codehere 0.2.2 → 0.3.0-rc.2

package/dist/infrastructure/config/product-context.js

@@ -35,9 +35,12 @@ export function saveProductContext(ctx, cwd = process.cwd()) {
  * Returns a plain-English risk label for use in recommendations.
  */
 export function riskLabel(level) {
-    return level === 'critical' ? 'critical-risk'
-        : level === 'high' ? 'high-risk'
-            : level === 'medium' ? 'production'
+    return level === 'critical'
+        ? 'critical-risk'
+        : level === 'high'
+            ? 'high-risk'
+            : level === 'medium'
+                ? 'production'
                 : 'low-risk';
 }
 /**
@@ -47,9 +50,7 @@ export function riskLabel(level) {
 export function adjustRecommendation(base, criticalCount, highCount, score, ctx) {
     if (!ctx)
         return base;
-    const prefix = ctx.productionApp
-        ? `${ctx.name || 'Production app'} · `
-        : '';
+    const prefix = ctx.productionApp ? `${ctx.name || 'Production app'} · ` : '';
     if (criticalCount > 0) {
         return `${prefix}${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} — fix before this goes to production.`;
     }

package/dist/infrastructure/hooks/claude-sdk-hook.js

@@ -18,64 +18,335 @@ import { join } from 'path';
 import { homedir } from 'os';
 const PATTERNS = [
     // Prompt Injection
-    { regex: /ignore\s+(previous|prior|above|all|your)\s+(instructions?|rules?|prompts?|guidelines?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Attempts to override system instructions' },
-    { regex: /disregard\s+(previous|prior|all|your)\s+(instructions?|rules?|prompts?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Disregard instruction override' },
-    { regex: /forget\s+(everything|all|previous|your)\s*(instructions?|rules?|context)?/i, severity: 'critical', category: 'Prompt Injection', description: 'Context clearing attempt' },
-    { regex: /you\s+are\s+now\s+(a|an|my)|new\s+role\s*:|act\s+as\s+(a|an|if)/i, severity: 'critical', category: 'Prompt Injection', description: 'Role hijacking attempt' },
-    { regex: /system\s*prompt|<\/?system>|(?<!['"\\])<\/?instruction>/i, severity: 'critical', category: 'Prompt Injection', description: 'System prompt injection' },
-    { regex: /\bdo\s+not\s+(follow|obey|listen|comply)\b/i, severity: 'critical', category: 'Prompt Injection', description: 'Instruction override attempt' },
-    { regex: /jailbreak|DAN\s+mode|developer\s+mode\s+enabled/i, severity: 'critical', category: 'Prompt Injection', description: 'Jailbreak attempt' },
-    { regex: /bypass\s+(safety|restrictions?|filters?|guidelines?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Safety bypass attempt' },
-    { regex: /\[INST\]|\[\/INST\]|###\s*human:|###\s*assistant:/i, severity: 'high', category: 'Prompt Injection', description: 'Prompt template injection' },
-    { regex: /override\s+(safety|security|policy|restrictions?)/i, severity: 'critical', category: 'Prompt Injection', description: 'Policy override attempt' },
+    // Allow chained modifiers: "ignore all previous instructions", "ignore all your prior rules", etc.
