codehere 0.1.1 → 0.2.2

package/dist/infrastructure/context/conversation-context.js

@@ -1,101 +1,16 @@
 /**
  * Conversation Context Manager
  * Manages conversation history and context for session-aware interactions
- * Supports persistence for session continuity
  *
  * Phase 1: v0.5.0-alpha.0
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { join } from 'path';
 /**
- * Conversation context manager with persistence
+ * In-memory conversation context manager
  * Stores conversation history per session for reference resolution
- * Supports saving/loading sessions for continuity across CLI invocations
  */
 class ConversationContextManager {
     sessions = new Map();
     maxHistoryPerSession = 50;
-    cacheDir = '.codehere-cache';
-    sessionsDir = 'sessions';
-    /**
-     * Get the sessions directory path
-     */
-    getSessionsPath(cwd = process.cwd()) {
-        return join(cwd, this.cacheDir, this.sessionsDir);
-    }
-    /**
-     * Get the session file path
-     */
-    getSessionFilePath(cwd = process.cwd()) {
-        return join(this.getSessionsPath(cwd), 'last-session.json');
-    }
-    /**
-     * Save session to disk for continuity
-     */
-    saveSession(sessionId, cwd = process.cwd()) {
-        const session = this.sessions.get(sessionId);
-        if (!session || session.turns.length === 0) {
-            return false;
-        }
-        try {
-            const sessionsPath = this.getSessionsPath(cwd);
-            if (!existsSync(sessionsPath)) {
-                mkdirSync(sessionsPath, { recursive: true });
-            }
-            const filePath = this.getSessionFilePath(cwd);
-            writeFileSync(filePath, JSON.stringify(session, null, 2));
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
-    /**
-     * Load previous session from disk
-     */
-    loadPreviousSession(cwd = process.cwd()) {
-        try {
-            const filePath = this.getSessionFilePath(cwd);
-            if (!existsSync(filePath)) {
-                return null;
-            }
-            const data = readFileSync(filePath, 'utf-8');
-            const session = JSON.parse(data);
-            // Validate session structure
-            if (!session.sessionId || !Array.isArray(session.turns)) {
-                return null;
-            }
-            // Check if session is too old (24 hours)
-            const age = Date.now() - session.lastUpdated;
-            if (age > 24 * 60 * 60 * 1000) {
-                return null;
-            }
-            // Restore session to memory
-            this.sessions.set(session.sessionId, session);
-            return session;
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Get last session summary for display
-     */
-    getLastSessionSummary(cwd = process.cwd()) {
-        const session = this.loadPreviousSession(cwd);
-        if (!session || session.turns.length === 0) {
-            return null;
-        }
-        const lastTurn = session.turns[session.turns.length - 1];
-        const lastTime = typeof lastTurn.timestamp === 'string'
-            ? new Date(lastTurn.timestamp).toLocaleString()
-            : new Date(lastTurn.timestamp).toLocaleString();
-        return {
-            turnCount: session.turns.length,
-            lastQuery: lastTurn.query,
-            lastTime,
-        };
-    }
     /**
      * Get conversation history for a session
      */

package/dist/infrastructure/cost/cost-router.js

@@ -0,0 +1,104 @@
+/**
+ * Cost Router
+ *
+ * Given a trust score and task complexity, recommends the cheapest model
+ * that's safe to use. The 42x cost difference between Haiku and Opus means
+ * routing decisions have real financial impact at scale.
