beehaven 0.8.16

package/dist/commands/claude.js

@@ -0,0 +1,218 @@
+/**
+ * `beehaven claude` — LOCAL, single-user Claude Code via the Claude Agent SDK,
+ * authenticated by the user's OWN Claude subscription (local OAuth).
+ *
+ * Restored from the pre-"destroy-the-treehouse" daemon integration but wired
+ * LOCAL-ONLY: the SDK `query()` runs in THIS process, reading the user's OAuth
+ * from `~/.claude/.credentials.json` (written by `claude setup-token`). The
+ * cloud→daemon orchestration path — disabled for Anthropic credential-use-policy
+ * compliance (see relay.ts) — stays OFF; nothing here syncs a token to the cloud
+ * or lets a remote drive Claude. It's your machine, your subscription, your turns.
+ *
+ * Subcommands:
+ *   login              run `claude setup-token` (browser OAuth) to authorize the SDK
+ *   status             show which credential is active (plan / api-key), masked
+ *   logout             remove the beehaven-stored credential copy
+ *   run "<task>"       run one Claude turn in cwd (streamed) — also the default:
+ *   "<task>"           `beehaven claude "refactor auth.ts"`
+ *
+ * Flags (run): --composition <id>  --cwd <dir>  --model <m>  --continue  --resume <sid>
+ */
+import { startPlanOauth, readClaudeCredential, deleteClaudeCredential, findClaudeBinary, } from '../claude-credential-store.js';
+import { promptOmni, subscribe, endSession } from '../daemon-omni.js';
+import { withDevMode } from '../dev-mode.js';
+import { userInfo } from 'node:os';
+// Tiny inline ANSI (spinner.ts only exports the spinner factory).
+const c = {
+    cyan: (s) => `\x1b[36m${s}\x1b[0m`,
+    green: (s) => `\x1b[32m${s}\x1b[0m`,
+    red: (s) => `\x1b[31m${s}\x1b[0m`,
+    dim: (s) => `\x1b[2m${s}\x1b[0m`,
+    yellow: (s) => `\x1b[33m${s}\x1b[0m`,
+};
+export async function cmdClaude(positionals, values) {
+    const sub = positionals[1];
+    switch (sub) {
+        case 'login':
+            return claudeLogin();
+        case 'status':
+            return claudeStatus();
+        case 'logout':
+            return claudeLogout();
+        case undefined:
+        case 'help':
+        case '--help':
+        case '-h':
+            return printHelp();
+        case 'run':
+            return claudeRun(positionals.slice(2).join(' '), values);
+        default:
+            // `beehaven claude "<task>"` — everything after `claude` is the task.
+            return claudeRun(positionals.slice(1).join(' '), values);
+    }
+}
+function printHelp() {
+    console.log(`
+  ${c.cyan('beehaven claude')} — local Claude Code via the Claude Agent SDK (your subscription)
+
+  ${c.dim('login')}              authorize the SDK with your Claude login (runs ${c.dim('claude setup-token')})
+  ${c.dim('status')}             show the active credential (plan / api-key), masked
+  ${c.dim('logout')}             remove the stored credential copy
+  ${c.dim('run "<task>"')}       run one Claude turn in the current directory (streamed)
+  ${c.dim('"<task>"')}           shorthand for run
+
+  ${c.dim('Flags:')} --composition <id>  --cwd <dir>  --model <m>  --continue  --resume <sid>
+
+  First time: ${c.cyan('beehaven claude login')} → ${c.cyan('beehaven claude "list the files here"')}
+`);
+}
+async function claudeLogin() {
+    const bin = await findClaudeBinary();
+    if (!bin) {
+        console.error(c.red('✗') +
+            ' Claude Code binary not found. Install it from https://claude.com/download (or reinstall the Mac app), then retry.');
+        process.exitCode = 1;
+        return;
+    }
+    console.log(c.dim(`Running ${bin} setup-token — a browser window will open for the Claude OAuth flow…`));
+    await new Promise((resolve) => {
+        let settled = false;
+        const finish = () => {
+            if (!settled) {
+                settled = true;
+                resolve();
+            }
+        };
+        startPlanOauth({
+            onOutput: (chunk) => process.stdout.write(chunk),
+            onExit: (code) => {
+                if (code === 0) {
+                    console.log('\n' +
+                        c.green('✓') +
+                        ' Authorized. The Claude Agent SDK will use your subscription (~/.claude/.credentials.json).');
+                }
+                else {
