codehere 0.1.1 → 0.2.1

package/dist/presentation/cli/commands/report-command.js

@@ -0,0 +1,353 @@
+/**
+ * CLI Command: report
+ *
+ * Generates a shareable audit narrative — not just a score.
+ * The viral artifact: something developers post in PRs, tweet, and put in READMEs.
+ *
+ * Usage:
+ *   codehere report                    # scan current dir, print markdown
+ *   codehere report src/               # scan a subdirectory
+ *   codehere report --out report.md    # write to file
+ *   codehere report --json             # machine-readable JSON
+ *   codehere report --diff HEAD        # scan only changed files
+ *
+ * Output is a markdown document with:
+ *   - Executive summary with score and grade
+ *   - Per-severity finding breakdowns with context
+ *   - Actionable recommendations in plain English
+ *   - A shareable badge and attribution
+ */
+import { writeFileSync } from 'fs';
+import { basename, relative } from 'path';
+import { colors, success, error, newline, info } from '../../../ui.js';
+import { scoreFile } from '../../../infrastructure/security/trust-scorer.js';
+import { readFileSync, existsSync, statSync, readdirSync } from 'fs';
+import { join, extname } from 'path';
+import { loadProductContext, adjustRecommendation } from '../../../infrastructure/config/product-context.js';
+// ── File collection (mirrors trust-command) ──────────────────────────────────
+const CODE_EXTENSIONS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+    '.py', '.rb', '.go', '.java', '.cs', '.php',
+    '.sh', '.bash', '.zsh',
+    '.sql', '.html', '.vue', '.svelte',
+]);
+const IGNORE_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.next', 'coverage', '.cache', '.codehere', '.codehere-cache']);
+function collectFiles(target) {
+    const stat = statSync(target);
+    if (stat.isFile())
+        return [target];
+    const files = [];
+    function walk(dir) {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            if (IGNORE_DIRS.has(entry.name))
+                continue;
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(full);
+            }
+            else if (CODE_EXTENSIONS.has(extname(entry.name))) {
+                files.push(full);
+            }
+        }
+    }
+    walk(target);
+    return files;
+}
+// ── Markdown generation ───────────────────────────────────────────────────────
+function gradeEmoji(grade) {
+    return grade === 'A' ? '🟢' : grade === 'B' ? '🟡' : grade === 'C' ? '🟠' : grade === 'D' ? '🔴' : '🚨';
+}
+function severityLabel(severity) {
+    return severity === 'critical' ? '🚨 Critical'
+        : severity === 'high' ? '⚠️  High'
+            : severity === 'medium' ? '🔵 Medium'
+                : '⬇️  Low';
+}
+function badgeUrl(score, grade) {
+    const color = grade === 'A' ? 'brightgreen'
+        : grade === 'B' ? 'green'
+            : grade === 'C' ? 'yellow'
+                : grade === 'D' ? 'orange'
+                    : 'red';
+    return `https://img.shields.io/badge/codehere%20trust-${score}%25%20${grade}-${color}?logo=shield&logoColor=white`;
+}
+function narrativeSummary(report) {
+    const { overallScore, grade, criticalCount, highCount, mediumCount, lowCount, files } = report;
+    if (criticalCount === 0 && highCount === 0) {
+        if (overallScore >= 90) {
+            return `Clean codebase. ${files.length} file${files.length !== 1 ? 's' : ''} scanned, nothing blocking a merge. ` +
+                (mediumCount > 0 ? `${mediumCount} medium-severity pattern${mediumCount !== 1 ? 's' : ''} worth reviewing in a future sprint.` : 'No significant findings.');
+        }
+        return `Solid codebase with some medium/low findings. ${overallScore}/100 — worth a review pass but not blocking.`;
+    }
+    if (criticalCount > 0) {
+        return `${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} found that should be resolved before this merges. ` +
+            `${highCount > 0 ? `Also ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} to address.` : ''}`;
+    }
+    return `No critical issues, but ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} worth addressing before merge.`;
+}
+function recommendationsMarkdown(report) {
+    const { criticalCount, highCount, mediumCount, lowCount, overallScore } = report;
+    const lines = [];
+    if (criticalCount > 0) {
