codehere 0.2.2 → 0.3.0-rc.1

package/dist/infrastructure/config/product-context.js

@@ -35,9 +35,12 @@ export function saveProductContext(ctx, cwd = process.cwd()) {
  * Returns a plain-English risk label for use in recommendations.
  */
 export function riskLabel(level) {
-    return level === 'critical' ? 'critical-risk'
-        : level === 'high' ? 'high-risk'
-            : level === 'medium' ? 'production'
+    return level === 'critical'
+        ? 'critical-risk'
+        : level === 'high'
+            ? 'high-risk'
+            : level === 'medium'
+                ? 'production'
                 : 'low-risk';
 }
 /**
@@ -47,9 +50,7 @@ export function riskLabel(level) {
 export function adjustRecommendation(base, criticalCount, highCount, score, ctx) {
     if (!ctx)
         return base;
-    const prefix = ctx.productionApp
-        ? `${ctx.name || 'Production app'} · `
-        : '';
+    const prefix = ctx.productionApp ? `${ctx.name || 'Production app'} · ` : '';
     if (criticalCount > 0) {
         return `${prefix}${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} — fix before this goes to production.`;
     }

package/dist/infrastructure/hooks/claude-sdk-hook.js

@@ -18,64 +18,335 @@ import { join } from 'path';
 import { homedir } from 'os';
 const PATTERNS = [
     // Prompt Injection
-    { regex: /ignore\s+(previous|prior|above|all|your)\s+(instructions?|rules?|prompts?|guidelines?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to override system instructions' },
-    { regex: /disregard\s+(previous|prior|all|your)\s+(instructions?|rules?|prompts?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Disregard instruction override' },
-    { regex: /forget\s+(everything|all|previous|your)\s*(instructions?|rules?|context)?/i, severity: 'critical', category: 'Prompt Injection', description: 'Context clearing attempt' },
-    { regex: /you\s+are\s+now\s+(a|an|my)|new\s+role\s*:|act\s+as\s+(a|an|if)/i, severity: 'critical', category: 'Prompt Injection', description: 'Role hijacking attempt' },
-    { regex: /system\s*prompt|<\/?system>|(?<!['"\\])<\/?instruction>/i, severity: 'critical', category: 'Prompt Injection', description: 'System prompt injection' },
-    { regex: /\bdo\s+not\s+(follow|obey|listen|comply)\b/i, severity: 'critical', category: 'Prompt Injection', description: 'Instruction override attempt' },
-    { regex: /jailbreak|DAN\s+mode|developer\s+mode\s+enabled/i, severity: 'critical', category: 'Prompt Injection', description: 'Jailbreak attempt' },
-    { regex: /bypass\s+(safety|restrictions?|filters?|guidelines?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Safety bypass attempt' },
-    { regex: /\[INST\]|\[\/INST\]|###\s*human:|###\s*assistant:/i, severity: 'high', category: 'Prompt Injection', description: 'Prompt template injection' },
-    { regex: /override\s+(safety|security|policy|restrictions?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Policy override attempt' },
+    // Allow chained modifiers: "ignore all previous instructions", "ignore all your prior rules", etc.