+                    console.error('\n' + c.red('✗') + ` claude setup-token exited with code ${code}.`);
+                    process.exitCode = 1;
+                }
+                finish();
+            },
+        }).then((r) => {
+            if (!('error' in r))
+                return; // spawned OK — onExit will fire finish()
+            console.error(c.red('✗') + ' ' + r.error);
+            process.exitCode = 1;
+            finish();
+        });
+    });
+}
+async function claudeStatus() {
+    const [cred, bin] = await Promise.all([readClaudeCredential(), findClaudeBinary()]);
+    console.log(`  Claude binary:  ${bin ? c.green(bin) : c.red('not found')}`);
+    if (!cred) {
+        console.log(`  Credential:     ${c.yellow('none')} — run ${c.cyan('beehaven claude login')}`);
+    }
+    else {
+        console.log(`  Credential:     ${c.green(cred.credType)} (${cred.maskedKey})`);
+    }
+}
+async function claudeLogout() {
+    await deleteClaudeCredential();
+    console.log(c.green('✓') +
+        ' Removed the beehaven-stored credential copy. ' +
+        c.dim('(This does NOT sign you out of Claude Code itself — run `claude logout` for that.)'));
+}
+async function claudeRun(taskRaw, values) {
+    const task = (taskRaw || '').trim();
+    if (!task) {
+        console.error(c.red('✗') + ' Provide a task, e.g. ' + c.cyan('beehaven claude "refactor auth.ts"'));
+        process.exitCode = 1;
+        return;
+    }
+    // The SDK reads ~/.claude/.credentials.json natively; this is just a friendly pre-check.
+    const cred = await readClaudeCredential();
+    if (!cred && !(await findClaudeBinary())) {
+        console.error(c.red('✗') + ' Not authorized. Run ' + c.cyan('beehaven claude login') + ' first.');
+        process.exitCode = 1;
+        return;
+    }
+    const sessionId = `cli-${process.pid}-${Date.now()}`;
+    const userId = userInfo().username || 'local';
+    let sawText = false;
+    let resolveDone = () => { };
+    const finished = new Promise((res) => {
+        resolveDone = res;
+    });
+    const cleanup = (code) => {
+        try {
+            unsub();
+        }
+        catch {
+            /* idempotent */
+        }
+        try {
+            endSession(sessionId);
+        }
+        catch {
+            /* best-effort */
+        }
+        process.exitCode = code;
+        resolveDone();
+    };
+    const unsub = subscribe((ev) => {
+        if (ev.sessionId !== sessionId)
+            return;
+        switch (ev.type) {
+            case 'agent:text-delta':
+                process.stdout.write(ev.text);
+                sawText = true;
+                break;
+            case 'agent:tool-call':
+                process.stdout.write('\n' + c.dim(`  ⚙ ${ev.tool}(${JSON.stringify(ev.input ?? {}).slice(0, 80)})`) + '\n');
+                break;
+            case 'agent:tool-result':
+                process.stdout.write(c.dim(`  ${ev.ok ? '✓' : '✗'} ${ev.tool}${ev.preview ? ' — ' + ev.preview.slice(0, 80) : ''}`) + '\n');
+                break;
+            case 'agent:compacting':
+                process.stdout.write(c.dim(`  … compacting context (${ev.kind})`) + '\n');
+                break;
+            case 'agent:done':
+                if (!sawText && ev.result?.text)
+                    process.stdout.write(ev.result.text);
+                process.stdout.write('\n' + c.green('✓') + c.dim(` done (${ev.result?.turns ?? '?'} turns, ${ev.result?.durationMs ?? '?'}ms)`) + '\n');
+                cleanup(0);
+                break;
+            case 'agent:error':
+                process.stderr.write('\n' + c.red('✗') + ' ' + ev.error + '\n');
+                cleanup(1);
+                break;
+        }
+    });
+    try {
+        await promptOmni({
+            prompt: task,
+            sessionId,
+            userId,
+            // Dev mode — the SAME instruction the maid chat's Claude gets
+            // (apps/electron/electron/treehouse-agents.ts). Two processes, two builds,
+            // two Claude Agent SDK integrations; without this the two behaved
+            // differently, and only the one nobody drives from a terminal was asked to
+            // report what it trips over. promptOmni has always taken appendSystemPrompt
+            // — this caller simply never passed one.