+        lines.push(`1. **Resolve all ${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} before merging.** These represent active security risks (credentials in code, eval injection, SQL without parameterization, etc.). They're usually quick fixes.`);
+    }
+    if (highCount > 0) {
+        lines.push(`${lines.length + 1}. **Address the ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} in this sprint.** Not blocking, but worth fixing while the code is fresh.`);
+    }
+    if (mediumCount > 0) {
+        lines.push(`${lines.length + 1}. **${mediumCount} medium-severity item${mediumCount !== 1 ? 's' : ''} can be queued for a future cleanup pass.** Mostly defensive hygiene — redirect hardening, input validation gaps.`);
+    }
+    if (lowCount > 0) {
+        lines.push(`${lines.length + 1}. **${lowCount} low-severity note${lowCount !== 1 ? 's' : ''} for informational purposes.** These rarely cause issues but keep the score from being perfect.`);
+    }
+    if (lines.length === 0) {
+        lines.push('1. **Nothing blocking.** Keep it up — this is what a healthy codebase looks like.');
+    }
+    return lines.join('\n\n');
+}
+function findingsMarkdown(files, cwd) {
+    const sections = [];
+    for (const severity of ['critical', 'high', 'medium', 'low']) {
+        const allFindings = [];
+        for (const f of files) {
+            for (const finding of f.findings.filter(x => x.severity === severity)) {
+                allFindings.push({ filepath: f.filepath, ...finding });
+            }
+        }
+        if (allFindings.length === 0)
+            continue;
+        sections.push(`### ${severityLabel(severity)}\n`);
+        // Cap per-severity at 10 most impactful findings
+        for (const f of allFindings.slice(0, 10)) {
+            const loc = f.line ? `:${f.line}` : '';
+            const cwe = f.cwe ? ` · ${f.cwe}` : '';
+            const matched = f.matched ? `\n> Matched: \`${f.matched.substring(0, 80)}\`` : '';
+            sections.push(`**${f.category}** · \`${f.filepath}${loc}\`${cwe}  \n> ${f.description}${matched}\n`);
+        }
+        if (allFindings.length > 10) {
+            sections.push(`*... and ${allFindings.length - 10} more ${severity}-severity findings*\n`);
+        }
+    }
+    return sections.length > 0 ? sections.join('\n') : '*No findings.*\n';
+}
+function generateMarkdown(report, target, cwd) {
+    const { overallScore, grade, files, criticalCount, highCount, mediumCount, lowCount, scannedAt } = report;
+    const targetLabel = basename(target) || '.';
+    const dateStr = new Date(scannedAt).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' });
+    const badge = badgeUrl(overallScore, grade);
+    const summary = narrativeSummary(report);
+    const gradeIcon = gradeEmoji(grade);
+    const productCtx = loadProductContext(cwd);
+    const contextLine = productCtx
+        ? `\nProject: **${productCtx.name}** · Risk level: **${productCtx.riskLevel}**${productCtx.productionApp ? ' · Production' : ''}\n`
+        : '';
+    const recommendation = adjustRecommendation(report.recommendation, criticalCount, highCount, overallScore, productCtx);
+    return `# Security Audit Report · ${targetLabel}
+
+${gradeIcon} **Score: ${overallScore}/100 · Grade ${grade}**
+Generated ${dateStr} by [codehere](https://github.com/codehere-dev/codehere)
+${contextLine}
+> ${recommendation}
+
+---
+
+## Summary
+
+| | |
+|---|---|
+| Files scanned | ${files.length} |
+| Critical | ${criticalCount > 0 ? `**${criticalCount}** 🚨` : criticalCount} |
+| High | ${highCount > 0 ? `**${highCount}** ⚠️` : highCount} |
+| Medium | ${mediumCount} |
+| Low | ${lowCount} |
+
+---
+
+## Findings
+
+${findingsMarkdown(files, cwd)}
+
+---
+
+## Recommendations
+
+${recommendationsMarkdown(report)}
+
+---
+
+## Add to your README
+
+\`\`\`markdown
+![codehere trust](${badge})
+\`\`\`
+
+Renders as: ![codehere trust](${badge})
+
+---
+
+*Generated with [codehere](https://github.com/codehere-dev/codehere) — the coding agent that makes you smarter, not just faster.*
+`;
+}
+// ── Command ───────────────────────────────────────────────────────────────────
+// ── Simple (non-technical) output ────────────────────────────────────────────
+function generateSimpleReport(report, target) {
+    const { overallScore, grade, criticalCount, highCount, mediumCount, files } = report;
+    const targetLabel = basename(target) || 'your project';
+    const lines = [];
+    // Plain English headline
+    if (criticalCount > 0) {