+ *
+ * Model tiers (approximate $/M output tokens, 2026):
+ *   fast tier    (e.g. claude-haiku-4-5)    $1.25    — cheap, good for simple tasks
+ *   balanced tier (e.g. claude-sonnet-4-6)  $15.00   — good for most tasks
+ *   max tier     (e.g. claude-opus-4-6)     $75.00   — strongest, use sparingly
+ *
+ * Routing logic:
+ *   trust >= 90, simple task  → fast tier      (60x cheaper than max tier)
+ *   trust >= 75, any task     → balanced tier  (5x cheaper than max tier)
+ *   trust < 75, or critical   → balanced tier with human review flag
+ *   critical findings present → block before reaching model
+ */
+const MODEL_COSTS = {
+    haiku: 1.25,
+    sonnet: 15.0,
+    opus: 75.0,
+};
+const MODEL_IDS = {
+    haiku: 'claude-haiku-4-5-20251001',
+    sonnet: 'claude-sonnet-4-6',
+    opus: 'claude-opus-4-6',
+};
+const TIER_LABELS = {
+    haiku: 'fast tier',
+    sonnet: 'balanced tier',
+    opus: 'max tier',
+};
+function savingsLabel(chosen) {
+    if (chosen === 'opus')
+        return 'max tier (baseline)';
+    const ratio = MODEL_COSTS.opus / MODEL_COSTS[chosen];
+    return `${TIER_LABELS[chosen]} · ${Math.round(ratio)}x cheaper than max tier`;
+}
+/**
+ * Recommend the optimal model for a given trust score and task complexity.
+ */
+export function recommendModel(trustScore, complexity = 'standard', criticalFindings = 0) {
+    // Critical findings → require human review regardless of model
+    if (criticalFindings > 0) {
+        return {
+            model: 'sonnet',
+            modelId: MODEL_IDS.sonnet,
+            reason: `${criticalFindings} critical finding${criticalFindings !== 1 ? 's' : ''} — human review required before applying any edit`,
+            costPer1MTokens: MODEL_COSTS.sonnet,
+            savingsVsOpus: savingsLabel('sonnet'),
+            humanReview: true,
+        };
+    }
+    // High-trust simple tasks → Haiku
+    if (trustScore >= 90 && complexity === 'simple') {
+        return {
+            model: 'haiku',
+            modelId: MODEL_IDS.haiku,
+            reason: `Trust ${trustScore}/100 · simple task — safe for fastest, cheapest model`,
+            costPer1MTokens: MODEL_COSTS.haiku,
+            savingsVsOpus: savingsLabel('haiku'),
+            humanReview: false,
+        };
+    }
+    // Good trust, standard task → Sonnet
+    if (trustScore >= 75) {
+        return {
+            model: 'sonnet',
+            modelId: MODEL_IDS.sonnet,
+            reason: `Trust ${trustScore}/100 · ${complexity} task — Sonnet is the right balance`,
+            costPer1MTokens: MODEL_COSTS.sonnet,
+            savingsVsOpus: savingsLabel('sonnet'),
+            humanReview: false,
+        };
+    }
+    // Low trust → Sonnet with human review
+    return {
+        model: 'sonnet',
+        modelId: MODEL_IDS.sonnet,
+        reason: `Trust ${trustScore}/100 — lower confidence; recommend reviewing the output`,
+        costPer1MTokens: MODEL_COSTS.sonnet,
+        savingsVsOpus: savingsLabel('sonnet'),
+        humanReview: true,
+    };
+}
+/**
+ * Estimate monthly savings from routing decisions.
