codehere 0.2.2 → 0.3.0-rc.10

package/dist/presentation/cli/commands/trust-command.js

@@ -18,40 +18,27 @@
  *   codehere trust --diff HEAD           # equivalent using git directly
  *   codehere trust --badge               # output badge markdown
  */
-import { readFileSync, existsSync, statSync, readdirSync } from 'fs';
-import { join, extname, relative, isAbsolute } from 'path';
-import { execSync } from 'child_process';
+import { existsSync } from 'fs';
+import { join, relative, isAbsolute } from 'path';
+import { execFileSync } from 'child_process';
 import { scoreFile } from '../../../infrastructure/security/trust-scorer.js';
+import { collectCodeFiles } from '../../../infrastructure/security/file-collection.js';
 import { colors, sectionHeader, error, newline, info, randomCleanScan } from '../../../ui.js';
 import { loadProductContext, adjustRecommendation } from '../../../infrastructure/config/product-context.js';
 // ── File collection ──────────────────────────────────────────────────────────
-const CODE_EXTENSIONS = new Set([
-    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
-    '.py', '.rb', '.go', '.java', '.cs', '.php',
-    '.sh', '.bash', '.zsh',
-    '.sql', '.html', '.vue', '.svelte',
-]);
-const IGNORE_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.next', 'coverage', '.cache', '.codehere', '.codehere-cache']);
-function collectFiles(target) {
-    const stat = statSync(target);
-    if (stat.isFile())
-        return [target];
-    const files = [];
-    function walk(dir) {
-        for (const entry of readdirSync(dir, { withFileTypes: true })) {
-            if (IGNORE_DIRS.has(entry.name))
-                continue;
-            const full = join(dir, entry.name);
-            if (entry.isDirectory()) {
-                walk(full);
-            }
-            else if (CODE_EXTENSIONS.has(extname(entry.name))) {
-                files.push(full);
-            }
-        }
+// See src/infrastructure/security/file-collection.ts for exclusion rules.
+/**
+ * Read a file safely — handles iCloud-evicted files on macOS.
+ * readFileSync blocks forever on iCloud-evicted files (dehydrated placeholders in ~/Documents).
+ * We use cat with a timeout as a subprocess so the main thread never blocks.
+ */
+function safeReadFile(filepath) {
+    try {
+        return execFileSync('cat', [filepath], { encoding: 'utf-8', timeout: 2000, maxBuffer: 5 * 1024 * 1024 });
+    }
+    catch {
+        return null; // File unreadable (iCloud-evicted, permissions, too large) — skip silently
     }
-    walk(target);
-    return files;
 }
 // ── Git diff mode ────────────────────────────────────────────────────────────
 function parseDiffFiles(diff) {
@@ -68,8 +55,8 @@ function parseDiffFiles(diff) {
         // Extract added lines only (lines starting with +, excluding +++)
         const addedLines = block
             .split('\n')
-            .filter(l => l.startsWith('+') && !l.startsWith('+++'))
-            .map(l => l.substring(1))
+            .filter((l) => l.startsWith('+') && !l.startsWith('+++'))
+            .map((l) => l.substring(1))
             .join('\n');
         if (addedLines.trim()) {
             files.push({ filepath, code: addedLines });
@@ -80,12 +67,18 @@ function parseDiffFiles(diff) {
 // ── Report formatting ────────────────────────────────────────────────────────
 function gradeColor(grade) {
     switch (grade) {
-        case 'A': return colors.green(grade);
-        case 'B': return colors.cyan(grade);
-        case 'C': return colors.yellow(grade);
-        case 'D': return colors.red(grade);
-        case 'F': return colors.red(colors.bold(grade));
-        default: return grade;
+        case 'A':
+            return colors.green(grade);
+        case 'B':
+            return colors.cyan(grade);
+        case 'C':
+            return colors.yellow(grade);
+        case 'D':
+            return colors.red(grade);
+        case 'F':
+            return colors.red(colors.bold(grade));
+        default:
+            return grade;
     }
 }
 function scoreBar(score, width = 20) {
@@ -98,10 +91,14 @@ function scoreBar(score, width = 20) {
     return colors.red(bar);
 }
 function badgeMarkdown(report) {
-    const color = report.grade === 'A' ? 'brightgreen'
-        : report.grade === 'B' ? 'green'
-            : report.grade === 'C' ? 'yellow'
-                : report.grade === 'D' ? 'orange'
+    const color = report.grade === 'A'
+        ? 'brightgreen'
+        : report.grade === 'B'
+            ? 'green'
+            : report.grade === 'C'
+                ? 'yellow'
+                : report.grade === 'D'
+                    ? 'orange'
                     : 'red';
     return `![codehere trust](https://img.shields.io/badge/codehere%20trust-${report.overallScore}%25%20${report.grade}-${color}?logo=shield)`;
 }
@@ -113,8 +110,12 @@ export async function executeTrustCommand(target, options = {}) {
     if (options.diff !== undefined) {
         // Run git diff and scan added lines
         try {
+            // THREAT-2 fix · ref comes from a user-supplied CLI flag. Using template-
+            // string interpolation with execSync allows shell metacharacters in `ref`
+            // (e.g. `--diff "main; rm -rf /"`) to escape the git invocation. Use the
+            // execFileSync array form so the shell is never invoked.