+        lines.push(`Your AI assistant found ${criticalCount} serious problem${criticalCount !== 1 ? 's' : ''} in ${targetLabel} that need${criticalCount === 1 ? 's' : ''} fixing before you share this code.`);
+    }
+    else if (highCount > 0) {
+        lines.push(`${targetLabel} looks mostly safe. There ${highCount === 1 ? 'is' : 'are'} ${highCount} thing${highCount !== 1 ? 's' : ''} worth reviewing, but nothing that needs urgent attention.`);
+    }
+    else if (overallScore >= 90) {
+        lines.push(`${targetLabel} is clean. Your AI assistant found nothing concerning. You're good to go.`);
+    }
+    else {
+        lines.push(`${targetLabel} is in reasonable shape. A few minor things to be aware of, but nothing blocking.`);
+    }
+    lines.push('');
+    // Score in human terms
+    const gradeMeaning = grade === 'A' ? 'Excellent'
+        : grade === 'B' ? 'Good'
+            : grade === 'C' ? 'Fair — some issues to address'
+                : grade === 'D' ? 'Needs work'
+                    : 'Urgent attention needed';
+    lines.push(`Security score: ${overallScore}/100 (${gradeMeaning})`);
+    lines.push(`Files checked: ${files.length}`);
+    lines.push('');
+    // What was found, in plain terms
+    if (criticalCount > 0 || highCount > 0 || mediumCount > 0) {
+        lines.push('What was found:');
+        if (criticalCount > 0) {
+            lines.push(`  • ${criticalCount} serious issue${criticalCount !== 1 ? 's' : ''} — things like exposed passwords, unsafe commands, or code that could be exploited`);
+        }
+        if (highCount > 0) {
+            lines.push(`  • ${highCount} notable issue${highCount !== 1 ? 's' : ''} — worth fixing, but not an emergency`);
+        }
+        if (mediumCount > 0) {
+            lines.push(`  • ${mediumCount} minor thing${mediumCount !== 1 ? 's' : ''} — good to know about, low urgency`);
+        }
+        lines.push('');
+    }
+    // Plain English what to do
+    lines.push('What to do:');
+    if (criticalCount > 0) {
+        lines.push(`  1. Ask your developer to look at the ${criticalCount} serious issue${criticalCount !== 1 ? 's' : ''} listed in the full report.`);
+        lines.push('  2. Do not share or deploy this code until those are resolved.');
+        if (highCount > 0) {
+            lines.push(`  3. The ${highCount} notable issue${highCount !== 1 ? 's' : ''} can be addressed in your next sprint.`);
+        }
+    }
+    else if (highCount > 0) {
+        lines.push(`  1. Ask your developer to review the ${highCount} notable issue${highCount !== 1 ? 's' : ''} when they get a chance.`);
+        lines.push('  2. This code is safe to continue working on in the meantime.');
+    }
+    else {
+        lines.push('  1. Keep going — this code is in good shape.');
+        lines.push('  2. Run this scan again before your next release.');
+    }
+    lines.push('');
+    lines.push('---');
+    lines.push('Generated by codehere — know what your AI agent did before your tech lead asks.');
+    return lines.join('\n');
+}
+export async function executeReportCommand(target, options = {}) {
+    const cwd = process.cwd();
+    const resolved = target ? join(cwd, target) : cwd;
+    if (!existsSync(resolved)) {
+        console.error(error(`Not found: ${resolved}`));
+        process.exit(1);
+    }
+    // Collect and scan
+    const paths = collectFiles(resolved);
+    if (paths.length === 0) {
+        console.log(info('No code files found to scan.'));
+        return;
+    }
+    // Show progress for large codebases
+    if (!options.out && paths.length > 20 && process.stderr.isTTY) {
+        process.stderr.write(colors.dim(`  Scanning ${paths.length} files...`));
+    }
+    const results = paths.map(p => scoreFile(relative(cwd, p), readFileSync(p, 'utf-8')));
+    // Clear progress line
+    if (!options.out && paths.length > 20 && process.stderr.isTTY) {
+        process.stderr.write('\r\x1b[K');
+    }
+    const totalFindings = results.reduce((s, r) => s + r.findings.length, 0);
+    const criticalCount = results.reduce((s, r) => s + r.findings.filter(f => f.severity === 'critical').length, 0);
+    const highCount = results.reduce((s, r) => s + r.findings.filter(f => f.severity === 'high').length, 0);
+    const mediumCount = results.reduce((s, r) => s + r.findings.filter(f => f.severity === 'medium').length, 0);
+    const lowCount = results.reduce((s, r) => s + r.findings.filter(f => f.severity === 'low').length, 0);