+ * @param avgTokensPerTask Average output tokens per AI task
+ * @param tasksPerMonth Monthly task volume
+ * @param distribution Fraction of tasks at each tier
+ */
+export function estimateMonthlySavings(avgTokensPerTask = 2000, tasksPerMonth = 500, distribution = { haiku: 0.4, sonnet: 0.55, opus: 0.05 }) {
+    const tokensMillion = avgTokensPerTask / 1_000_000;
+    let routedCost = 0;
+    for (const [tier, fraction] of Object.entries(distribution)) {
+        routedCost += fraction * tasksPerMonth * tokensMillion * MODEL_COSTS[tier];
+    }
+    const opusCost = tasksPerMonth * tokensMillion * MODEL_COSTS.opus;
+    const saving = opusCost - routedCost;
+    const savingPct = (saving / opusCost) * 100;
+    return { routedCost, opusCost, saving, savingPct };
+}
+//# sourceMappingURL=cost-router.js.map

package/dist/infrastructure/cost/cost-tracker.js

@@ -13,7 +13,6 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import initSqlJs from 'sql.js';
-import { getConfigManager } from '../config/config-manager.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Cohere pricing (as of 2024, update as needed)
@@ -48,8 +47,8 @@ export class CostTracker {
     // Default budget limit when no override is provided
     static DEFAULT_BUDGET_LIMIT = 2.0;
     constructor(budgetLimit, alertThreshold = 0.8) {
-        const config = getConfigManager();
-        const dataDir = config.getDataDir();
+        const agentDir = join(__dirname, '../../..');
+        const dataDir = join(agentDir, 'data');
         if (!existsSync(dataDir)) {
             mkdirSync(dataDir, { recursive: true });
         }

package/dist/infrastructure/governance/policy-as-code.js

@@ -85,7 +85,8 @@ export class PolicyAsCode {
         for (const condition of rule.conditions) {
             const conditionResult = this.evaluateCondition(condition, context);
             // Debug logging
-            console.log(`[PolicyAsCode] Evaluating condition: ${condition.type} ${condition.operator} ${condition.value}, actual: ${conditionResult.actual}, condition met: ${conditionResult.passed}`);
+            if (process.env.CODEHERE_DEBUG === '1')
+                console.log(`[PolicyAsCode] Evaluating condition: ${condition.type} ${condition.operator} ${condition.value}, actual: ${conditionResult.actual}, condition met: ${conditionResult.passed}`);
             // CRITICAL FIX: Policy conditions are "blocking conditions"
             // If condition is met (passed = true), it means we SHOULD block → policy FAILS
             // If condition is NOT met (passed = false), it means we should NOT block → policy PASSES

package/dist/infrastructure/hooks/claude-sdk-hook.js

@@ -0,0 +1,253 @@
+/**
+ * Claude Agent SDK Hook Handler
+ *
+ * Intercepts every Claude Code tool call via PreToolUse/PostToolUse hooks.
+ * Runs Layer 0 security scan (local, no API, <50ms) before any tool executes.
+ *
+ * Claude Code hook contract:
+ * - stdin:  JSON event { session_id, hook_event_name, tool_name, tool_input }
+ * - stdout: optional JSON { decision: 'block'|'approve', reason?: string, suppressOutput?: boolean }
+ * - stderr: human-readable messages shown to user
+ * - exit 0: allow (default)
+ * - exit non-0: block with stderr shown to user
+ *
+ * Docs: https://docs.anthropic.com/en/docs/claude-code/hooks
+ */
+import { appendFileSync, existsSync, mkdirSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const PATTERNS = [
+    // Prompt Injection
+    { regex: /ignore\s+(previous|prior|above|all|your)\s+(instructions?|rules?|prompts?|guidelines?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to override system instructions' },
+    { regex: /disregard\s+(previous|prior|all|your)\s+(instructions?|rules?|prompts?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Disregard instruction override' },
+    { regex: /forget\s+(everything|all|previous|your)\s*(instructions?|rules?|context)?/i, severity: 'critical', category: 'Prompt Injection', description: 'Context clearing attempt' },
+    { regex: /you\s+are\s+now\s+(a|an|my)|new\s+role\s*:|act\s+as\s+(a|an|if)/i, severity: 'critical', category: 'Prompt Injection', description: 'Role hijacking attempt' },