+    {
+        regex: /ignore\s+(?:(?:previous|prior|above|all|your|the)\s+){1,4}(?:instructions?|rules?|prompts?|guidelines?)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Attempts to override system instructions',
+    },
+    {
+        regex: /disregard\s+(previous|prior|all|your)\s+(instructions?|rules?|prompts?)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Disregard instruction override',
+    },
+    {
+        regex: /forget\s+(everything|all|previous|your)\s*(instructions?|rules?|context)?/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Context clearing attempt',
+    },
+    {
+        regex: /you\s+are\s+now\s+(a|an|my)|new\s+role\s*:|act\s+as\s+(a|an|if)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Role hijacking attempt',
+    },
+    {
+        regex: /system\s*prompt|<\/?system>|(?<!['"\\])<\/?instruction>/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'System prompt injection',
+    },
+    {
+        regex: /\bdo\s+not\s+(follow|obey|listen|comply)\b/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Instruction override attempt',
+    },
+    {
+        regex: /jailbreak|DAN\s+mode|developer\s+mode\s+enabled/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Jailbreak attempt',
+    },
+    {
+        regex: /bypass\s+(safety|restrictions?|filters?|guidelines?)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Safety bypass attempt',
+    },
+    {
+        regex: /\[INST\]|\[\/INST\]|###\s*human:|###\s*assistant:/i,
+        severity: 'high',
+        category: 'Prompt Injection',
+        description: 'Prompt template injection',
+    },
+    {
+        regex: /override\s+(safety|security|policy|restrictions?)/i,
+        severity: 'critical',
+        category: 'Prompt Injection',
+        description: 'Policy override attempt',
+    },
     // Credential Theft
-    { regex: /cat\s+~?\/?(\.env|\.secrets?|credentials?|\.aws\/credentials)/i, severity: 'critical', category: 'Credential Theft', description: 'Reads credential files' },
-    { regex: /echo\s+\$\s*(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)/i, severity: 'critical', category: 'Credential Theft', description: 'Exfiltrates env secrets' },
-    { regex: /printenv|env\s*\|\s*(grep|curl|wget|nc)\b/i, severity: 'high', category: 'Credential Theft', description: 'Environment variable exfiltration' },
-    { regex: /curl.*\$(API_KEY|TOKEN|SECRET|PASSWORD)/i, severity: 'critical', category: 'Credential Theft', description: 'API key exfiltration via curl' },
-    { regex: /ssh-keygen|cat\s+~\/.ssh\/(id_rsa|id_ed25519|authorized_keys)/i, severity: 'high', category: 'Credential Theft', description: 'SSH key access' },
-    { regex: /keychain|security\s+find-generic-password/i, severity: 'high', category: 'Credential Theft', description: 'macOS keychain access attempt' },
-    { regex: /OPENAI_API_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN/i, severity: 'high', category: 'Credential Theft', description: 'Known API key reference' },
-    { regex: /\bsecret_key\b|\bapi_secret\b|\bauth_token\b/i, severity: 'medium', category: 'Credential Theft', description: 'Secret key reference' },
-    { regex: /curl.*webhook.*\$\w+|wget.*\$\w+.*credentials/i, severity: 'critical', category: 'Credential Theft', description: 'Credential webhook exfiltration' },
-    { regex: /\/proc\/\d+\/environ|\/etc\/shadow/i, severity: 'critical', category: 'Credential Theft', description: 'System credential file access' },
+    {
+        regex: /cat\s+~?\/?(\.env|\.secrets?|credentials?|\.aws\/credentials)/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'Reads credential files',
+    },
+    {
+        regex: /echo\s+\$\s*(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'Exfiltrates env secrets',
+    },
+    {
+        regex: /printenv|env\s*\|\s*(grep|curl|wget|nc)\b/i,
+        severity: 'high',
+        category: 'Credential Theft',
+        description: 'Environment variable exfiltration',
+    },
+    {
+        regex: /curl.*\$(API_KEY|TOKEN|SECRET|PASSWORD)/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'API key exfiltration via curl',
+    },
+    // Reading SSH private keys is never benign in dev workflow — promote to critical.
+    // ssh-keygen alone (key generation) stays 'high' since it's also a legitimate setup operation.
+    {
+        regex: /cat\s+~?\/?\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'Reads SSH private key',
+    },
+    {
+        regex: /ssh-keygen|cat\s+~?\/?\.ssh\/authorized_keys/i,
+        severity: 'high',
+        category: 'Credential Theft',
+        description: 'SSH key tooling access',
+    },
+    {
+        regex: /keychain|security\s+find-generic-password/i,
+        severity: 'high',
+        category: 'Credential Theft',
+        description: 'macOS keychain access attempt',