+            appendSystemPrompt: withDevMode(),
+            model: typeof values.model === 'string' ? values.model : undefined,
+            cwd: typeof values.cwd === 'string' ? values.cwd : undefined,
+            compositionId: typeof values.composition === 'string' ? values.composition : undefined,
+            continueSession: !!values.continue,
+            resumeSessionId: typeof values.resume === 'string' ? values.resume : undefined,
+        });
+    }
+    catch (err) {
+        process.stderr.write(c.red('✗') + ' ' + (err?.message ?? String(err)) + '\n');
+        cleanup(1);
+        return;
+    }
+    await finished;
+    // The SDK subprocess may keep handles open; exit deterministically once the turn is done.
+    setImmediate(() => process.exit(process.exitCode ?? 0));
+}

package/dist/commands/compliance.js

@@ -0,0 +1,387 @@
+/**
+ * beehaven compliance — Security & compliance report
+ *
+ * Scans the project for compliance posture:
+ *   - Auth configuration (Passport provider, MFA, session management)
+ *   - Data classification (tables with classification tags)
+ *   - Audit logging (AuditChain configured)
+ *   - Encryption (at-rest encryption, KeyRing)
+ *   - API key management (ApiKeyManager usage)
+ *   - Lock/access control (per-building locks)
+ *   - Rate limiting (Middleware, Counter)
+ *   - Visitor session management (credit limits, action allowlists)
+ *   - CORS configuration
+ *   - Environment variable security (secrets vs plaintext)
+ *
+ * Usage:
+ *   beehaven compliance               # Full report
+ *   beehaven compliance --format json  # JSON output
+ *   beehaven compliance --check        # Exit 1 if critical issues found
+ */
+import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
+import { join, relative } from 'path';
+import { color } from '../spinner.js';
+export async function compliance(args) {
+    const projectDir = args.path ?? process.cwd();
+    const findings = [];
+    console.log(color.cyan('\n🔒 Beehaven Compliance Report\n'));
+    // Scan source files
+    const sourceFiles = findSourceFiles(projectDir);
+    // ── Auth Configuration ───────────────────────────────────
+    checkAuth(sourceFiles, findings);
+    // ── Data Classification ──────────────────────────────────
+    checkClassification(sourceFiles, findings);
+    // ── Audit Logging ────────────────────────────────────────
+    checkAuditLog(sourceFiles, findings);
+    // ── Encryption ───────────────────────────────────────────
+    checkEncryption(sourceFiles, findings);
+    // ── API Key Management ───────────────────────────────────
+    checkApiKeys(sourceFiles, findings);
+    // ── Access Control (Locks) ───────────────────────────────
+    checkLocks(sourceFiles, findings);
+    // ── Rate Limiting ────────────────────────────────────────
+    checkRateLimiting(sourceFiles, findings);
+    // ── Visitor Sessions ─────────────────────────────────────
+    checkVisitorSessions(sourceFiles, findings);
+    // ── Environment Variables ────────────────────────────────
+    checkEnvSecurity(projectDir, findings);
+    // ── CORS ─────────────────────────────────────────────────
+    checkCors(sourceFiles, findings);
+    // ── MFA ──────────────────────────────────────────────────
+    checkMFA(sourceFiles, findings);
+    // Build report
+    const report = buildReport(findings);
+    if (args.format === 'json') {
+        console.log(JSON.stringify(report, null, 2));
+    }
+    else {
+        printReport(report);
+    }
+    if (args.check && report.findings.some((f) => f.severity === 'critical')) {
+        process.exit(1);
+    }
+}
+// ── Checks ──────────────────────────────────────────────────────────
+function checkAuth(files, findings) {
+    const hasPassport = files.some((f) => f.content.includes('Passport.'));
+    const hasAuthVerify = files.some((f) => f.content.includes('auth:') && f.content.includes('verify'));
+    if (!hasPassport && !hasAuthVerify) {
+        findings.push({
