name)
-		shellCmd := claude.BuildCommand(sess.UUID, sess.Mode, true, claude.OverlayPathIfExists(config.ClaudeOverlayPath()))
+		shellCmd := claude.BuildCommand(sess.UUID, sess.Mode, true, claude.OverlayPathIfExists(config.ClaudeOverlayPath()), claude.EnvFilePathIfExists(config.EnvFilePath()))
 		if err := tc.NewSession(sess.Name, sess.Workdir, shellCmd); err != nil {
 			return fmt.Errorf("recreating tmux session: %w", err)
 		}
@@ -156,7 +156,7 @@ func preflight(sess *session.Session, cfg config.Config, store *session.Store, t
 	if !claudeResult.Passed() {
 		out.Debug(Verbose, "claude not running, restarting with --resume")
 		out.Warn("claude process dead — respawning")
-		shellCmd := claude.BuildCommand(sess.UUID, sess.Mode, true, claude.OverlayPathIfExists(config.ClaudeOverlayPath()))
+		shellCmd := claude.BuildCommand(sess.UUID, sess.Mode, true, claude.OverlayPathIfExists(config.ClaudeOverlayPath()), claude.EnvFilePathIfExists(config.EnvFilePath()))
 		if err := tc.RespawnPane(sess.Name, shellCmd); err != nil {
 			return fmt.Errorf("respawning pane: %w", err)
 		}

cmd/log_tool_use.go

@@ -0,0 +1,106 @@
+package cmd
+
+import (
+	"encoding/json"
+	"io"
+	"os"
+	"path/filepath"
+	"regexp"
+	"syscall"
+	"time"
+
+	"github.com/spf13/cobra"
+	"github.com/RandomCodeSpace/ctm/internal/config"
+)
+
+func init() {
+	rootCmd.AddCommand(logToolUseCmd)
+}
+
+// logToolUseCmd is the PostToolUse hook target. Claude invokes it for every
+// tool call and pipes the raw hook JSON on stdin. We parse it, add a
+// timestamp, and append one JSONL line to ~/.config/ctm/logs/<session>.jsonl.
+//
+// Hidden because it's an internal hook, not a user-facing command. Always
+// exits 0 — hook failures must never block the tool pipeline.
+var logToolUseCmd = &cobra.Command{
+	Use:    "log-tool-use",
+	Short:  "Internal PostToolUse hook — logs tool invocations (hidden)",
+	Hidden: true,
+	RunE:   runLogToolUse,
+	SilenceUsage:  true,
+	SilenceErrors: true,
+}
+
+// sessionIDSafe matches only characters we allow in a log filename.
+// Claude's session IDs are UUIDs, but we sanitize defensively to prevent
+// path traversal or filesystem weirdness if the hook payload is malformed.
+var sessionIDSafe = regexp.MustCompile(`[^a-zA-Z0-9_-]`)
+
+func sanitizeSessionID(id string) string {
+	clean := sessionIDSafe.ReplaceAllString(id, "-")
+	if clean == "" || len(clean) > 128 {
+		return "unknown"
+	}
+	return clean
+}
+
+func runLogToolUse(cmd *cobra.Command, args []string) error {
+	// Read all of stdin. Hook payloads are small (<100KB typically).
+	data, err := io.ReadAll(io.LimitReader(os.Stdin, 1<<20)) // 1 MiB cap
+	if err != nil || len(data) == 0 {
+		return nil
+	}
+
+	// Parse into a generic map so we preserve all fields claude sends.
+	var payload map[string]interface{}
+	if err := json.Unmarshal(data, &payload); err != nil {
+		return nil
+	}
+
+	// Extract and sanitize session_id for the filename.
+	sessionID := "unknown"
+	if v, ok := payload["session_id"].(string); ok && v != "" {
+		sessionID = sanitizeSessionID(v)
+	}
+
+	// Add a ctm-side timestamp so the log is readable even if claude
+	// doesn't include one in the payload.
+	payload["ctm_timestamp"] = time.Now().UTC().Format(time.RFC3339)
+
+	logDir := filepath.Join(config.Dir(), "logs")
+	// 0700 on the dir — tool payloads can contain file paths and contents.
+	if err := os.MkdirAll(logDir, 0700); err != nil {
+		return nil
+	}
+	logFile := filepath.Join(logDir, sessionID+".jsonl")
+
+	// 0600 on the file — same reasoning as the dir.
+	f, err := os.OpenFile(logFile, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0600)
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+
+	line, err := json.Marshal(payload)
+	if err != nil {
+		return nil
+	}
+	line = append(line, '\n')
+
+	// Acquire an exclusive advisory lock before writing. O_APPEND is only
+	// atomic up to PIPE_BUF (4096 bytes) on Linux; tool payloads can easily
+	// exceed that (Read/Bash output). Without the lock, concurrent hook
+	// invocations can interleave bytes and corrupt the JSONL stream.
+	// Lock failure is non-fatal — write anyway rather than block the tool pipeline.
+	fd := int(f.Fd())
+	lockAcquired := false
+	if err := syscall.Flock(fd, syscall.LOCK_EX); err == nil {
+		lockAcquired = true
+		defer syscall.Flock(fd, syscall.LOCK_UN) //nolint:errcheck
+	}
+	_ = lockAcquired
+
+	_, _ = f.Write(line)
+	return nil
+}

cmd/log_tool_use_test.go

@@ -0,0 +1,44 @@
+package cmd
+
+import "testing"
+
+func TestSanitizeSessionID(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{"valid uuid", "f6489cb4-010f-4c96-940b-188014f746f0", "f6489cb4-010f-4c96-940b-188014f746f0"},
+		{"simple alnum", "abc123", "abc123"},
+		{"underscore ok", "a_b_c", "a_b_c"},
+		{"dash ok", "a-b-c", "a-b-c"},
+		{"path traversal attempt", "../../etc/passwd", "------etc-passwd"},
+		{"absolute path", "/etc/passwd", "-etc-passwd"},
+		{"dot", "a.b.c", "a-b-c"},
+		{"spaces", "a b c", "a-b-c"},
+		{"null byte", "abc\x00def", "abc-def"},
+		{"empty string", "", "unknown"},
+		{"only invalid chars", "////", "----"},
+		{"really long", string(make([]byte, 200)), "unknown"}, // >128 after sanitize → fallback
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := sanitizeSessionID(tt.in)
+			if got != tt.want {
+				t.Errorf("sanitizeSessionID(%q) = %q, want %q", tt.in, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSanitizeSessionIDNoEmptyResult(t *testing.T) {
+	// Sanity: never returns "" — either a clean id or "unknown".
+	inputs := []string{"", "...", "/////", string(make([]byte, 500))}
+	for _, in := range inputs {
+		got := sanitizeSessionID(in)
+		if got == "" {
+			t.Errorf("sanitizeSessionID(%q) returned empty string", in)
+		}
+	}
+}