+    },
+    {
+        regex: /OPENAI_API_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN/i,
+        severity: 'high',
+        category: 'Credential Theft',
+        description: 'Known API key reference',
+    },
+    {
+        regex: /\bsecret_key\b|\bapi_secret\b|\bauth_token\b/i,
+        severity: 'medium',
+        category: 'Credential Theft',
+        description: 'Secret key reference',
+    },
+    {
+        regex: /curl.*webhook.*\$\w+|wget.*\$\w+.*credentials/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'Credential webhook exfiltration',
+    },
+    {
+        regex: /\/proc\/\d+\/environ|\/etc\/shadow/i,
+        severity: 'critical',
+        category: 'Credential Theft',
+        description: 'System credential file access',
+    },
     // Destructive Operations
-    { regex: /rm\s+-rf?\s+(\/|~|\.\.|\*|\/home|\/etc|\/var|\/usr)/i, severity: 'critical', category: 'Destructive', description: 'Recursive deletion of system/home directories' },
-    { regex: /delete\s+all\s+files|wipe\s+(disk|drive|everything)|format\s+[a-z]:/i, severity: 'critical', category: 'Destructive', description: 'Mass file deletion' },
-    { regex: />\s*\/dev\/(sda|hda|vda|nvme)|dd\s+if=.*of=\/dev/i, severity: 'critical', category: 'Destructive', description: 'Raw disk write attempt' },
-    { regex: /DROP\s+TABLE|DROP\s+DATABASE|TRUNCATE\s+TABLE/i, severity: 'critical', category: 'Destructive', description: 'Database destruction' },
-    { regex: /git\s+(push\s+--force|reset\s+--hard)\s+origin/i, severity: 'high', category: 'Destructive', description: 'Force push or hard reset to remote' },
-    { regex: /shutdown\s+-[hr]|reboot\s+--force|init\s+0/i, severity: 'high', category: 'Destructive', description: 'System shutdown/reboot' },
-    { regex: /pkill\s+-9\s+(node|python|ruby|java)\b/i, severity: 'medium', category: 'Destructive', description: 'Process mass termination' },
-    { regex: /crontab\s+-r|at\s+now.*rm|systemctl\s+disable\s+--now/i, severity: 'high', category: 'Destructive', description: 'Scheduled destruction' },
+    // Block rm -rf against system roots or a user's whole home — but allow
+    // routine deletion under /tmp, ~/Library/Caches, node_modules, etc.
+    // Previous pattern included bare `\/` which matched any path starting
+    // with `/` (so `rm -rf /tmp/foo` was blocked). The alternatives below
+    // require an explicit system target or a bare home reference.
+    {
+        regex: /rm\s+-rf?\s+(?:\/(?:["'\s]|$|\*)|\/(?:home|etc|var|usr|bin|sbin|System|Library|opt|root|boot|dev)\b|~(?:["'\s]|$|\/(?:["'\s]|$|\*))|\$HOME(?:["'\s]|$|\/(?:["'\s]|$|\*))|\.\.(?:["'\s]|$))/im,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Recursive deletion of system/home directories',
+    },
+    {
+        regex: /delete\s+all\s+files|wipe\s+(disk|drive|everything)|format\s+[a-z]:/i,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Mass file deletion',
+    },
+    {
+        regex: />\s*\/dev\/(sda|hda|vda|nvme)|dd\s+if=.*of=\/dev/i,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Raw disk write attempt',
+    },
+    {
+        regex: /DROP\s+TABLE|DROP\s+DATABASE|TRUNCATE\s+TABLE/i,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Database destruction',
+    },
+    // Force-push or hard reset against main/master/production is irreversible loss of shared history — critical.
+    // Force-push to other branches stays 'high' since rebase-and-force-push to feature branches is routine.
+    {
+        regex: /git\s+(?:push\s+(?:--force|-f)|reset\s+--hard)\s+\S*origin\s+(main|master|production|release|prod)\b/i,
+        severity: 'critical',
+        category: 'Destructive',
+        description: 'Force push or hard reset to a protected branch',
+    },
+    {
+        regex: /git\s+(push\s+(?:--force|-f)|reset\s+--hard)\s+origin/i,
+        severity: 'high',
+        category: 'Destructive',
+        description: 'Force push or hard reset to remote',
+    },
+    {
+        regex: /shutdown\s+-[hr]|reboot\s+--force|init\s+0/i,
+        severity: 'high',
+        category: 'Destructive',
+        description: 'System shutdown/reboot',
+    },
+    {
+        regex: /pkill\s+-9\s+(node|python|ruby|java)\b/i,
+        severity: 'medium',
+        category: 'Destructive',
+        description: 'Process mass termination',
+    },
+    {
+        regex: /crontab\s+-r|at\s+now.*rm|systemctl\s+disable\s+--now/i,
+        severity: 'high',
+        category: 'Destructive',
+        description: 'Scheduled destruction',
+    },
     // Code/Command Injection
     // NOTE: patterns match execution intent, not grep/search of these strings.
     // A command starting with "grep", "rg", "ag", or "find" is a search, not execution —
     // those are pre-filtered in buildScanPayload before patterns run.