+            category: 'Auth',
+            severity: 'critical',
+            message: 'No auth provider configured (Passport or verify function)',
+            fix: 'Add auth: { verify: Passport.firebase({ projectId }) } to defineHive()',
+        });
+    }
+    else {
+        findings.push({ category: 'Auth', severity: 'pass', message: 'Auth provider configured' });
+    }
+    const hasTicket = files.some((f) => f.content.includes('/auth/ticket'));
+    if (hasTicket) {
+        findings.push({
+            category: 'Auth',
+            severity: 'pass',
+            message: 'Ticket exchange enabled for WebSocket auth',
+        });
+    }
+}
+function checkClassification(files, findings) {
+    const hasClassification = files.some((f) => f.content.includes('ClassificationRegistry') || f.content.includes('classification:'));
+    if (hasClassification) {
+        findings.push({
+            category: 'Data',
+            severity: 'pass',
+            message: 'Data classification configured',
+        });
+    }
+    else {
+        findings.push({
+            category: 'Data',
+            severity: 'warning',
+            message: 'No data classification — consider tagging tables with sensitivity levels',
+            fix: 'Use ClassificationRegistry to tag tables as public/internal/confidential/restricted',
+        });
+    }
+}
+function checkAuditLog(files, findings) {
+    const hasAudit = files.some((f) => f.content.includes('AuditChain') ||
+        f.content.includes('AuditSink') ||
+        f.content.includes('auditChain'));
+    if (hasAudit) {
+        findings.push({ category: 'Audit', severity: 'pass', message: 'Audit logging configured' });
+    }
+    else {
+        findings.push({
+            category: 'Audit',
+            severity: 'warning',
+            message: 'No audit logging — required for SOC2 compliance',
+            fix: 'Add AuditChain with D1 backend for tamper-proof audit trail',
+        });
+    }
+}
+function checkEncryption(files, findings) {
+    const hasEncryption = files.some((f) => f.content.includes('Encryption') || f.content.includes('KeyRing'));
+    if (hasEncryption) {
+        findings.push({
+            category: 'Encryption',
+            severity: 'pass',
+            message: 'At-rest encryption configured',
+        });
+    }
+    else {
+        findings.push({
+            category: 'Encryption',
+            severity: 'info',
+            message: 'No field-level encryption — consider for PII columns',
+            fix: 'Use Encryption class for encrypting sensitive columns',
+        });
+    }
+}
+function checkApiKeys(files, findings) {
+    const hasApiKeys = files.some((f) => f.content.includes('ApiKeyManager'));
+    const hasPlaintextKeys = files.some((f) => /apiKey\s*[:=]\s*['"][^'"]{20,}['"]/.test(f.content));
+    if (hasPlaintextKeys) {
+        findings.push({
+            category: 'API Keys',
+            severity: 'critical',
+            message: 'Hardcoded API key detected in source code',
+            fix: 'Move API keys to environment variables or secrets',
+        });
+    }
+    if (hasApiKeys) {
+        findings.push({
+            category: 'API Keys',
+            severity: 'pass',
+            message: 'ApiKeyManager configured (SHA-256 hashed storage)',
+        });
+    }
+}
+function checkLocks(files, findings) {
+    const hasLock = files.some((f) => f.content.includes('Lock.') || f.content.includes('lock =') || f.content.includes('lock:'));
+    if (hasLock) {
+        findings.push({
+            category: 'Access',
+            severity: 'pass',
+            message: 'Lock-based access control configured',
+        });
+    }
+    else {
+        findings.push({
+            category: 'Access',
+            severity: 'warning',
+            message: 'No explicit lock on buildings — all authenticated users can access',
+            fix: 'Add Lock.member(), Lock.owner(), or Lock.roles() to restrict access',
+        });
+    }
+}