+    {
+        regex: /ignore\s+(?:(?:previous|prior|above|all|your|the)\s+){1,4}(?:instructions?|rules?|prompts?|guidelines?)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Attempts to override system instructions',
+    },
+    {
+        regex: /disregard\s+(previous|prior|all|your)\s+(instructions?|rules?|prompts?)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Disregard instruction override',
+    },
+    {
+        regex: /forget\s+(everything|all|previous|your)\s*(instructions?|rules?|context)?/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Context clearing attempt',
+    },
+    {
+        regex: /you\s+are\s+now\s+(a|an|my)|new\s+role\s*:|act\s+as\s+(a|an|if)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Role hijacking attempt',
+    },
+    {
+        regex: /system\s*prompt|<\/?system>|(?<!['"\\])<\/?instruction>/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'System prompt injection',
+    },
+    {
+        regex: /\bdo\s+not\s+(follow|obey|listen|comply)\b/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Instruction override attempt',
+    },
+    {
+        regex: /jailbreak|DAN\s+mode|developer\s+mode\s+enabled/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Jailbreak attempt',
+    },
+    {
+        regex: /bypass\s+(safety|restrictions?|filters?|guidelines?)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Safety bypass attempt',
+    },
+    {
+        regex: /\[INST\]|\[\/INST\]|###\s*human:|###\s*assistant:/i,
+        severity: 'high',
+        category: 'Prompt Injection',
+        description: 'Prompt template injection',
+    },
+    {
+        regex: /override\s+(safety|security|policy|restrictions?)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Policy override attempt',
+    },
     // Credential Theft
-    { regex: /cat\s+~?\/?(\.env|\.secrets?|credentials?|\.aws\/credentials)/i, severity: 'critical', category: 'Credential Theft', description: 'Reads credential files' },
-    { regex: /echo\s+\$\s*(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)/i, severity: 'critical', category: 'Credential Theft', description: 'Exfiltrates env secrets' },
-    { regex: /printenv|env\s*\|\s*(grep|curl|wget|nc)\b/i, severity: 'high', category: 'Credential Theft', description: 'Environment variable exfiltration' },
-    { regex: /curl.*\$(API_KEY|TOKEN|SECRET|PASSWORD)/i, severity: 'critical', category: 'Credential Theft', description: 'API key exfiltration via curl' },
-    { regex: /ssh-keygen|cat\s+~\/.ssh\/(id_rsa|id_ed25519|authorized_keys)/i, severity: 'high', category: 'Credential Theft', description: 'SSH key access' },
-    { regex: /keychain|security\s+find-generic-password/i, severity: 'high', category: 'Credential Theft', description: 'macOS keychain access attempt' },
-    { regex: /OPENAI_API_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN/i, severity: 'high', category: 'Credential Theft', description: 'Known API key reference' },
-    { regex: /\bsecret_key\b|\bapi_secret\b|\bauth_token\b/i, severity: 'medium', category: 'Credential Theft', description: 'Secret key reference' },
-    { regex: /curl.*webhook.*\$\w+|wget.*\$\w+.*credentials/i, severity: 'critical', category: 'Credential Theft', description: 'Credential webhook exfiltration' },
-    { regex: /\/proc\/\d+\/environ|\/etc\/shadow/i, severity: 'critical', category: 'Credential Theft', description: 'System credential file access' },
+    {
+        regex: /cat\s+~?\/?(\.env|\.secrets?|credentials?|\.aws\/credentials)/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'Reads credential files',
+    },
+    {
+        regex: /echo\s+\$\s*(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'Exfiltrates env secrets',
+    },
+    {
+        regex: /printenv|env\s*\|\s*(grep|curl|wget|nc)\b/i,
+        severity: 'high',
+        category: 'Credential Theft',
+        description: 'Environment variable exfiltration',
+    },
+    {
+        regex: /curl.*\$(API_KEY|TOKEN|SECRET|PASSWORD)/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'API key exfiltration via curl',
+    },
+    // Reading SSH private keys is never benign in dev workflow — promote to critical.
+    // ssh-keygen alone (key generation) stays 'high' since it's also a legitimate setup operation.
+    {
+        regex: /cat\s+~?\/?\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'Reads SSH private key',
+    },
+    {
+        regex: /ssh-keygen|cat\s+~?\/?\.ssh\/authorized_keys/i,
+        severity: 'high',
+        category: 'Credential Theft',
+        description: 'SSH key tooling access',
+    },
+    {
+        regex: /keychain|security\s+find-generic-password/i,
+        severity: 'high',
+        category: 'Credential Theft',
