codehere 0.2.1 → 0.3.0-rc.1

package/dist/infrastructure/providers/provider-registry.js

@@ -1,88 +0,0 @@
-/**
- * Provider Layer: ProviderRegistry
- * Central registry for all model providers
- *
- * Phase 4A: Foundation Implementation (No Behavior Change)
- */
-/**
- * Provider Registry
- * Singleton registry for managing model providers
- */
-export class ProviderRegistry {
-    static instance = null;
-    providers = new Map();
-    defaultProviderId;
-    /**
-     * Get singleton instance
-     */
-    static getInstance() {
-        if (!ProviderRegistry.instance) {
-            ProviderRegistry.instance = new ProviderRegistry();
-        }
-        return ProviderRegistry.instance;
-    }
-    /**
-     * Register a provider
-     */
-    register(provider) {
-        this.providers.set(provider.id, provider);
-        // Auto-set as default if this is the first provider
-        if (!this.defaultProviderId) {
-            this.defaultProviderId = provider.id;
-        }
-    }
-    /**
-     * Get provider by ID
-     */
-    get(providerId) {
-        return this.providers.get(providerId);
-    }
-    /**
-     * Get default provider
-     */
-    getDefault() {
-        if (!this.defaultProviderId) {
-            throw new Error('No default provider configured');
-        }
-        const provider = this.get(this.defaultProviderId);
-        if (!provider) {
-            throw new Error(`Default provider '${this.defaultProviderId}' not found`);
-        }
-        return provider;
-    }
-    /**
-     * Set default provider
-     */
-    setDefault(providerId) {
-        if (!this.providers.has(providerId)) {
-            throw new Error(`Provider '${providerId}' not registered`);
-        }
-        this.defaultProviderId = providerId;
-    }
-    /**
-     * Get all registered providers
-     */
-    getAll() {
-        return Array.from(this.providers.values());
-    }
-    /**
-     * Find providers by capability
-     */
-    findByCapability(capability) {
-        return this.getAll().filter(p => p.capabilities[capability]);
-    }
-    /**
-     * Check if provider is registered
-     */
-    has(providerId) {
-        return this.providers.has(providerId);
-    }
-    /**
-     * Clear all providers (mainly for testing)
-     */
-    clear() {
-        this.providers.clear();
-        this.defaultProviderId = undefined;
-    }
-}
-//# sourceMappingURL=provider-registry.js.map

package/dist/infrastructure/safety/pattern-detector.js

@@ -1,133 +0,0 @@
-/**
- * Mistake Detection Loop (P4-A)
- *
- * Detects repeated patterns in hook events and surfaces warnings:
- * - Same category blocked 3+ times → user warning
- * - Same file blocked 3+ times → suggest different approach
- * - AI retrying blocked command with minor variation → escalate
- *
- * v0.3.0
- */
-import { readFileSync, existsSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-import chalk from 'chalk';
-const AUDIT_FILE = join(homedir(), '.codehere', 'audit', 'hook-events.jsonl');
-const THRESHOLD = 3;
-/**
- * Analyze recent audit log for mistake patterns in a session.