+    const overallScore = results.length > 0
+        ? Math.round(results.reduce((s, r) => s + r.score, 0) / results.length)
+        : 100;
+    const grade = overallScore >= 90 ? 'A' : overallScore >= 75 ? 'B' : overallScore >= 60 ? 'C' : overallScore >= 40 ? 'D' : 'F';
+    const recommendation = criticalCount > 0
+        ? `${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} need${criticalCount === 1 ? 's' : ''} attention before this merges.`
+        : highCount > 0
+            ? `Nothing critical, but ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} worth addressing.`
+            : overallScore >= 75
+                ? 'Clean scan. Nothing blocking a merge.'
+                : 'A few things to look at — nothing critical.';
+    const report = {
+        files: results,
+        overallScore,
+        grade,
+        totalFindings,
+        criticalCount,
+        highCount,
+        mediumCount,
+        lowCount,
+        recommendation,
+        scannedAt: new Date().toISOString(),
+    };
+    if (paths.length > 20) {
+        process.stderr.write(' '.repeat(40) + '\r');
+    }
+    // JSON output
+    if (options.json) {
+        const output = JSON.stringify(report, null, 2);
+        if (options.out) {
+            writeFileSync(options.out, output);
+            console.log(success(`Report written to ${options.out}`));
+        }
+        else {
+            console.log(output);
+        }
+        return;
+    }
+    // Simple (non-technical) output
+    if (options.simple) {
+        const simple = generateSimpleReport(report, resolved);
+        if (options.out) {
+            writeFileSync(options.out, simple);
+            console.log(success(`Plain-English report written to ${options.out}`));
+        }
+        else {
+            process.stdout.write(simple + '\n');
+        }
+        return;
+    }
+    // Markdown output
+    const markdown = generateMarkdown(report, resolved, cwd);
+    if (options.out) {
+        writeFileSync(options.out, markdown);
+        newline();
+        console.log(success(`Report written to ${options.out}`));
+        console.log(colors.dim(`  ${paths.length} files · score ${overallScore}/100 · grade ${grade}`));
+        if (criticalCount > 0) {
+            console.log(colors.red(`  ${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} — check the report`));
+        }
+        newline();
+        console.log(colors.dim('  Share it: paste it in your PR, add the badge to your README.'));
+        newline();
+    }
+    else {
+        // Print to stdout (can be piped to file)
+        process.stdout.write(markdown);
+    }
+}
+//# sourceMappingURL=report-command.js.map

package/dist/presentation/cli/commands/run-command.js

@@ -57,7 +57,7 @@ export async function executeRunCommand(goal, options) {
             // Show advisory info
             if (riskTier === 't3') {
                 // T3 - High risk warning
-                console.log(warning('⚠️  High-risk operation detected (RiskTier T3)'));
+                console.log(warning('⚠️  High-risk changes ahead — review carefully before committing'));
                 if (files.length > 0) {
                     console.log(colors.dim(`   Files: ${files.join(', ')}`));
                 }
@@ -65,7 +65,7 @@ export async function executeRunCommand(goal, options) {
                 newline();
             }
             else if (riskTier === 't2') {
-                console.log(warning(`Risk tier: T2 - Review changes carefully before applying.`));
+                console.log(warning('Double-check these changes before applying — config files involved.'));
                 newline();
             }
             if (environment !== 'local') {
@@ -122,7 +122,7 @@ export async function executeRunCommand(goal, options) {
             if (result.execution) {
                 sectionHeader('Execution Results');
                 if (result.execution.overallSuccess) {
-                    console.log(success('✓ Execution completed successfully'));
+                    console.log(success('✓ Done'));
                 }
                 else {
                     console.log(error('✗ Execution failed'));

package/dist/presentation/cli/commands/scan-tool-command.js

@@ -0,0 +1,65 @@
+/**
+ * CLI Command: scan-tool
+ *
+ * Reads a Claude Code PreToolUse hook event from stdin (JSON),
+ * runs Layer 0 security scan, and outputs a block/allow decision.