+    { regex: /system\s*prompt|<\/?system>|(?<!['"\\])<\/?instruction>/i, severity: 'critical', category: 'Prompt Injection', description: 'System prompt injection' },
+    { regex: /\bdo\s+not\s+(follow|obey|listen|comply)\b/i, severity: 'critical', category: 'Prompt Injection', description: 'Instruction override attempt' },
+    { regex: /jailbreak|DAN\s+mode|developer\s+mode\s+enabled/i, severity: 'critical', category: 'Prompt Injection', description: 'Jailbreak attempt' },
+    { regex: /bypass\s+(safety|restrictions?|filters?|guidelines?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Safety bypass attempt' },
+    { regex: /\[INST\]|\[\/INST\]|###\s*human:|###\s*assistant:/i, severity: 'high', category: 'Prompt Injection', description: 'Prompt template injection' },
+    { regex: /override\s+(safety|security|policy|restrictions?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Policy override attempt' },
+    // Credential Theft
+    { regex: /cat\s+~?\/?(\.env|\.secrets?|credentials?|\.aws\/credentials)/i, severity: 'critical', category: 'Credential Theft', description: 'Reads credential files' },
+    { regex: /echo\s+\$\s*(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)/i, severity: 'critical', category: 'Credential Theft', description: 'Exfiltrates env secrets' },
+    { regex: /printenv|env\s*\|\s*(grep|curl|wget|nc)\b/i, severity: 'high', category: 'Credential Theft', description: 'Environment variable exfiltration' },
+    { regex: /curl.*\$(API_KEY|TOKEN|SECRET|PASSWORD)/i, severity: 'critical', category: 'Credential Theft', description: 'API key exfiltration via curl' },
+    { regex: /ssh-keygen|cat\s+~\/.ssh\/(id_rsa|id_ed25519|authorized_keys)/i, severity: 'high', category: 'Credential Theft', description: 'SSH key access' },
+    { regex: /keychain|security\s+find-generic-password/i, severity: 'high', category: 'Credential Theft', description: 'macOS keychain access attempt' },
+    { regex: /OPENAI_API_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN/i, severity: 'high', category: 'Credential Theft', description: 'Known API key reference' },
+    { regex: /\bsecret_key\b|\bapi_secret\b|\bauth_token\b/i, severity: 'medium', category: 'Credential Theft', description: 'Secret key reference' },
+    { regex: /curl.*webhook.*\$\w+|wget.*\$\w+.*credentials/i, severity: 'critical', category: 'Credential Theft', description: 'Credential webhook exfiltration' },
+    { regex: /\/proc\/\d+\/environ|\/etc\/shadow/i, severity: 'critical', category: 'Credential Theft', description: 'System credential file access' },
+    // Destructive Operations
+    { regex: /rm\s+-rf?\s+(\/|~|\.\.|\*|\/home|\/etc|\/var|\/usr)/i, severity: 'critical', category: 'Destructive', description: 'Recursive deletion of system/home directories' },
+    { regex: /delete\s+all\s+files|wipe\s+(disk|drive|everything)|format\s+[a-z]:/i, severity: 'critical', category: 'Destructive', description: 'Mass file deletion' },
+    { regex: />\s*\/dev\/(sda|hda|vda|nvme)|dd\s+if=.*of=\/dev/i, severity: 'critical', category: 'Destructive', description: 'Raw disk write attempt' },
+    { regex: /DROP\s+TABLE|DROP\s+DATABASE|TRUNCATE\s+TABLE/i, severity: 'critical', category: 'Destructive', description: 'Database destruction' },
+    { regex: /git\s+(push\s+--force|reset\s+--hard)\s+origin/i, severity: 'high', category: 'Destructive', description: 'Force push or hard reset to remote' },
+    { regex: /shutdown\s+-[hr]|reboot\s+--force|init\s+0/i, severity: 'high', category: 'Destructive', description: 'System shutdown/reboot' },
+    { regex: /pkill\s+-9\s+(node|python|ruby|java)\b/i, severity: 'medium', category: 'Destructive', description: 'Process mass termination' },
+    { regex: /crontab\s+-r|at\s+now.*rm|systemctl\s+disable\s+--now/i, severity: 'high', category: 'Destructive', description: 'Scheduled destruction' },
+    // Code/Command Injection
+    // NOTE: patterns match execution intent, not grep/search of these strings.
+    // A command starting with "grep", "rg", "ag", or "find" is a search, not execution —
+    // those are pre-filtered in buildScanPayload before patterns run.