- */
-export function detectMistakes(sessionId) {
-    if (!existsSync(AUDIT_FILE))
-        return [];
-    let lines;
-    try {
-        const raw = readFileSync(AUDIT_FILE, 'utf-8').trim();
-        if (!raw)
-            return [];
-        lines = raw.split('\n');
-    }
-    catch {
-        return [];
-    }
-    // Parse blocked events, optionally filtered to a session
-    const blockedEvents = [];
-    for (const line of lines) {
-        try {
-            const entry = JSON.parse(line);
-            if (!entry.blocked)
-                continue;
-            if (sessionId && entry.sessionId !== sessionId)
-                continue;
-            blockedEvents.push(entry);
-        }
-        catch {
-            continue;
-        }
-    }
-    if (blockedEvents.length < THRESHOLD)
-        return [];
-    const patterns = [];
-    // 1. Same category blocked 3+ times
-    const categoryCounts = new Map();
-    for (const event of blockedEvents) {
-        if (event.categories) {
-            for (const cat of event.categories) {
-                categoryCounts.set(cat, (categoryCounts.get(cat) || 0) + 1);
-            }
-        }
-    }
-    for (const [category, count] of categoryCounts) {
-        if (count >= THRESHOLD) {
-            patterns.push({
-                type: 'repeated-category',
-                description: `"${category}" blocked ${count} times`,
-                count,
-                suggestion: `The AI keeps triggering ${category} detections. Consider adding a project rule or using a safer pattern.`,
-            });
-        }
-    }
-    // 2. Same tool+file blocked 3+ times
-    const fileCounts = new Map();
-    for (const event of blockedEvents) {
-        if (event.toolName === 'Write' || event.toolName === 'Edit' || event.toolName === 'MultiEdit') {
-            try {
-                const input = JSON.parse(event.toolInput);
-                const filePath = input.file_path || input.filepath || '';
-                if (filePath) {
-                    fileCounts.set(filePath, (fileCounts.get(filePath) || 0) + 1);
-                }
-            }
-            catch {
-                // toolInput might be truncated
-            }
-        }
-    }
-    for (const [filePath, count] of fileCounts) {
-        if (count >= THRESHOLD) {
-            const shortPath = filePath.split('/').slice(-2).join('/');
-            patterns.push({
-                type: 'repeated-file',
-                description: `Writes to ${shortPath} blocked ${count} times`,
-                count,
-                suggestion: `The AI keeps trying to modify this file in a blocked way. Try a different instruction or approach.`,
-            });
-        }
-    }
-    // 3. Rapid retries (3+ blocked events within 60 seconds)
-    if (blockedEvents.length >= THRESHOLD) {
-        const recent = blockedEvents.slice(-10);
-        let rapidCount = 0;
-        for (let i = 1; i < recent.length; i++) {
-            const prev = new Date(recent[i - 1].timestamp).getTime();
-            const curr = new Date(recent[i].timestamp).getTime();
-            if (curr - prev < 60_000) {
-                rapidCount++;
-            }
-        }
-        if (rapidCount >= THRESHOLD - 1) {
-            patterns.push({
-                type: 'retry-variation',
-                description: `${rapidCount + 1} rapid retries detected`,
-                count: rapidCount + 1,
-                suggestion: `The AI is rapidly retrying blocked commands. It may be stuck in a loop — consider rephrasing your instruction.`,
-            });
-        }
-    }
-    return patterns;
-}
-/**
- * Format mistake patterns for display in CLI.
- */
-export function formatMistakeWarnings(patterns) {
-    if (patterns.length === 0)
-        return '';
-    const lines = [];
-    lines.push(chalk.yellow.bold('Repeated patterns detected:'));
-    for (const p of patterns) {
-        lines.push(chalk.yellow(`  ${p.description}`));
-        lines.push(chalk.dim(`  ${p.suggestion}`));
-    }
-    return lines.join('\n');
-}
-//# sourceMappingURL=pattern-detector.js.map

package/dist/infrastructure/security/ai-sast-scanner.js

@@ -1,290 +0,0 @@
-/**
- * Infrastructure: AI SAST Scanner
- * AI-driven Static Application Security Testing
- * Detects security vulnerabilities in generated code
- *
- * Based on enterprise architecture: AI SAST for security gates
- */
-export class AISASTScanner {
-    aiService;
-    constructor(aiService) {
-        this.aiService = aiService;
-    }
-    /**
-     * Fast security check on instruction text (before expensive operations)
-     * This is a quick heuristic check to reject dangerous instructions early
-     */
-    async scanInstruction(instruction) {
-        // Full pattern-based scan — 50+ patterns across 5 categories
-        // Matches benchmark coverage. Runs locally, no API needed.