             const ref = options.diff || 'HEAD';
-            const diffOutput = execSync(`git diff ${ref}`, { cwd, encoding: 'utf-8' });
+            const diffOutput = execFileSync('git', ['diff', ref], { cwd, encoding: 'utf-8' });
             filesToScan = parseDiffFiles(diffOutput);
             if (filesToScan.length === 0) {
                 console.log(info('No changed files to scan'));
@@ -151,30 +152,42 @@ export async function executeTrustCommand(target, options = {}) {
             console.error(error(`Not found: ${resolved}`));
             process.exit(1);
         }
-        const paths = collectFiles(resolved);
-        filesToScan = paths.map(p => ({
-            filepath: relative(cwd, p),
-            code: readFileSync(p, 'utf-8'),
-        }));
+        const paths = collectCodeFiles(resolved);
+        let skippedCount = 0;
+        for (const p of paths) {
+            const code = safeReadFile(p);
+            if (code !== null) {
+                filesToScan.push({ filepath: relative(cwd, p), code });
+            }
+            else {
+                skippedCount++;
+            }
+        }
+        if (skippedCount > 0) {
+            console.log(colors.dim(`  Skipped ${skippedCount} unreadable file${skippedCount > 1 ? 's' : ''}`));
+        }
+        if (filesToScan.length === 0 && skippedCount > 0) {
+            console.log(info('No readable files to scan.'));
+            console.log(colors.dim('  Check file permissions or availability and retry.'));
+            return;
+        }
     }
     // ── Scan ──────────────────────────────────────────────────────────────────
-    const results = filesToScan.map(f => scoreFile(f.filepath, f.code));
+    const results = filesToScan.map((f) => scoreFile(f.filepath, f.code));
     const totalFindings = results.reduce((s, r) => s + r.findings.length, 0);
-    const criticalCount = results.reduce((s, r) => s + r.findings.filter(f => f.severity === 'critical').length, 0);
-    const highCount = results.reduce((s, r) => s + r.findings.filter(f => f.severity === 'high').length, 0);
-    const mediumCount = results.reduce((s, r) => s + r.findings.filter(f => f.severity === 'medium').length, 0);
-    const lowCount = results.reduce((s, r) => s + r.findings.filter(f => f.severity === 'low').length, 0);
-    const overallScore = results.length > 0
-        ? Math.round(results.reduce((s, r) => s + r.score, 0) / results.length)
-        : 100;
+    const criticalCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'critical').length, 0);
+    const highCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'high').length, 0);
+    const mediumCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'medium').length, 0);
+    const lowCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'low').length, 0);
+    const overallScore = results.length > 0 ? Math.round(results.reduce((s, r) => s + r.score, 0) / results.length) : 100;
     const grade = overallScore >= 90 ? 'A' : overallScore >= 75 ? 'B' : overallScore >= 60 ? 'C' : overallScore >= 40 ? 'D' : 'F';
     const baseRecommendation = criticalCount > 0
         ? `${criticalCount} critical ${criticalCount === 1 ? 'issue' : 'issues'} — worth sorting before this merges.`
         : highCount > 0
             ? `Nothing critical, but ${highCount} high-severity ${highCount === 1 ? 'pattern' : 'patterns'} worth a look.`
-            : overallScore >= 75
-                ? 'Clean scan. Nothing blocking a merge.'