+    { regex: /curl\s+\S+\s*\|\s*(bash|sh|python|ruby|perl|node)\b/i, severity: 'critical', category: 'Code Injection', description: 'Remote script piped directly to shell' },
+    { regex: /wget\s+(-qO-\s+)?https?:\/\/\S+\s*\|\s*(bash|sh)/i, severity: 'critical', category: 'Code Injection', description: 'Remote code execution via wget' },
+    { regex: /node\s+-e\s+["'].*eval\s*\(|node\s+-e\s+["'].*require\s*\(/i, severity: 'critical', category: 'Code Injection', description: 'Inline node eval execution' },
+    { regex: /eval\s*\(.*process\.env\.|eval\s*\(.*\$_(GET|POST|REQUEST)/i, severity: 'critical', category: 'Code Injection', description: 'eval() with external or env input' },
+    { regex: /exec\s*\(\s*['"]\s*system/i, severity: 'critical', category: 'Code Injection', description: 'System shell from code' },
+    { regex: /python\s+-c\s+["']import\s+os;os\.system/i, severity: 'high', category: 'Code Injection', description: 'Python shell injection' },
+    { regex: /nc\s+-[eln]+\s+\d{1,3}\.\d{1,3}|bash\s+-i\s+>&\s*\/dev\/tcp/i, severity: 'critical', category: 'Code Injection', description: 'Reverse shell attempt' },
+    { regex: /\bbase64\b.*\|.*(bash|sh)\b|\bbase64\b.*exec/i, severity: 'critical', category: 'Code Injection', description: 'Base64-encoded code execution' },
+    { regex: /\$\(curl|subprocess\.run\(['"]curl/i, severity: 'high', category: 'Code Injection', description: 'Command substitution with curl' },
+    // Supply Chain
+    { regex: /npm\s+install\s+[a-z0-9-]+[0-9]{4,}|pip\s+install\s+\w+\d{6,}/i, severity: 'high', category: 'Supply Chain', description: 'Suspicious package version pattern' },
+    { regex: /npm\s+install\s+--save\s+[a-z]{2}\.[a-z]{2}\.[a-z]{2}/i, severity: 'high', category: 'Supply Chain', description: 'Typosquatting package pattern' },
+    { regex: /preinstall|postinstall|prepare/i, severity: 'medium', category: 'Supply Chain', description: 'Lifecycle script reference' },
+    { regex: /registry\.npmjs\.org\/[^/]+\/-\/[^/]+\.tgz.*;\s*bash/i, severity: 'critical', category: 'Supply Chain', description: 'Direct npm tarball execution' },
+    // OWASP / Security Misconfig
+    { regex: /Access-Control-Allow-Origin:\s*\*/i, severity: 'medium', category: 'OWASP', description: 'Wildcard CORS header' },
+    { regex: /verify\s*=\s*False|ssl_verify\s*=\s*False|checkCertificate\s*=\s*false/i, severity: 'high', category: 'OWASP', description: 'SSL certificate verification disabled' },
+    { regex: /password\s*=\s*["'][^"']{0,16}["']|secret\s*=\s*["'][^"']{0,16}["']/i, severity: 'medium', category: 'OWASP', description: 'Hardcoded credential' },
+    { regex: /eval\s*\([^)]*user|innerHTML\s*=\s*[^;]*user|document\.write\s*\([^)]*user/i, severity: 'high', category: 'OWASP', description: 'Potential XSS via user input' },
+    { regex: /SELECT\s+\*?\s+FROM\s+\w+\s+WHERE.*['"]\s*\+|query\s*\+\s*user/i, severity: 'critical', category: 'OWASP', description: 'SQL injection pattern' },
+    // Data Exfiltration
+    { regex: /curl\s+.*-d\s+@\/|curl\s+.*--data-binary\s+@\//i, severity: 'high', category: 'Data Exfiltration', description: 'File upload via curl' },
+    { regex: /scp\s+.*@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/i, severity: 'high', category: 'Data Exfiltration', description: 'SCP to external IP' },
+    { regex: /rclone\s+copy|rsync\s+-av?[rpz]+\s+\/\w+.*@/i, severity: 'medium', category: 'Data Exfiltration', description: 'Mass file sync to remote' },
+];
+// ── Risk scoring ────────────────────────────────────────────────────────────
+const SEVERITY_SCORES = {
+    critical: 40,
+    high: 20,
+    medium: 10,
+    low: 5,
+};
+/**
+ * Scans a text payload against all Layer 0 patterns.