+ *
+ * This is the actual binary that Claude Code's hook system invokes.
+ * It must be fast (<100ms) and never crash — any failure falls through to allow.
+ *
+ * Usage (by hook system, not user):
+ *   echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' | codehere scan-tool
+ */
+import { processHookEvent } from '../../../infrastructure/hooks/claude-sdk-hook.js';
+export async function executeScanToolCommand(options) {
+    // Read all stdin
+    let raw = '';
+    try {
+        for await (const chunk of process.stdin) {
+            raw += chunk;
+        }
+    }
+    catch {
+        // If stdin read fails, allow the tool call
+        process.exit(0);
+    }
+    if (!raw.trim()) {
+        process.exit(0);
+    }
+    // Parse event JSON
+    let event;
+    try {
+        event = JSON.parse(raw);
+    }
+    catch {
+        // Malformed JSON — allow by default (fail open for dev experience)
+        if (options.debug) {
+            process.stderr.write('[codehere] Warning: could not parse hook event JSON\n');
+        }
+        process.exit(0);
+    }
+    try {
+        const decision = processHookEvent(event);
+        if (options.logOnly) {
+            // Log-only mode: never block, but log everything
+            if (options.debug && decision) {
+                process.stderr.write(`[codehere] Would block: ${decision.reason}\n`);
+            }
+            process.exit(0);
+        }
+        if (decision?.decision === 'block') {
+            // Output block decision as JSON (Claude Code hook contract)
+            process.stdout.write(JSON.stringify(decision) + '\n');
+            // Also write to stderr for user visibility
+            process.stderr.write(`\n${decision.reason}\n`);
+            process.exit(2); // non-zero exit = Claude Code treats as block signal
+        }
+        // Allow — exit 0 with no output
+        process.exit(0);
+    }
+    catch {
+        // Any scan failure: fail open (allow), never break developer workflow
+        process.exit(0);
+    }
+}
+//# sourceMappingURL=scan-tool-command.js.map

package/dist/presentation/cli/commands/setup-command.js

@@ -6,16 +6,24 @@
 import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { getConfigManager } from '../../../infrastructure/config/config-manager.js';
-import { colors, separator, newline, sectionHeader, success, error, warning, info, createBanner, createWelcomeMessage, } from '../../../ui.js';
+import { colors, separator, newline, sectionHeader, success, error, warning, info, } from '../../../ui.js';
 import { executionTracer } from '../../../infrastructure/observability/execution-tracer.js';
 import { findCodebaseRoot } from '../../../domain/services/codebase-detector.js';
 /**
- * Check if API key is configured
+ * Check if any API key is configured
  */
 function checkAPIKey() {
-    const apiKey = process.env.COHERE_API_KEY;
-    if (apiKey && apiKey.trim() && !apiKey.includes('your_key_here') && apiKey.length > 10) {
-        return { configured: true, key: apiKey };
+    const providers = [
+        { env: 'ANTHROPIC_API_KEY', name: 'Anthropic' },
+        { env: 'OPENAI_API_KEY', name: 'OpenAI' },
+        { env: 'COHERE_API_KEY', name: 'Cohere' },
+        { env: 'OPENROUTER_API_KEY', name: 'OpenRouter' },
+    ];
+    for (const { env, name } of providers) {
+        const key = process.env[env];
+        if (key && key.trim() && !key.includes('your_key_here') && key.length > 10) {
+            return { configured: true, provider: name, key };
+        }
     }
     return { configured: false };
 }
@@ -109,12 +117,10 @@ export async function executeSetupCommand(force = false) {
         console.log();
         console.log(warning('Interactive terminal required.'));
         console.log();
-        console.log('For non-interactive setup, configure environment variables directly:');
-        console.log(colors.dim('  • COHERE_API_KEY=<your-cohere-api-key>'));