-        const instructionPatterns = [
-            // ── PROMPT INJECTION (10 patterns) ────────────────────────
-            { pattern: /ignore\s+(previous|prior|above|all|your)\s+(instructions?|rules?|prompts?|guidelines?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to override system instructions' },
-            { pattern: /disregard\s+(previous|prior|all|your)\s+(instructions?|rules?|prompts?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to disregard system instructions' },
-            { pattern: /forget\s+(everything|all|previous|your)\s*(instructions?|rules?|context)?/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to clear system context' },
-            { pattern: /you\s+are\s+now\s+(a|an|my)|new\s+role|act\s+as\s+(a|an|if)/i, severity: 'critical', category: 'Prompt Injection', description: 'Role hijacking attempt' },
-            { pattern: /system\s*prompt|<\/?system>|<\/?instruction>/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to access or inject system prompt' },
-            { pattern: /\bdo\s+not\s+(follow|obey|listen|comply)\b/i, severity: 'critical', category: 'Prompt Injection', description: 'Instruction override attempt' },
-            { pattern: /override\s+(safety|security|rules|restrictions|guidelines)/i, severity: 'critical', category: 'Prompt Injection', description: 'Safety override attempt' },
-            { pattern: /jailbreak|DAN\s+mode|developer\s+mode|unrestricted\s+mode/i, severity: 'critical', category: 'Prompt Injection', description: 'Known jailbreak technique' },
-            { pattern: /translate.*to.*base64|encode.*instructions|decode.*payload/i, severity: 'high', category: 'Prompt Injection', description: 'Obfuscation-based injection' },
-            { pattern: /pretend\s+(you|there|that)\s*(are|is|was)\s*(no|isn.t|aren.t)/i, severity: 'critical', category: 'Prompt Injection', description: 'Reality manipulation injection' },
-            // ── CREDENTIAL THEFT (10 patterns) ────────────────────────
-            { pattern: /hardcode.*password|store.*password|plaintext.*password/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded credentials' },
-            { pattern: /api[_\s-]?key\s*[:=]\s*['"]/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded API key' },
-            { pattern: /secret[_\s-]?key\s*[:=]\s*['"]/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded secret key' },
-            { pattern: /\bpassword\s*[:=]\s*['"][^'"]{3,}/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded password value' },
-            { pattern: /token\s*[:=]\s*['"][A-Za-z0-9+/=_-]{20,}/i, severity: 'high', category: 'Credential Theft', description: 'Hardcoded token' },
-            { pattern: /print.*env|console\.log.*process\.env|dump.*environment/i, severity: 'high', category: 'Credential Theft', description: 'Environment variable exfiltration' },
-            { pattern: /read.*\.env|cat\s+\.env|show.*credentials/i, severity: 'high', category: 'Credential Theft', description: 'Credential file access' },
-            { pattern: /send.*key.*to|post.*secret.*to|upload.*credentials/i, severity: 'critical', category: 'Credential Theft', description: 'Credential exfiltration' },
-            { pattern: /AWS_SECRET|AZURE_KEY|GCP_KEY|DATABASE_URL.*password/i, severity: 'high', category: 'Credential Theft', description: 'Cloud credential exposure' },
-            { pattern: /ssh[_\s-]?key|private[_\s-]?key.*BEGIN/i, severity: 'critical', category: 'Credential Theft', description: 'Private key exposure' },
-            // ── CODE INJECTION (10 patterns) ──────────────────────────
-            { pattern: /execute.*user.*input|eval.*user|exec.*user/i, severity: 'critical', category: 'Code Injection', description: 'User input execution' },
-            { pattern: /shell.*command|system.*call|process\.exec|child_process/i, severity: 'critical', category: 'Code Injection', description: 'Shell command execution' },
-            { pattern: /sql.*injection|raw.*sql.*query|query.*\+.*user/i, severity: 'high', category: 'Code Injection', description: 'SQL injection vector' },
-            { pattern: /bypass.*security|disable.*security|remove.*validation/i, severity: 'critical', category: 'Code Injection', description: 'Security bypass' },