-                : 'A few things to look at — nothing critical, but worth a pass.';
+            : mediumCount + lowCount > 0
+                ? `${mediumCount + lowCount} low-priority ${mediumCount + lowCount === 1 ? 'finding' : 'findings'} — nothing blocking, but worth a pass.`
+                : 'Clean scan. Nothing blocking a merge.';
     const productCtx = loadProductContext(process.cwd());
     const recommendation = adjustRecommendation(baseRecommendation, criticalCount, highCount, overallScore, productCtx);
     const report = {
@@ -244,8 +257,10 @@ export async function executeTrustCommand(target, options = {}) {
                 continue;
             console.log(`  ${colors.bold(r.filepath)}`);
             for (const f of r.findings) {
-                const sev = f.severity === 'critical' ? colors.red('crit')
-                    : f.severity === 'high' ? colors.yellow('high')
+                const sev = f.severity === 'critical'
+                    ? colors.red('crit')
+                    : f.severity === 'high'
+                        ? colors.yellow('high')
                         : colors.dim(f.severity.slice(0, 4));
                 const ln = f.line ? colors.dim(`L${f.line}`) : '';
                 console.log(`    ${sev}  ${ln.padEnd(6)} ${f.description}`);
@@ -253,20 +268,17 @@ export async function executeTrustCommand(target, options = {}) {
         }
         newline();
     }
-    else if (criticalCount + highCount > 0) {
+    else if (totalFindings > 0) {
         console.log(colors.dim('  FINDINGS'));
-        const allFindings = results.flatMap(r => r.findings
-            .filter(f => f.severity === 'critical' || f.severity === 'high')
-            .map(f => ({ ...f, filepath: r.filepath })));
-        const sorted = allFindings.sort((a, b) => {
-            if (a.severity === 'critical' && b.severity !== 'critical')
-                return -1;
-            if (a.severity !== 'critical' && b.severity === 'critical')
-                return 1;
-            return 0;
-        });
+        const severityRank = { critical: 0, high: 1, medium: 2, low: 3 };
+        const allFindings = results.flatMap((r) => r.findings.map((f) => ({ ...f, filepath: r.filepath })));
+        const sorted = allFindings.sort((a, b) => severityRank[a.severity] - severityRank[b.severity]);
         for (const f of sorted.slice(0, 5)) {
-            const sev = f.severity === 'critical' ? colors.red('crit') : colors.yellow('high');
+            const sev = f.severity === 'critical'
+                ? colors.red('crit')
+                : f.severity === 'high'
+                    ? colors.yellow('high')
+                    : colors.dim(f.severity.slice(0, 4));
             const ln = f.line ? `:${f.line}` : '';
             console.log(`  ${sev}  ${f.filepath}${ln}`);
             console.log(`        ${colors.dim(f.description)}`);

package/dist/presentation/cli/error-display.js

@@ -63,11 +63,7 @@ function extractFilePath(errorMessage) {
  */
 function extractLineNumber(errorMessage) {
     // Patterns: "line 42", ":42", "at line 42"
-    const patterns = [
-        /(?:line|Line)\s+(\d+)/i,
-        /:(\d+):/,
-        /\((\d+)\)/,
-    ];
+    const patterns = [/(?:line|Line)\s+(\d+)/i, /:(\d+):/, /\((\d+)\)/];
     for (const pattern of patterns) {
         const match = errorMessage.match(pattern);
         if (match && match[1]) {
@@ -89,9 +85,8 @@ function getRecoveryCommands(errorType, errorMessage, context) {
         case ErrorType.VALIDATION:
             if (lowerMessage.includes('file') || lowerMessage.includes('not found')) {
                 if (context.filepath) {
-                    commands.push(`codehere explain ${context.filepath}${context.lineNumber ? `:${context.lineNumber}` : ''}`);
+                    commands.push(`codehere trust ${context.filepath}`);
                 }
-                commands.push('codehere index');
             }
             break;
         case ErrorType.API_ERROR:
@@ -102,7 +97,7 @@ function getRecoveryCommands(errorType, errorMessage, context) {
             break;
         case ErrorType.POLICY:
             if (context.filepath) {
-                commands.push(`codehere explain ${context.filepath}`);
+                commands.push(`codehere trust ${context.filepath}`);
                 commands.push('codehere config policies');
             }
             break;
@@ -174,7 +169,7 @@ function getDocumentationLink(errorType) {