+ * Returns findings and a 0-100 risk score.
+ * Average run time: < 5ms on a modern CPU.
+ */
+export function scanPayload(text) {
+    const findings = [];
+    for (const pattern of PATTERNS) {
+        const match = text.match(pattern.regex);
+        if (match) {
+            findings.push({
+                severity: pattern.severity,
+                category: pattern.category,
+                description: pattern.description,
+                matched: match[0].substring(0, 120), // truncate for audit log
+            });
+        }
+    }
+    return findings;
+}
+export function calculateRiskScore(findings) {
+    let score = 0;
+    for (const f of findings) {
+        score += SEVERITY_SCORES[f.severity] ?? 5;
+    }
+    return Math.min(100, score);
+}
+// ── Audit log ───────────────────────────────────────────────────────────────
+const AUDIT_DIR = join(homedir(), '.codehere', 'audit');
+export const AUDIT_FILE = join(AUDIT_DIR, 'hook-events.jsonl');
+function ensureAuditDir() {
+    if (!existsSync(AUDIT_DIR)) {
+        mkdirSync(AUDIT_DIR, { recursive: true });
+    }
+}
+export function appendAuditLog(entry) {
+    try {
+        ensureAuditDir();
+        appendFileSync(AUDIT_FILE, JSON.stringify(entry) + '\n');
+    }
+    catch {
+        // Audit log failure must not block tool execution
+    }
+}
+// ── Main hook handler ────────────────────────────────────────────────────────
+/**
+ * Process a Claude Code hook event.
+ * Called with the parsed stdin JSON from Claude Code's hook system.
+ *
+ * Returns:
+ * - null: allow the tool call, print nothing
+ * - HookDecision with decision:'block': reject the tool call
+ */
+/**
+ * Build a scan payload that is appropriate for the tool type.
+ *
+ * Bash / NotebookEdit: the command IS the executable — scan everything.
+ *   Exception: commands that start with grep/rg/find/ag are search operations,
+ *   not execution — strip the search term so pattern strings in args don't
+ *   trigger the scanner.
+ *
+ * Write / Edit / MultiEdit: the content is data being written to disk,
+ *   not executed. Only scan the file path (destination) and, for Edit,
+ *   the old_string (what we're matching). Never scan new_string / content
+ *   — that would block writing security documentation, test fixtures, etc.
+ */
+function buildScanPayload(toolName, toolInput) {
+    if (toolName === 'Bash') {
+        const cmd = String(toolInput.command ?? '');
+        // Search commands — only scan the binary name and flags, not the pattern argument.
+        // grep/rg/ag/find searching FOR dangerous strings is not dangerous.