-            { pattern: /delete\s+all\s+files|rm\s+-rf|remove\s+all|wipe\s+disk/i, severity: 'critical', category: 'Code Injection', description: 'Destructive file operation' },
-            { pattern: /reverse\s+shell|bind\s+shell|nc\s+-e|netcat.*-e/i, severity: 'critical', category: 'Code Injection', description: 'Reverse shell attempt' },
-            { pattern: /download.*execute|curl.*\|\s*sh|wget.*\|\s*bash/i, severity: 'critical', category: 'Code Injection', description: 'Remote code execution' },
-            { pattern: /modify.*hosts|edit.*\/etc\/|change.*resolv\.conf/i, severity: 'critical', category: 'Code Injection', description: 'System file modification' },
-            { pattern: /disable.*firewall|stop.*antivirus|kill.*security/i, severity: 'critical', category: 'Code Injection', description: 'Security software bypass' },
-            { pattern: /crypto.*min(er|ing)|bitcoin.*address|monero.*wallet/i, severity: 'critical', category: 'Code Injection', description: 'Cryptominer injection' },
-            // ── SUPPLY CHAIN (10 patterns) ────────────────────────────
-            { pattern: /install\s+[a-z]+-[a-z]+\d{3,}|npm\s+i\s+[a-z]+-typo/i, severity: 'high', category: 'Supply Chain', description: 'Typosquatting package install' },
-            { pattern: /add.*dependency.*http|require\s*\(\s*['"]https?:/i, severity: 'high', category: 'Supply Chain', description: 'Remote dependency injection' },
-            { pattern: /postinstall.*script|preinstall.*curl|lifecycle.*wget/i, severity: 'critical', category: 'Supply Chain', description: 'Malicious lifecycle script' },
-            { pattern: /replace.*package|swap.*module|inject.*into.*node_modules/i, severity: 'critical', category: 'Supply Chain', description: 'Package replacement attack' },
-            { pattern: /modify.*package\.json.*scripts|add.*postinstall/i, severity: 'high', category: 'Supply Chain', description: 'Build script injection' },
-            { pattern: /git.*clone.*untrusted|clone.*unknown.*repo/i, severity: 'high', category: 'Supply Chain', description: 'Untrusted repository clone' },
-            { pattern: /override.*lockfile|delete.*lock|ignore.*integrity/i, severity: 'high', category: 'Supply Chain', description: 'Lock file tampering' },
-            { pattern: /publish.*malicious|npm\s+publish.*trojan/i, severity: 'critical', category: 'Supply Chain', description: 'Malicious package publish' },
-            { pattern: /dependency\s+confusion|internal.*package.*public/i, severity: 'high', category: 'Supply Chain', description: 'Dependency confusion attack' },
-            { pattern: /add.*webpack.*plugin.*http|loader.*remote.*url/i, severity: 'high', category: 'Supply Chain', description: 'Build tool injection' },
-            // ── OWASP TOP 10 (10 patterns) ────────────────────────────
-            { pattern: /disable.*cors|access-control-allow-origin.*\*/i, severity: 'high', category: 'OWASP', description: 'CORS misconfiguration' },
-            { pattern: /disable.*csrf|skip.*csrf.*check|no.*csrf/i, severity: 'high', category: 'OWASP', description: 'CSRF protection bypass' },
-            { pattern: /no.*authentication|skip.*auth|remove.*auth.*check/i, severity: 'critical', category: 'OWASP', description: 'Authentication bypass' },
-            { pattern: /set.*cookie.*httponly.*false|cookie.*secure.*false/i, severity: 'high', category: 'OWASP', description: 'Insecure cookie configuration' },
-            { pattern: /http:\/\/.*api|unencrypted.*connection|disable.*tls/i, severity: 'high', category: 'OWASP', description: 'Insecure transport' },
-            { pattern: /expose.*stack.*trace|verbose.*error.*production/i, severity: 'high', category: 'OWASP', description: 'Information disclosure' },
-            { pattern: /admin.*route.*public|no.*authorization.*check/i, severity: 'critical', category: 'OWASP', description: 'Broken access control' },
-            { pattern: /deserialize.*untrusted|parse.*user.*json.*eval/i, severity: 'critical', category: 'OWASP', description: 'Insecure deserialization' },
-            { pattern: /log.*password|log.*token|log.*secret|log.*credentials/i, severity: 'high', category: 'OWASP', description: 'Sensitive data in logs' },