 function generateErrorCode(errorType, errorMessage) {
     const prefix = errorType.toUpperCase().substring(0, 3);
     const hash = errorMessage.split('').reduce((acc, char) => {
-        return ((acc << 5) - acc) + char.charCodeAt(0);
+        return (acc << 5) - acc + char.charCodeAt(0);
     }, 0);
     const code = Math.abs(hash).toString(16).substring(0, 4).toUpperCase();
     return `${prefix}-${code}`;
@@ -183,7 +178,7 @@ function generateErrorCode(errorType, errorMessage) {
  * Display error with helpful context and recovery suggestions
  */
 export function displayError(error, options = {}) {
-    const { operation = 'operation', query, showSuggestions = true, showStack = false, } = options;
+    const { operation = 'operation', query, showSuggestions = true, showStack = false } = options;
     const errorType = classifyError(error);
     const errorMessage = error instanceof Error ? error.message : String(error);
     const isEnterpriseError = error instanceof EnterpriseError;
@@ -227,16 +222,21 @@ export function displayError(error, options = {}) {
         const suggestions = getErrorSuggestions(errorType, errorMessage, { operation, query, filepath: fileContext });
         if (suggestions.length > 0) {
             console.log(colors.bold('Suggestions:'));
-            suggestions.forEach(suggestion => {
+            suggestions.forEach((suggestion) => {
                 console.log(colors.dim(`  ${symbols.bullet} ${suggestion}`));
             });
             newline();
         }
         // Show recovery commands for certain error types
-        const recoveryCommands = getRecoveryCommands(errorType, errorMessage, { operation, query, filepath: fileContext, lineNumber: lineContext });
+        const recoveryCommands = getRecoveryCommands(errorType, errorMessage, {
+            operation,
+            query,
+            filepath: fileContext,
+            lineNumber: lineContext,
+        });
         if (recoveryCommands.length > 0) {
             console.log(colors.bold('Recovery Commands:'));
-            recoveryCommands.forEach(cmd => {
+            recoveryCommands.forEach((cmd) => {
                 console.log(colors.cyan(`  $ ${cmd}`));
             });
             newline();
@@ -271,7 +271,7 @@ function getErrorSuggestions(errorType, errorMessage, context) {
     const lowerMessage = errorMessage.toLowerCase();
     switch (errorType) {
         case ErrorType.RATE_LIMIT:
-            suggestions.push('You\'ve reached the API rate limit or monthly quota');
+            suggestions.push("You've reached the API rate limit or monthly quota");
             suggestions.push('Wait a moment and try again');
             suggestions.push('Check your API key limits at: https://dashboard.cohere.com/api-keys');
             suggestions.push('Consider upgrading your API key for higher limits');
@@ -286,11 +286,8 @@ function getErrorSuggestions(errorType, errorMessage, context) {
                 suggestions.push('For troubleshooting, include the error code when reporting issues');
             }
             else if (lowerMessage.includes('not found') || lowerMessage.includes('missing')) {
-                if (context.query) {
-                    suggestions.push(`Try searching: codehere "find ${context.query.split(' ').slice(0, 3).join(' ')}"`);
-                }
-                suggestions.push('Make sure you\'re in the correct directory');
-                suggestions.push('Run "codehere index" to build search index');
+                suggestions.push("Make sure you're in the correct directory");
+                suggestions.push('Run "codehere trust ." to verify the path is scanned');
             }
             else {
                 suggestions.push('Check the error message above for specific details');
@@ -319,8 +316,7 @@ function getErrorSuggestions(errorType, errorMessage, context) {
                 suggestions.push('Check file permissions');
             }
             else if (lowerMessage.includes('memory') || lowerMessage.includes('database')) {
-                suggestions.push('The memory system may need initialization');
-                suggestions.push('Try running "codehere index" to rebuild the index');
+                suggestions.push('Run "codehere health" to inspect runtime state');
             }
             else {
                 suggestions.push('This error may be temporary - try again');