+        description: 'macOS keychain access attempt',
+    },
+    {
+        regex: /OPENAI_API_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN/i,
+        severity: 'high',
+        category: 'Credential Theft',
+        description: 'Known API key reference',
+    },
+    {
+        regex: /\bsecret_key\b|\bapi_secret\b|\bauth_token\b/i,
+        severity: 'medium',
+        category: 'Credential Theft',
+        description: 'Secret key reference',
+    },
+    {
+        regex: /curl.*webhook.*\$\w+|wget.*\$\w+.*credentials/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'Credential webhook exfiltration',
+    },
+    {
+        regex: /\/proc\/\d+\/environ|\/etc\/shadow/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'System credential file access',
+    },
     // Destructive Operations
-    { regex: /rm\s+-rf?\s+(\/|~|\.\.|\*|\/home|\/etc|\/var|\/usr)/i, severity: 'critical', category: 'Destructive', description: 'Recursive deletion of system/home directories' },
-    { regex: /delete\s+all\s+files|wipe\s+(disk|drive|everything)|format\s+[a-z]:/i, severity: 'critical', category: 'Destructive', description: 'Mass file deletion' },
-    { regex: />\s*\/dev\/(sda|hda|vda|nvme)|dd\s+if=.*of=\/dev/i, severity: 'critical', category: 'Destructive', description: 'Raw disk write attempt' },
-    { regex: /DROP\s+TABLE|DROP\s+DATABASE|TRUNCATE\s+TABLE/i, severity: 'critical', category: 'Destructive', description: 'Database destruction' },
-    { regex: /git\s+(push\s+--force|reset\s+--hard)\s+origin/i, severity: 'high', category: 'Destructive', description: 'Force push or hard reset to remote' },
-    { regex: /shutdown\s+-[hr]|reboot\s+--force|init\s+0/i, severity: 'high', category: 'Destructive', description: 'System shutdown/reboot' },
-    { regex: /pkill\s+-9\s+(node|python|ruby|java)\b/i, severity: 'medium', category: 'Destructive', description: 'Process mass termination' },
-    { regex: /crontab\s+-r|at\s+now.*rm|systemctl\s+disable\s+--now/i, severity: 'high', category: 'Destructive', description: 'Scheduled destruction' },
+    // Block rm -rf against system roots or a user's whole home — but allow
+    // routine deletion under /tmp, ~/Library/Caches, node_modules, etc.
+    // Previous pattern included bare `\/` which matched any path starting
+    // with `/` (so `rm -rf /tmp/foo` was blocked). The alternatives below
+    // require an explicit system target or a bare home reference.
+    {
+        regex: /rm\s+-rf?\s+(?:\/(?:["'\s]|$|\*)|\/(?:home|etc|var|usr|bin|sbin|System|Library|opt|root|boot|dev)\b|~(?:["'\s]|$|\/(?:["'\s]|$|\*))|\$HOME(?:["'\s]|$|\/(?:["'\s]|$|\*))|\.\.(?:["'\s]|$))/im,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Recursive deletion of system/home directories',
+    },
+    {
+        regex: /delete\s+all\s+files|wipe\s+(disk|drive|everything)|format\s+[a-z]:/i,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Mass file deletion',
+    },
+    {
+        regex: />\s*\/dev\/(sda|hda|vda|nvme)|dd\s+if=.*of=\/dev/i,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Raw disk write attempt',
+    },
+    {
+        regex: /DROP\s+TABLE|DROP\s+DATABASE|TRUNCATE\s+TABLE/i,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Database destruction',
+    },
+    // Force-push or hard reset against main/master/production is irreversible loss of shared history — critical.
+    // Force-push to other branches stays 'high' since rebase-and-force-push to feature branches is routine.
+    {
+        regex: /git\s+(?:push\s+(?:--force|-f)|reset\s+--hard)\s+\S*origin\s+(main|master|production|release|prod)\b/i,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Force push or hard reset to a protected branch',
+    },
+    {
+        regex: /git\s+(push\s+(?:--force|-f)|reset\s+--hard)\s+origin/i,
+        severity: 'high',
+        category: 'Destructive',
+        description: 'Force push or hard reset to remote',
+    },
+    {
+        regex: /shutdown\s+-[hr]|reboot\s+--force|init\s+0/i,
+        severity: 'high',
+        category: 'Destructive',
+        description: 'System shutdown/reboot',
+    },
+    {
+        regex: /pkill\s+-9\s+(node|python|ruby|java)\b/i,
+        severity: 'medium',
+        category: 'Destructive',
+        description: 'Process mass termination',
+    },
+    {
+        regex: /crontab\s+-r|at\s+now.*rm|systemctl\s+disable\s+--now/i,
+        severity: 'high',
+        category: 'Destructive',
+        description: 'Scheduled destruction',
+    },
     // Code/Command Injection
     // NOTE: patterns match execution intent, not grep/search of these strings.
     // A command starting with "grep", "rg", "ag", or "find" is a search, not execution —
     // those are pre-filtered in buildScanPayload before patterns run.