-    { regex: /curl\s+\S+\s*\|\s*(bash|sh|python|ruby|perl|node)\b/i, severity: 'critical', category: 'Code Injection', description: 'Remote script piped directly to shell' },
-    { regex: /wget\s+(-qO-\s+)?https?:\/\/\S+\s*\|\s*(bash|sh)/i, severity: 'critical', category: 'Code Injection', description: 'Remote code execution via wget' },
-    { regex: /node\s+-e\s+["'].*eval\s*\(|node\s+-e\s+["'].*require\s*\(/i, severity: 'critical', category: 'Code Injection', description: 'Inline node eval execution' },
-    { regex: /eval\s*\(.*process\.env\.|eval\s*\(.*\$_(GET|POST|REQUEST)/i, severity: 'critical', category: 'Code Injection', description: 'eval() with external or env input' },
-    { regex: /exec\s*\(\s*['"]\s*system/i, severity: 'critical', category: 'Code Injection', description: 'System shell from code' },
-    { regex: /python\s+-c\s+["']import\s+os;os\.system/i, severity: 'high', category: 'Code Injection', description: 'Python shell injection' },
-    { regex: /nc\s+-[eln]+\s+\d{1,3}\.\d{1,3}|bash\s+-i\s+>&\s*\/dev\/tcp/i, severity: 'critical', category: 'Code Injection', description: 'Reverse shell attempt' },
-    { regex: /\bbase64\b.*\|.*(bash|sh)\b|\bbase64\b.*exec/i, severity: 'critical', category: 'Code Injection', description: 'Base64-encoded code execution' },
-    { regex: /\$\(curl|subprocess\.run\(['"]curl/i, severity: 'high', category: 'Code Injection', description: 'Command substitution with curl' },
+    {
+        regex: /curl\s+\S+\s*\|\s*(bash|sh|python|ruby|perl|node)\b/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Remote script piped directly to shell',
+    },
+    {
+        regex: /wget\s+(-qO-\s+)?https?:\/\/\S+\s*\|\s*(bash|sh)/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Remote code execution via wget',
+    },
+    {
+        regex: /node\s+-e\s+["'].*eval\s*\(|node\s+-e\s+["'].*require\s*\(/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Inline node eval execution',
+    },
+    {
+        regex: /eval\s*\(.*process\.env\.|eval\s*\(.*\$_(GET|POST|REQUEST)/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'eval() with external or env input',
+    },
+    {
+        regex: /exec\s*\(\s*['"]\s*system/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'System shell from code',
+    },
+    {
+        regex: /python\s+-c\s+["']import\s+os;os\.system/i,
+        severity: 'high',
+        category: 'Code Injection',
+        description: 'Python shell injection',
+    },
+    // Reverse shell forms:
+    //   nc -e /bin/bash 1.2.3.4 4444   (binary between -e and IP)
+    //   nc -e 1.2.3.4 4444             (IP directly after -e)
+    //   bash -i >& /dev/tcp/host/port  (bash builtin)
+    {
+        regex: /nc\s+-[eln]+(?:\s+\S+)?\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|bash\s+-i\s+>&\s*\/dev\/tcp/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Reverse shell attempt',
+    },
+    {
+        regex: /\bbase64\b.*\|.*(bash|sh)\b|\bbase64\b.*exec/i,
+        severity: 'critical',
+        category: 'Code Injection',
+        description: 'Base64-encoded code execution',
+    },
+    {
+        regex: /\$\(curl|subprocess\.run\(['"]curl/i,
+        severity: 'high',
+        category: 'Code Injection',
+        description: 'Command substitution with curl',
+    },
     // Supply Chain
-    { regex: /npm\s+install\s+[a-z0-9-]+[0-9]{4,}|pip\s+install\s+\w+\d{6,}/i, severity: 'high', category: 'Supply Chain', description: 'Suspicious package version pattern' },
-    { regex: /npm\s+install\s+--save\s+[a-z]{2}\.[a-z]{2}\.[a-z]{2}/i, severity: 'high', category: 'Supply Chain', description: 'Typosquatting package pattern' },
-    { regex: /preinstall|postinstall|prepare/i, severity: 'medium', category: 'Supply Chain', description: 'Lifecycle script reference' },
-    { regex: /registry\.npmjs\.org\/[^/]+\/-\/[^/]+\.tgz.*;\s*bash/i, severity: 'critical', category: 'Supply Chain', description: 'Direct npm tarball execution' },
+    {
+        regex: /npm\s+install\s+[a-z0-9-]+[0-9]{4,}|pip\s+install\s+\w+\d{6,}/i,