+function checkRateLimiting(files, findings) {
+    const hasRateLimit = files.some((f) => f.content.includes('rateLimit') ||
+        f.content.includes('Counter') ||
+        f.content.includes('RATE_LIMITER'));
+    if (hasRateLimit) {
+        findings.push({
+            category: 'Rate Limit',
+            severity: 'pass',
+            message: 'Rate limiting configured',
+        });
+    }
+    else {
+        findings.push({
+            category: 'Rate Limit',
+            severity: 'warning',
+            message: 'No rate limiting — vulnerable to abuse',
+            fix: 'Add rateLimit to tiers or use CF Rate Limiting binding',
+        });
+    }
+}
+function checkVisitorSessions(files, findings) {
+    const hasVisitors = files.some((f) => f.content.includes('VisitorSessionManager'));
+    if (hasVisitors) {
+        findings.push({
+            category: 'Visitors',
+            severity: 'pass',
+            message: 'Visitor session management with credit limits',
+        });
+    }
+}
+function checkEnvSecurity(projectDir, findings) {
+    // Check for .env in git
+    const gitignorePath = join(projectDir, '.gitignore');
+    if (existsSync(gitignorePath)) {
+        const gitignore = readFileSync(gitignorePath, 'utf-8');
+        if (!gitignore.includes('.env')) {
+            findings.push({
+                category: 'Env',
+                severity: 'critical',
+                message: '.env not in .gitignore — secrets may be committed',
+                fix: 'Add .env to .gitignore',
+            });
+        }
+        else {
+            findings.push({ category: 'Env', severity: 'pass', message: '.env excluded from git' });
+        }
+    }
+    // Check for .env file with secrets
+    const envPath = join(projectDir, '.env');
+    if (existsSync(envPath)) {
+        const env = readFileSync(envPath, 'utf-8');
+        const secretPatterns = [/sk_live_/i, /whsec_/i, /-----BEGIN/i, /password\s*=/i];
+        for (const pattern of secretPatterns) {
+            if (pattern.test(env)) {
+                findings.push({
+                    category: 'Env',
+                    severity: 'warning',
+                    message: 'Production secrets detected in .env file',
+                    fix: 'Use wrangler secret or CF dashboard for production secrets',
+                });
+                break;
+            }
+        }
+    }
+    // Check wrangler.toml for plaintext secrets
+    const wranglerPath = join(projectDir, 'wrangler.toml');
+    if (existsSync(wranglerPath)) {
+        const wrangler = readFileSync(wranglerPath, 'utf-8');
+        if (/secret|key|password|token/i.test(wrangler) && /=\s*"[^"]{10,}"/.test(wrangler)) {
+            findings.push({
+                category: 'Env',
+                severity: 'warning',
+                message: 'Possible secrets in wrangler.toml — use wrangler secret instead',
+            });
+        }
+    }
+}
+function checkCors(files, findings) {
+    const hasWildcardCors = files.some((f) => f.content.includes("'*'") && f.content.includes('Access-Control'));
+    if (hasWildcardCors) {
+        findings.push({
+            category: 'CORS',
+            severity: 'warning',
+            message: 'Wildcard CORS origin detected — consider restricting to specific domains',
+        });
+    }
+}
+function checkMFA(files, findings) {
+    const hasMFA = files.some((f) => f.content.includes('withMFA') || f.content.includes('MFA'));
+    if (hasMFA) {
+        findings.push({ category: 'MFA', severity: 'pass', message: 'MFA (TOTP) configured' });
+    }
+    else {
+        findings.push({
+            category: 'MFA',
+            severity: 'info',
+            message: 'No MFA configured — consider for admin/sensitive operations',
+            fix: 'Use withMFA() to wrap Passport for admin routes',
+        });
+    }
+}
+// ── Report Builder ──────────────────────────────────────────────────
+function buildReport(findings) {
+    const categories = [...new Set(findings.map((f) => f.category))];