-    { regex: /curl\s+\S+\s*\|\s*(bash|sh|python|ruby|perl|node)\b/i, severity: 'critical', category: 'Code Injection', description: 'Remote script piped directly to shell' },
-    { regex: /wget\s+(-qO-\s+)?https?:\/\/\S+\s*\|\s*(bash|sh)/i, severity: 'critical', category: 'Code Injection', description: 'Remote code execution via wget' },
-    { regex: /node\s+-e\s+["'].*eval\s*\(|node\s+-e\s+["'].*require\s*\(/i, severity: 'critical', category: 'Code Injection', description: 'Inline node eval execution' },
-    { regex: /eval\s*\(.*process\.env\.|eval\s*\(.*\$_(GET|POST|REQUEST)/i, severity: 'critical', category: 'Code Injection', description: 'eval() with external or env input' },
-    { regex: /exec\s*\(\s*['"]\s*system/i, severity: 'critical', category: 'Code Injection', description: 'System shell from code' },
-    { regex: /python\s+-c\s+["']import\s+os;os\.system/i, severity: 'high', category: 'Code Injection', description: 'Python shell injection' },
-    { regex: /nc\s+-[eln]+\s+\d{1,3}\.\d{1,3}|bash\s+-i\s+>&\s*\/dev\/tcp/i, severity: 'critical', category: 'Code Injection', description: 'Reverse shell attempt' },
-    { regex: /\bbase64\b.*\|.*(bash|sh)\b|\bbase64\b.*exec/i, severity: 'critical', category: 'Code Injection', description: 'Base64-encoded code execution' },
-    { regex: /\$\(curl|subprocess\.run\(['"]curl/i, severity: 'high', category: 'Code Injection', description: 'Command substitution with curl' },
+    {
+        regex: /curl\s+\S+\s*\|\s*(bash|sh|python|ruby|perl|node)\b/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Remote script piped directly to shell',
+    },
+    {
+        regex: /wget\s+(-qO-\s+)?https?:\/\/\S+\s*\|\s*(bash|sh)/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Remote code execution via wget',
+    },
+    {
+        regex: /node\s+-e\s+["'].*eval\s*\(|node\s+-e\s+["'].*require\s*\(/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Inline node eval execution',
+    },
+    {
+        regex: /eval\s*\(.*process\.env\.|eval\s*\(.*\$_(GET|POST|REQUEST)/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'eval() with external or env input',
+    },
+    {
+        regex: /exec\s*\(\s*['"]\s*system/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'System shell from code',
+    },
+    {
+        regex: /python\s+-c\s+["']import\s+os;os\.system/i,
+        severity: 'high',
+        category: 'Code Injection',
+        description: 'Python shell injection',
+    },
+    // Reverse shell forms:
+    //   nc -e /bin/bash 1.2.3.4 4444   (binary between -e and IP)
+    //   nc -e 1.2.3.4 4444             (IP directly after -e)
+    //   bash -i >& /dev/tcp/host/port  (bash builtin)
+    {
+        regex: /nc\s+-[eln]+(?:\s+\S+)?\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|bash\s+-i\s+>&\s*\/dev\/tcp/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Reverse shell attempt',
+    },
+    {
+        regex: /\bbase64\b.*\|.*(bash|sh)\b|\bbase64\b.*exec/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Base64-encoded code execution',
+    },
+    {
+        regex: /\$\(curl|subprocess\.run\(['"]curl/i,
+        severity: 'high',
+        category: 'Code Injection',
+        description: 'Command substitution with curl',
+    },
     // Supply Chain
-    { regex: /npm\s+install\s+[a-z0-9-]+[0-9]{4,}|pip\s+install\s+\w+\d{6,}/i, severity: 'high', category: 'Supply Chain', description: 'Suspicious package version pattern' },
-    { regex: /npm\s+install\s+--save\s+[a-z]{2}\.[a-z]{2}\.[a-z]{2}/i, severity: 'high', category: 'Supply Chain', description: 'Typosquatting package pattern' },
-    { regex: /preinstall|postinstall|prepare/i, severity: 'medium', category: 'Supply Chain', description: 'Lifecycle script reference' },
-    { regex: /registry\.npmjs\.org\/[^/]+\/-\/[^/]+\.tgz.*;\s*bash/i, severity: 'critical', category: 'Supply Chain', description: 'Direct npm tarball execution' },
+    {
+        regex: /npm\s+install\s+[a-z0-9-]+[0-9]{4,}|pip\s+install\s+\w+\d{6,}/i,
+        severity: 'high',
+        category: 'Supply Chain',
+        description: 'Suspicious package version pattern',
+    },
+    {