-        console.log(colors.dim('  • OPENAI_API_KEY=<your-openai-api-key> (optional)'));
-        console.log(colors.dim('  • CODEHERE_AI_PROVIDER=cohere|openai|local'));
-        console.log();
-        console.log(colors.dim('See: https://docs.codehere.ai/setup'));
+        console.log('Set an API key in your environment:');
+        console.log(colors.cyan('  export ANTHROPIC_API_KEY=sk-ant-...') + colors.dim('  (recommended)'));
+        console.log(colors.cyan('  export OPENAI_API_KEY=sk-...'));
+        console.log(colors.cyan('  export COHERE_API_KEY=...'));
         return;
     }
     // Start execution tracing
@@ -124,39 +130,9 @@ export async function executeSetupCommand(force = false) {
     });
     try {
         const isFirstTime = !isSetupComplete() || force;
-        // Welcome banner for first-time users
-        if (isFirstTime) {
-            newline();
-            console.log(createWelcomeMessage());
-            newline();
-            console.log(createBanner('Welcome to Codehere', 'Your AI-powered coding assistant'));
-            newline();
-            // Feature overview for first-time users
-            console.log(colors.bold('What Codehere Can Do:'));
-            console.log(colors.dim('  • ') + colors.cyan('Ask questions') + colors.dim(' about your codebase'));
-            console.log(colors.dim('  • ') + colors.cyan('Edit code') + colors.dim(' with natural language instructions'));
-            console.log(colors.dim('  • ') + colors.cyan('Explain code') + colors.dim(' files and functions'));
-            console.log(colors.dim('  • ') + colors.cyan('Plan complex tasks') + colors.dim(' with multi-step workflows'));
-            console.log(colors.dim('  • ') + colors.cyan('Multi-agent orchestration') + colors.dim(' for advanced tasks'));
-            newline();
-            console.log(colors.bold('Quick Start Guide:'));
-            console.log(colors.dim('  1. ') + colors.cyan('codehere "explain this function"') + colors.dim(' - Ask questions'));
-            console.log(colors.dim('  2. ') + colors.cyan('codehere "add error handling to auth.ts"') + colors.dim(' - Edit code'));
-            console.log(colors.dim('  3. ') + colors.cyan('codehere plan "refactor authentication"') + colors.dim(' - Plan tasks'));
-            newline();
-            console.log(separator('═', 80));
-            console.log(colors.bold('Setup Wizard'));
-            console.log(separator('═', 80));
-            newline();
-        }
-        else {
-            // Regular setup header for reconfigure
-            newline();
-            console.log(separator('═', 80));
-            console.log(colors.bold('Codehere - Setup Wizard'));
-            console.log(separator('═', 80));
-            newline();
-        }
+        newline();
+        console.log(colors.bold('Setup'));
+        newline();
         // Check if already set up
         if (!force && isSetupComplete()) {
             console.log(info('Setup has already been completed.'));
@@ -175,19 +151,17 @@ export async function executeSetupCommand(force = false) {
         sectionHeader('Step 1: API Key Configuration');
         const apiKeyCheck = checkAPIKey();
         if (apiKeyCheck.configured) {
-            console.log(success(`API Key: Found and configured`));
+            console.log(success(`API Key: ${apiKeyCheck.provider} key found`));
             console.log(colors.dim(`  Key preview: ${apiKeyCheck.key?.substring(0, 8)}...${apiKeyCheck.key?.substring(apiKeyCheck.key.length - 4)}`));
             result.apiKeyConfigured = true;
         }
         else {
             console.log(warning('API Key: Not configured'));
             newline();
-            console.log(colors.bold('To configure your API key:'));
-            console.log(colors.dim(`  1. Get your API key from: ${colors.cyan('https://dashboard.cohere.com/api-keys')}`));
-            console.log(colors.dim(`  2. Create a .env file in your project root:`));