+    const summary = {};
+    let totalScore = 0;
+    let totalMax = 0;
+    for (const cat of categories) {
+        const catFindings = findings.filter((f) => f.category === cat);
+        const max = catFindings.length * 10;
+        let score = 0;
+        for (const f of catFindings) {
+            switch (f.severity) {
+                case 'pass':
+                    score += 10;
+                    break;
+                case 'info':
+                    score += 7;
+                    break;
+                case 'warning':
+                    score += 3;
+                    break;
+                case 'critical':
+                    score += 0;
+                    break;
+            }
+        }
+        summary[cat] = { score, max, findings: catFindings.length };
+        totalScore += score;
+        totalMax += max;
+    }
+    const pct = totalMax > 0 ? Math.round((totalScore / totalMax) * 100) : 0;
+    let grade;
+    if (pct >= 90)
+        grade = 'A';
+    else if (pct >= 80)
+        grade = 'B';
+    else if (pct >= 70)
+        grade = 'C';
+    else if (pct >= 60)
+        grade = 'D';
+    else
+        grade = 'F';
+    return { score: totalScore, maxScore: totalMax, grade, findings, summary };
+}
+function printReport(report) {
+    const severityColors = {
+        critical: color.red,
+        warning: color.yellow,
+        info: color.cyan,
+        pass: color.green,
+    };
+    const severityIcons = {
+        critical: 'FAIL',
+        warning: 'WARN',
+        info: 'INFO',
+        pass: 'PASS',
+    };
+    // Group by category
+    const categories = [...new Set(report.findings.map((f) => f.category))];
+    for (const cat of categories) {
+        const catFindings = report.findings.filter((f) => f.category === cat);
+        const catSummary = report.summary[cat];
+        const pct = catSummary.max > 0 ? Math.round((catSummary.score / catSummary.max) * 100) : 0;
+        console.log(`${color.bold(cat)} ${color.dim(`(${pct}%)`)}`);
+        for (const f of catFindings) {
+            const icon = severityIcons[f.severity];
+            const colorFn = severityColors[f.severity];
+            console.log(`  ${colorFn(icon)} ${f.message}`);
+            if (f.fix)
+                console.log(`       ${color.dim(`Fix: ${f.fix}`)}`);
+        }
+        console.log('');
+    }
+    // Overall score
+    const pct = report.maxScore > 0 ? Math.round((report.score / report.maxScore) * 100) : 0;
+    const gradeColor = report.grade === 'A' ? color.green : report.grade === 'B' ? color.yellow : color.red;
+    console.log(`${color.bold('Overall:')} ${gradeColor(`Grade ${report.grade}`)} (${pct}%)`);
+    const criticals = report.findings.filter((f) => f.severity === 'critical').length;
+    const warnings = report.findings.filter((f) => f.severity === 'warning').length;
+    if (criticals > 0)
+        console.log(color.red(`  ${criticals} critical issue(s) require immediate attention`));
+    if (warnings > 0)
+        console.log(color.yellow(`  ${warnings} warning(s) should be addressed`));
+    console.log('');
+}
+function findSourceFiles(dir) {
+    const files = [];
+    const extensions = ['.ts', '.tsx', '.js', '.jsx'];
+    const ignoreDirs = ['node_modules', 'dist', '.git', '_archive'];
+    function walk(d) {
+        try {
+            for (const entry of readdirSync(d)) {
+                const full = join(d, entry);
+                try {
+                    const stat = statSync(full);
+                    if (stat.isDirectory() && !ignoreDirs.includes(entry)) {
+                        walk(full);
+                    }
+                    else if (stat.isFile() && extensions.some((ext) => entry.endsWith(ext))) {
+                        files.push({ path: relative(dir, full), content: readFileSync(full, 'utf-8') });
+                    }
+                }
+                catch { }
+            }
+        }
+        catch { }
+    }
+    walk(dir);
+    return files;
+}