+        regex: /npm\s+install\s+--save\s+[a-z]{2}\.[a-z]{2}\.[a-z]{2}/i,
+        severity: 'high',
+        category: 'Supply Chain',
+        description: 'Typosquatting package pattern',
+    },
+    {
+        regex: /preinstall|postinstall|prepare/i,
+        severity: 'medium',
+        category: 'Supply Chain',
+        description: 'Lifecycle script reference',
+    },
+    {
+        regex: /registry\.npmjs\.org\/[^/]+\/-\/[^/]+\.tgz.*;\s*bash/i,
+        severity: 'critical',
+        category: 'Supply Chain',
+        description: 'Direct npm tarball execution',
+    },
     // OWASP / Security Misconfig
-    { regex: /Access-Control-Allow-Origin:\s*\*/i, severity: 'medium', category: 'OWASP', description: 'Wildcard CORS header' },
-    { regex: /verify\s*=\s*False|ssl_verify\s*=\s*False|checkCertificate\s*=\s*false/i, severity: 'high', category: 'OWASP', description: 'SSL certificate verification disabled' },
-    { regex: /password\s*=\s*["'][^"']{0,16}["']|secret\s*=\s*["'][^"']{0,16}["']/i, severity: 'medium', category: 'OWASP', description: 'Hardcoded credential' },
-    { regex: /eval\s*\([^)]*user|innerHTML\s*=\s*[^;]*user|document\.write\s*\([^)]*user/i, severity: 'high', category: 'OWASP', description: 'Potential XSS via user input' },
-    { regex: /SELECT\s+\*?\s+FROM\s+\w+\s+WHERE.*['"]\s*\+|query\s*\+\s*user/i, severity: 'critical', category: 'OWASP', description: 'SQL injection pattern' },
+    {
+        regex: /Access-Control-Allow-Origin:\s*\*/i,
+        severity: 'medium',
+        category: 'OWASP',
+        description: 'Wildcard CORS header',
+    },
+    {
+        regex: /verify\s*=\s*False|ssl_verify\s*=\s*False|checkCertificate\s*=\s*false/i,
+        severity: 'high',
+        category: 'OWASP',
+        description: 'SSL certificate verification disabled',
+    },
+    {
+        regex: /password\s*=\s*["'][^"']{0,16}["']|secret\s*=\s*["'][^"']{0,16}["']/i,
+        severity: 'medium',
+        category: 'OWASP',
+        description: 'Hardcoded credential',
+    },
+    {
+        regex: /eval\s*\([^)]*user|innerHTML\s*=\s*[^;]*user|document\.write\s*\([^)]*user/i,
+        severity: 'high',
+        category: 'OWASP',
+        description: 'Potential XSS via user input',
+    },
+    {
+        regex: /SELECT\s+\*?\s+FROM\s+\w+\s+WHERE.*['"]\s*\+|query\s*\+\s*user/i,
+        severity: 'critical',
+        category: 'OWASP',
+        description: 'SQL injection pattern',
+    },
     // Data Exfiltration
-    { regex: /curl\s+.*-d\s+@\/|curl\s+.*--data-binary\s+@\//i, severity: 'high', category: 'Data Exfiltration', description: 'File upload via curl' },
-    { regex: /scp\s+.*@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/i, severity: 'high', category: 'Data Exfiltration', description: 'SCP to external IP' },
-    { regex: /rclone\s+copy|rsync\s+-av?[rpz]+\s+\/\w+.*@/i, severity: 'medium', category: 'Data Exfiltration', description: 'Mass file sync to remote' },
+    {
+        regex: /curl\s+.*-d\s+@\/|curl\s+.*--data-binary\s+@\//i,
+        severity: 'high',
+        category: 'Data Exfiltration',
+        description: 'File upload via curl',
+    },
+    {
+        regex: /scp\s+.*@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/i,
+        severity: 'high',
+        category: 'Data Exfiltration',
+        description: 'SCP to external IP',
+    },
+    {
+        regex: /rclone\s+copy|rsync\s+-av?[rpz]+\s+\/\w+.*@/i,
+        severity: 'medium',
+        category: 'Data Exfiltration',
+        description: 'Mass file sync to remote',
+    },
 ];
 // ── Risk scoring ────────────────────────────────────────────────────────────
 const SEVERITY_SCORES = {
@@ -112,16 +383,17 @@ export function calculateRiskScore(findings) {
     return Math.min(100, score);
 }
 // ── Audit log ───────────────────────────────────────────────────────────────
-const AUDIT_DIR = join(homedir(), '.codehere', 'audit');
-export const AUDIT_FILE = join(AUDIT_DIR, 'hook-events.jsonl');
-function ensureAuditDir() {
-    if (!existsSync(AUDIT_DIR)) {
-        mkdirSync(AUDIT_DIR, { recursive: true });
-    }
-}
+/**
+ * Audit log path — defaults to ~/.codehere/audit/hook-events.jsonl.