-            console.log(colors.cyan('     echo "COHERE_API_KEY=your_key_here" > .env'));
-            console.log(colors.dim(`  3. Or export it in your shell:`));
-            console.log(colors.cyan('     export COHERE_API_KEY=your_key_here'));
+            console.log(colors.bold('Set one of these environment variables:'));
+            console.log(colors.cyan('  export ANTHROPIC_API_KEY=sk-ant-...') + colors.dim('  (recommended)'));
+            console.log(colors.cyan('  export OPENAI_API_KEY=sk-...'));
+            console.log(colors.cyan('  export COHERE_API_KEY=...'));
             newline();
         }
         newline();
@@ -199,9 +173,9 @@ export async function executeSetupCommand(force = false) {
             result.modelDetected = model;
         }
         else {
-            console.log(info('Model: Using default (Command R+)'));
-            console.log(colors.dim('  Run model evaluation to set preferred model.'));
-            result.modelDetected = 'Command R+ (default)';
+            console.log(info('Model: Using default (Claude Sonnet)'));
+            console.log(colors.dim('  Configurable via .codehere/providers.json'));
+            result.modelDetected = 'Claude Sonnet (default)';
         }
         newline();
         // Step 3: Codebase Detection
@@ -243,35 +217,14 @@ export async function executeSetupCommand(force = false) {
             // Save configuration
             configManager.saveConfig();
             result.configPath = configManager.getConfigPath();
-            console.log(separator('═', 80));
-            console.log(success('Setup Complete!'));
-            console.log(separator('═', 80));
             newline();
-            console.log(colors.bold('Configuration Saved:'));
-            console.log(colors.dim(`  ${result.configPath}`));
+            console.log(success('Done.'));
+            newline();
+            console.log(colors.bold('Next steps:'));
+            console.log(colors.dim(`  1. ${colors.cyan('codehere index')}    Build search index`));
+            console.log(colors.dim(`  2. ${colors.cyan('codehere trust .')}  Scan for vulnerabilities`));
+            console.log(colors.dim(`  3. ${colors.cyan('codehere')}          Launch interactive session`));
             newline();
-            // Enhanced next steps with feature discovery
-            if (isFirstTime) {
-                console.log(colors.bold('🎉 Setup Complete! Next Steps:'));
-                console.log(colors.dim(`  1. Index your codebase: ${colors.cyan('codehere index')}`));
-                console.log(colors.dim(`  2. Try asking a question: ${colors.cyan('codehere "explain this function"')}`));
-                console.log(colors.dim(`  3. Get help: ${colors.cyan('codehere --help')}`));
-                newline();
-                console.log(colors.bold('💡 Pro Tip:'));
-                console.log(colors.dim('  After you\'ve tried the basics, discover advanced features:'));
-                console.log(colors.dim(`    • Multi-agent orchestration: ${colors.cyan('codehere orchestrate')}`));
-                console.log(colors.dim(`    • ReAct reasoning: ${colors.cyan('codehere react')}`));
-                console.log(colors.dim(`    • Configuration: ${colors.cyan('codehere config')}`));
-                newline();
-            }
-            else {
-                console.log(colors.bold('Next Steps:'));
-                console.log(colors.dim(`  1. Index your codebase: ${colors.cyan('codehere index')}`));
-                console.log(colors.dim(`  2. Try asking a question: ${colors.cyan('codehere "explain this function"')}`));
-                console.log(colors.dim(`  3. Get help: ${colors.cyan('codehere --help')}`));
-                console.log(colors.dim(`  4. Configure preferences: ${colors.cyan('codehere config')}`));
-                newline();
-            }
             saveSetupConfig(result);
             // Track onboarding completion for first-time users
             if (isFirstTime) {