+        if (/^\s*(grep|rg|ag|find|awk|sed)\s/.test(cmd)) {
+            const binary = cmd.match(/^\s*(\S+)/)?.[1] ?? cmd;
+            return JSON.stringify({ command: binary });
+        }
+        return JSON.stringify({ command: cmd });
+    }
+    if (toolName === 'Write') {
+        // Only scan the destination path — content is data, not a command
+        return JSON.stringify({ file_path: toolInput.file_path ?? '' });
+    }
+    if (toolName === 'Edit') {
+        // Scan destination path + old_string (the selector), not new_string (the replacement)
+        return JSON.stringify({
+            file_path: toolInput.file_path ?? '',
+            old_string: toolInput.old_string ?? '',
+        });
+    }
+    if (toolName === 'MultiEdit') {
+        // Scan file paths only
+        const edits = Array.isArray(toolInput.edits) ? toolInput.edits : [];
+        return JSON.stringify({ file_paths: edits.map((e) => e.file_path ?? '') });
+    }
+    // Unknown tool — scan everything
+    return JSON.stringify(toolInput);
+}
+export function processHookEvent(event) {
+    const { hook_event_name, tool_name = 'unknown', tool_input = {}, session_id = 'unknown', } = event;
+    // Only intercept PreToolUse events
+    if (hook_event_name !== 'PreToolUse') {
+        return null;
+    }
+    // Build context-appropriate scan payload (Bash = full, Write/Edit = path only)
+    const payload = buildScanPayload(tool_name, tool_input);
+    // Layer 0 scan — local, no API, ~2ms
+    const findings = scanPayload(payload);
+    const riskScore = calculateRiskScore(findings);
+    const criticalFindings = findings.filter(f => f.severity === 'critical');
+    // Blocking threshold: critical finding OR risk score too high
+    const blocked = criticalFindings.length > 0 || riskScore >= 60;
+    // Build audit entry
+    const auditEntry = {
+        timestamp: new Date().toISOString(),
+        sessionId: session_id,
+        toolName: tool_name,
+        toolInput: payload.substring(0, 500), // truncate long inputs
+        riskScore,
+        blocked,
+        findings: findings.length,
+        criticalFindings: criticalFindings.length,
+    };
+    appendAuditLog(auditEntry);
+    if (!blocked) {
+        return null; // allow
+    }
+    // Build human-readable block reason
+    const topFinding = criticalFindings[0] ?? findings[0];
+    const categoryVoice = {
+        'Prompt Injection': 'Caught a prompt injection attempt',
+        'Credential Theft': 'Stopped — this looks like it\'s trying to access credentials',
+        'Destructive': 'Stopped — this could delete or destroy data',
+        'Code Injection': 'Blocked — this pattern looks like code injection',
+        'Supply Chain': 'Blocked — suspicious package or dependency pattern',
+        'OWASP': 'Blocked — security misconfiguration pattern',
+        'Data Exfiltration': 'Blocked — this looks like it\'s trying to send data out',
+    };
+    const reason = topFinding
+        ? `[codehere] ${categoryVoice[topFinding.category] ?? 'Blocked'} — ${topFinding.description}. (matched: "${topFinding.matched}")`
+        : `[codehere] Blocked — risk score ${riskScore}/100 is too high to allow this through`;
+    return {
+        decision: 'block',
+        reason,
+    };
+}
+// ── Hook configuration generator ────────────────────────────────────────────
+/**
+ * Returns the JSON config block to add to ~/.claude/settings.json
+ * under the "hooks" key.
+ */
+export function generateHookConfig(options = {}) {
+    const command = options.logOnly
+        ? 'codehere scan-tool --log-only'
+        : `codehere scan-tool${options.blockMode === 'all' ? ' --block-all' : ''}`;
+    // Cover every tool that can mutate the filesystem or run code.
+    // NotebookEdit added to catch Jupyter notebook writes.
+    const hook = { type: 'command', command };
+    return {
+        PreToolUse: [
+            { matcher: 'Bash', hooks: [hook] },
+            { matcher: 'Edit', hooks: [hook] },
+            { matcher: 'Write', hooks: [hook] },
+            { matcher: 'MultiEdit', hooks: [hook] },
+            { matcher: 'NotebookEdit', hooks: [hook] },
+        ],
+    };
+}
+//# sourceMappingURL=claude-sdk-hook.js.map

package/dist/infrastructure/hooks/session-analyzer.js

@@ -0,0 +1,111 @@
+/**
+ * Session Analyzer
+ *
+ * Detects multi-agent amplification patterns in the hook audit log.
+ *
+ * When Claude Code spawns sub-agents via the Task tool, each agent makes
+ * additional tool calls. One compromised instruction can amplify into
+ * many downstream tool calls — the "17.2x amplification" risk.