+ * Override at process start with CODEHERE_AUDIT_FILE env var (used by tests, optional for users).
+ */
+export const AUDIT_FILE = process.env.CODEHERE_AUDIT_FILE || join(homedir(), '.codehere', 'audit', 'hook-events.jsonl');
 export function appendAuditLog(entry) {
     try {
-        ensureAuditDir();
+        const dir = AUDIT_FILE.substring(0, AUDIT_FILE.lastIndexOf('/'));
+        if (dir && !existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
         appendFileSync(AUDIT_FILE, JSON.stringify(entry) + '\n');
     }
     catch {
@@ -181,7 +453,7 @@ function buildScanPayload(toolName, toolInput) {
     return JSON.stringify(toolInput);
 }
 export function processHookEvent(event) {
-    const { hook_event_name, tool_name = 'unknown', tool_input = {}, session_id = 'unknown', } = event;
+    const { hook_event_name, tool_name = 'unknown', tool_input = {}, session_id = 'unknown' } = event;
     // Only intercept PreToolUse events
     if (hook_event_name !== 'PreToolUse') {
         return null;
@@ -191,7 +463,7 @@ export function processHookEvent(event) {
     // Layer 0 scan — local, no API, ~2ms
     const findings = scanPayload(payload);
     const riskScore = calculateRiskScore(findings);
-    const criticalFindings = findings.filter(f => f.severity === 'critical');
+    const criticalFindings = findings.filter((f) => f.severity === 'critical');
     // Blocking threshold: critical finding OR risk score too high
     const blocked = criticalFindings.length > 0 || riskScore >= 60;
     // Build audit entry
@@ -213,12 +485,12 @@ export function processHookEvent(event) {
     const topFinding = criticalFindings[0] ?? findings[0];
     const categoryVoice = {
         'Prompt Injection': 'Caught a prompt injection attempt',
-        'Credential Theft': 'Stopped — this looks like it\'s trying to access credentials',
-        'Destructive': 'Stopped — this could delete or destroy data',
+        'Credential Theft': "Stopped — this looks like it's trying to access credentials",
+        Destructive: 'Stopped — this could delete or destroy data',
         'Code Injection': 'Blocked — this pattern looks like code injection',
         'Supply Chain': 'Blocked — suspicious package or dependency pattern',
-        'OWASP': 'Blocked — security misconfiguration pattern',
-        'Data Exfiltration': 'Blocked — this looks like it\'s trying to send data out',
+        OWASP: 'Blocked — security misconfiguration pattern',
+        'Data Exfiltration': "Blocked — this looks like it's trying to send data out",
     };
     const reason = topFinding
         ? `[codehere] ${categoryVoice[topFinding.category] ?? 'Blocked'} — ${topFinding.description}. (matched: "${topFinding.matched}")`

package/dist/infrastructure/observability/execution-tracer.js

@@ -76,11 +76,13 @@ export class ExecutionTracer {
             duration: operation.duration,
             input: this.sanitizeInput(operation.input),
             output: this.sanitizeOutput(operation.output),
-            error: operation.error ? {
-                message: operation.error.message,
-                stack: operation.error.stack,
-                code: operation.error.code,
-            } : undefined,
+            error: operation.error
+                ? {
+                    message: operation.error.message,
+                    stack: operation.error.stack,
+                    code: operation.error.code,
+                }
+                : undefined,
             metadata: operation.metadata,
         };
         this.currentRun.traces.push(trace);
@@ -191,7 +193,10 @@ export class ExecutionTracer {
         // Limit size and remove sensitive fields
         const sanitized = JSON.parse(JSON.stringify(input, (key, value) => {
             // Remove API keys and secrets
-            if (typeof key === 'string' && (key.toLowerCase().includes('key') || key.toLowerCase().includes('secret') || key.toLowerCase().includes('password'))) {
+            if (typeof key === 'string' &&
+                (key.toLowerCase().includes('key') ||
+                    key.toLowerCase().includes('secret') ||
+                    key.toLowerCase().includes('password'))) {
                 return '[REDACTED]';
             }
             // Limit string length

package/dist/infrastructure/orchestration/agent-adapter.js

@@ -0,0 +1,13 @@
+/**
+ * AgentAdapter — F2 foundation.