-            { pattern: /xml.*external.*entity|xxe|DOCTYPE.*SYSTEM/i, severity: 'critical', category: 'OWASP', description: 'XXE injection' },
-        ];
-        const findings = [];
-        for (const { pattern, severity, category, description } of instructionPatterns) {
-            if (pattern.test(instruction)) {
-                findings.push({
-                    severity,
-                    category,
-                    description,
-                    filepath: 'instruction',
-                    line: 0,
-                    recommendation: `BLOCKED: ${description}. This instruction was rejected by the safety scanner.`,
-                });
-            }
-        }
-        if (findings.length === 0) {
-            return null; // No issues found, allow to proceed
-        }
-        const criticalCount = findings.filter(f => f.severity === 'critical').length;
-        const highCount = findings.filter(f => f.severity === 'high').length;
-        return {
-            findings,
-            totalFindings: findings.length,
-            criticalCount,
-            highCount,
-            mediumCount: 0,
-            lowCount: 0,
-            passed: criticalCount === 0 && highCount === 0,
-        };
-    }
-    /**
-     * Fast pattern-based check for dangerous code patterns
-     */
-    checkDangerousPatterns(code) {
-        const findings = [];
-        const dangerousPatterns = [
-            {
-                pattern: /\beval\s*\(/gi,
-                category: 'Code Injection',
-                description: 'Use of eval() allows arbitrary code execution',
-                severity: 'critical',
-                cwe: 'CWE-95',
-            },
-            {
-                pattern: /\bFunction\s*\(/gi,
-                category: 'Code Injection',
-                description: 'Use of Function() constructor allows arbitrary code execution',
-                severity: 'critical',
-                cwe: 'CWE-95',
-            },
-            {
-                pattern: /\.innerHTML\s*=\s*[^=]/gi,
-                category: 'Cross-Site Scripting',
-                description: 'Direct innerHTML assignment can lead to XSS',
-                severity: 'high',
-                cwe: 'CWE-79',
-            },
-            {
-                pattern: /setTimeout\s*\(\s*[^,)]+\s*\)/gi,
-                category: 'Code Injection',
-                description: 'setTimeout with user input can execute arbitrary code',
-                severity: 'high',
-                cwe: 'CWE-95',
-            },
-            {
-                pattern: /setInterval\s*\(\s*[^,)]+\s*\)/gi,
-                category: 'Code Injection',
-                description: 'setInterval with user input can execute arbitrary code',
-                severity: 'high',
-                cwe: 'CWE-95',
-            },
-        ];
-        dangerousPatterns.forEach(({ pattern, category, description, severity, cwe }) => {
-            const matches = code.matchAll(pattern);
-            for (const match of matches) {
-                const line = code.substring(0, match.index || 0).split('\n').length;
-                findings.push({
-                    severity,
-                    category,
-                    description,
-                    line,
-                    recommendation: `Avoid ${category.toLowerCase()}. Use safer alternatives.`,
-                    cwe,
-                    filepath: '', // Will be set by caller
-                });
-            }
-        });
-        return findings;
-    }
-    /**
-     * Scan code for security vulnerabilities
-     */
-    async scan(filepath, code) {
-        const findings = [];
-        // Fast pattern-based checks first (before expensive AI analysis)
-        const patternFindings = this.checkDangerousPatterns(code);
-        // Set filepath for pattern findings
-        patternFindings.forEach(f => { f.filepath = filepath; });
-        findings.push(...patternFindings);
-        // If critical patterns found, return early (don't need AI analysis)
-        const criticalPatternFindings = patternFindings.filter(f => f.severity === 'critical');
-        if (criticalPatternFindings.length > 0) {