+ *
+ * This analyzer groups audit events by session and detects:
+ *   1. High tool call volume per session (potential amplification)
+ *   2. Sessions with blocked calls (injection attempts)
+ *   3. Sessions with unusual tool mix (e.g., many Bash calls in a row)
+ */
+/**
+ * Group audit entries by session and compute per-session stats.
+ */
+export function analyzeSessions(entries) {
+    const bySession = new Map();
+    for (const entry of entries) {
+        const sid = entry.sessionId || 'unknown';
+        if (!bySession.has(sid))
+            bySession.set(sid, []);
+        bySession.get(sid).push(entry);
+    }
+    const summaries = [];
+    for (const [sessionId, sessionEntries] of bySession) {
+        const sorted = [...sessionEntries].sort((a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime());
+        const first = sorted[0];
+        const last = sorted[sorted.length - 1];
+        const durationMs = new Date(last.timestamp).getTime() - new Date(first.timestamp).getTime();
+        const toolMix = {};
+        let blocked = 0;
+        let critical = 0;
+        for (const e of sorted) {
+            toolMix[e.toolName] = (toolMix[e.toolName] ?? 0) + 1;
+            if (e.blocked)
+                blocked++;
+            if (e.criticalFindings > 0)
+                critical++;
+        }
+        // Risk heuristics:
+        // - >50 calls in one session = possible amplification
+        // - >10 Bash calls = elevated risk
+        // - any blocked calls in a long session = suspicious
+        const bashCount = toolMix['Bash'] ?? 0;
+        const callCount = sorted.length;
+        let risk = 'low';
+        if (blocked > 0 && callCount > 20)
+            risk = 'high';
+        else if (callCount > 50 || (bashCount > 10 && callCount > 20))
+            risk = 'medium';
+        else if (blocked > 0 || callCount > 25)
+            risk = 'medium';
+        summaries.push({
+            sessionId,
+            firstSeen: first.timestamp,
+            lastSeen: last.timestamp,
+            totalCalls: callCount,
+            blockedCalls: blocked,
+            criticalCalls: critical,
+            toolMix,
+            amplificationRisk: risk,
+            durationMs,
+        });
+    }
+    return summaries.sort((a, b) => new Date(b.lastSeen).getTime() - new Date(a.lastSeen).getTime());
+}
+/**
+ * Identify sessions with amplification risk worth flagging.
+ */
+export function detectAmplificationAlerts(sessions) {
+    const alerts = [];
+    for (const session of sessions) {
+        if (session.amplificationRisk === 'low')
+            continue;
+        let message = '';
+        const risk = session.amplificationRisk;
+        if (session.blockedCalls > 0 && session.totalCalls > 20) {
+            message = `${session.totalCalls} tool calls with ${session.blockedCalls} blocked — possible injection in multi-agent chain`;
+        }
+        else if (session.totalCalls > 50) {
+            message = `${session.totalCalls} tool calls in one session — check for amplification`;
+        }
+        else if ((session.toolMix['Bash'] ?? 0) > 10) {
+            message = `${session.toolMix['Bash']} Bash calls in one session — elevated risk`;
+        }
+        else {
+            message = `${session.totalCalls} calls, ${session.blockedCalls} blocked — worth reviewing`;
+        }
+        alerts.push({
+            sessionId: session.sessionId,
+            message,
+            callCount: session.totalCalls,
+            blockedCount: session.blockedCalls,
+            risk: risk === 'high' ? 'high' : 'medium',
+        });
+    }
+    return alerts.slice(0, 5); // top 5 alerts
+}
+/**
+ * Format session duration for display.
+ */
+export function formatDuration(ms) {
+    if (ms < 60_000)
+        return `${Math.round(ms / 1000)}s`;
+    if (ms < 3_600_000)
+        return `${Math.round(ms / 60_000)}m`;
+    return `${Math.round(ms / 3_600_000)}h`;
+}
+//# sourceMappingURL=session-analyzer.js.map