+ *
+ * Uniform interface over every AI coding agent codehere can spawn and manage.
+ * One adapter per backend: ClaudeCodeAdapter, CodexAdapter, AiderAdapter, …
+ *
+ * The interface intentionally carries **optional fields for later PM-UX layers**
+ * so we don't force a breaking change when v0.4/v0.5 ship progress roll-up,
+ * final report, intervention, and project scope. Unused today, ignored by the
+ * current renderer. See memory/project_manager_ux_v1.md for the full shape.
+ */
+export {};
+//# sourceMappingURL=agent-adapter.js.map

package/dist/infrastructure/orchestration/agent-installer.js

@@ -0,0 +1,101 @@
+/**
+ * Agent installer — runs the install command for a registered adapter.
+ *
+ * Principle #10 (non-technical users first-class): the user clicks a button,
+ * codehere runs the install, streams output back to the UI. No terminal, no
+ * copy-paste. If brew isn't present, we fall back to curl/sh or npm-based
+ * installers. On success, re-check readiness and tell the UI to refresh.
+ *
+ * Security: the command comes from adapter source code (built-ins) or from
+ * the user's own ~/.codehere/agents.yaml (generic adapters) — never from an
+ * HTTP request parameter. We refuse to execute an arbitrary command supplied
+ * over the wire.
+ */
+import { spawn } from 'child_process';
+import { EventEmitter } from 'events';
+/** Execute an install command in a shell so chained commands (&& / || / |)
+ *  work. We need the user's shell rc loaded so brew / npm / path extensions
+ *  resolve — default: `$SHELL -lc "<command>"`. */
+export function runInstallCommand(command) {
+    const emitter = new EventEmitter();
+    const buffer = [];
+    let statusValue = 'running';
+    const startedAt = Date.now();
+    const emit = (event) => {
+        buffer.push(event);
+        emitter.emit('event', event);
+    };
+    const shell = process.env.SHELL || '/bin/zsh';
+    let child;
+    try {
+        child = spawn(shell, ['-lc', command], {
+            env: process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch (err) {
+        statusValue = 'failed';
+        const msg = err instanceof Error ? err.message : String(err);
+        queueMicrotask(() => emit({ type: 'error', data: msg }));
+        return {
+            get status() {
+                return statusValue;
+            },
+            subscribe(handler) {
+                for (const e of buffer)
+                    handler(e);
+                emitter.on('event', handler);
+                return () => emitter.off('event', handler);
+            },
+            kill() {
+                /* not running */
+            },
+        };
+    }
+    child.stdout?.on('data', (chunk) => {
+        emit({ type: 'out', data: chunk.toString('utf-8') });
+    });
+    child.stderr?.on('data', (chunk) => {
+        emit({ type: 'err', data: chunk.toString('utf-8') });
+    });
+    child.on('exit', (code) => {
+        statusValue = code === 0 ? 'completed' : 'failed';
+        emit({ type: 'done', code, durationMs: Date.now() - startedAt });
+    });
+    child.on('error', (err) => {
+        statusValue = 'failed';
+        emit({ type: 'error', data: err.message });
+    });
+    return {
+        get status() {
+            return statusValue;
+        },
+        subscribe(handler) {
+            for (const e of buffer)
+                handler(e);
+            emitter.on('event', handler);
+            return () => emitter.off('event', handler);
+        },
+        kill() {
+            if (statusValue !== 'running')
+                return;
+            try {
+                child.kill('SIGTERM');
+            }
+            catch {
+                /* already dead */
+            }
+        },
+    };
+}
+/** Convenience: install a registered adapter. Returns null if adapter has no
+ *  installHint configured or is already installed. */
+export function installAgent(adapter) {
+    if (!adapter.checkReadiness)
+        return null;
+    const readiness = adapter.checkReadiness();
+    if (readiness.state !== 'needs_install' || !readiness.installHint?.command)
+        return null;
+    return runInstallCommand(readiness.installHint.command);
+}
+//# sourceMappingURL=agent-installer.js.map