-            return {
-                findings,
-                totalFindings: findings.length,
-                criticalCount: criticalPatternFindings.length,
-                highCount: findings.filter(f => f.severity === 'high').length,
-                mediumCount: findings.filter(f => f.severity === 'medium').length,
-                lowCount: findings.filter(f => f.severity === 'low').length,
-                passed: false,
-            };
-        }
-        // AI-based analysis (only if no critical patterns found)
-        const aiFindings = await this.analyzeWithAI(filepath, code);
-        findings.push(...aiFindings);
-        // Count by severity
-        const criticalCount = findings.filter(f => f.severity === 'critical').length;
-        const highCount = findings.filter(f => f.severity === 'high').length;
-        const mediumCount = findings.filter(f => f.severity === 'medium').length;
-        const lowCount = findings.filter(f => f.severity === 'low').length;
-        // Pass if no critical or high severity findings
-        const passed = criticalCount === 0 && highCount === 0;
-        return {
-            findings,
-            totalFindings: findings.length,
-            criticalCount,
-            highCount,
-            mediumCount,
-            lowCount,
-            passed,
-        };
-    }
-    /**
-     * Scan multiple files
-     */
-    async scanFiles(files) {
-        const allFindings = [];
-        for (const file of files) {
-            const result = await this.scan(file.filepath, file.code);
-            allFindings.push(...result.findings);
-        }
-        const criticalCount = allFindings.filter(f => f.severity === 'critical').length;
-        const highCount = allFindings.filter(f => f.severity === 'high').length;
-        const mediumCount = allFindings.filter(f => f.severity === 'medium').length;
-        const lowCount = allFindings.filter(f => f.severity === 'low').length;
-        const passed = criticalCount === 0 && highCount === 0;
-        return {
-            findings: allFindings,
-            totalFindings: allFindings.length,
-            criticalCount,
-            highCount,
-            mediumCount,
-            lowCount,
-            passed,
-        };
-    }
-    /**
-     * Analyze code with AI for security vulnerabilities
-     */
-    async analyzeWithAI(filepath, code) {
-        const prompt = `Analyze the following code for security vulnerabilities. Focus on:
-- SQL Injection (CWE-89)
-- Cross-Site Scripting / XSS (CWE-79)
-- Code Injection (CWE-94, CWE-95) - including eval(), Function(), setTimeout/setInterval with user input
-- Command Injection (CWE-78)
-- Path Traversal (CWE-22)
-- Insecure Deserialization (CWE-502)
-- Authentication/Authorization flaws
-- Sensitive data exposure
-- Insecure dependencies
-- Dangerous JavaScript patterns: eval(), Function(), innerHTML with user input, dangerous regex
-
-Code from ${filepath}:
-\`\`\`
-${code}
-\`\`\`
-
-Respond with a JSON array of findings. Each finding should have:
-- severity: "critical" | "high" | "medium" | "low"
-- category: e.g., "SQL Injection"
-- description: Brief description of the vulnerability
-- line: Line number (approximate)
-- recommendation: How to fix it
-- cwe: CWE identifier if applicable
-
-If no vulnerabilities found, return empty array [].
-
-JSON only, no other text:`;
-        try {
-            const response = await this.aiService.chat(prompt, []);
-            // Extract JSON from response
-            const jsonMatch = response.match(/\[[\s\S]*\]/);
-            if (!jsonMatch) {
-                return [];
-            }
-            const findings = JSON.parse(jsonMatch[0]);
-            // Add filepath to each finding
-            return findings.map(f => ({
-                ...f,
-                filepath,
-            }));
-        }
-        catch (error) {
-            console.warn('AI SAST analysis failed:', error);
-            return [];
-        }
-    }
-    /**
-     * Check if code passes security gates
-     */
-    async passesSecurityGates(filepath, code) {
-        const result = await this.scan(filepath, code);
-        return result.passed;
-    }
-}
-//# sourceMappingURL=ai-sast-scanner.js.map