+        severity: 'high',
+        category: 'Supply Chain',
+        description: 'Suspicious package version pattern',
+    },
+    {
+        regex: /npm\s+install\s+--save\s+[a-z]{2}\.[a-z]{2}\.[a-z]{2}/i,
+        severity: 'high',
+        category: 'Supply Chain',
+        description: 'Typosquatting package pattern',
+    },
+    {
+        regex: /preinstall|postinstall|prepare/i,
+        severity: 'medium',
+        category: 'Supply Chain',
+        description: 'Lifecycle script reference',
+    },
+    {
+        regex: /registry\.npmjs\.org\/[^/]+\/-\/[^/]+\.tgz.*;\s*bash/i,
+        severity: 'critical',
+        category: 'Supply Chain',
+        description: 'Direct npm tarball execution',
+    },
     // OWASP / Security Misconfig
-    { regex: /Access-Control-Allow-Origin:\s*\*/i, severity: 'medium', category: 'OWASP', description: 'Wildcard CORS header' },
-    { regex: /verify\s*=\s*False|ssl_verify\s*=\s*False|checkCertificate\s*=\s*false/i, severity: 'high', category: 'OWASP', description: 'SSL certificate verification disabled' },
-    { regex: /password\s*=\s*["'][^"']{0,16}["']|secret\s*=\s*["'][^"']{0,16}["']/i, severity: 'medium', category: 'OWASP', description: 'Hardcoded credential' },
-    { regex: /eval\s*\([^)]*user|innerHTML\s*=\s*[^;]*user|document\.write\s*\([^)]*user/i, severity: 'high', category: 'OWASP', description: 'Potential XSS via user input' },
-    { regex: /SELECT\s+\*?\s+FROM\s+\w+\s+WHERE.*['"]\s*\+|query\s*\+\s*user/i, severity: 'critical', category: 'OWASP', description: 'SQL injection pattern' },
+    {
+        regex: /Access-Control-Allow-Origin:\s*\*/i,
+        severity: 'medium',
+        category: 'OWASP',
+        description: 'Wildcard CORS header',
+    },
+    {
+        regex: /verify\s*=\s*False|ssl_verify\s*=\s*False|checkCertificate\s*=\s*false/i,
+        severity: 'high',
+        category: 'OWASP',
+        description: 'SSL certificate verification disabled',
+    },
+    {
+        regex: /password\s*=\s*["'][^"']{0,16}["']|secret\s*=\s*["'][^"']{0,16}["']/i,
+        severity: 'medium',
+        category: 'OWASP',
+        description: 'Hardcoded credential',
+    },
+    {
+        regex: /eval\s*\([^)]*user|innerHTML\s*=\s*[^;]*user|document\.write\s*\([^)]*user/i,
+        severity: 'high',
+        category: 'OWASP',
+        description: 'Potential XSS via user input',
+    },
+    {
+        regex: /SELECT\s+\*?\s+FROM\s+\w+\s+WHERE.*['"]\s*\+|query\s*\+\s*user/i,
+        severity: 'critical',
+        category: 'OWASP',
+        description: 'SQL injection pattern',
+    },
     // Data Exfiltration
-    { regex: /curl\s+.*-d\s+@\/|curl\s+.*--data-binary\s+@\//i, severity: 'high', category: 'Data Exfiltration', description: 'File upload via curl' },
-    { regex: /scp\s+.*@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/i, severity: 'high', category: 'Data Exfiltration', description: 'SCP to external IP' },
-    { regex: /rclone\s+copy|rsync\s+-av?[rpz]+\s+\/\w+.*@/i, severity: 'medium', category: 'Data Exfiltration', description: 'Mass file sync to remote' },
+    {
+        regex: /curl\s+.*-d\s+@\/|curl\s+.*--data-binary\s+@\//i,
+        severity: 'high',
+        category: 'Data Exfiltration',
+        description: 'File upload via curl',
+    },
+    {
+        regex: /scp\s+.*@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/i,
+        severity: 'high',
+        category: 'Data Exfiltration',
+        description: 'SCP to external IP',
+    },
+    {
+        regex: /rclone\s+copy|rsync\s+-av?[rpz]+\s+\/\w+.*@/i,
+        severity: 'medium',
+        category: 'Data Exfiltration',
+        description: 'Mass file sync to remote',
+    },
 ];
 // ── Risk scoring ────────────────────────────────────────────────────────────
 const SEVERITY_SCORES = {
@@ -112,16 +383,17 @@ export function calculateRiskScore(findings) {
     return Math.min(100, score);
 }
 // ── Audit log ───────────────────────────────────────────────────────────────
-const AUDIT_DIR = join(homedir(), '.codehere', 'audit');
-export const AUDIT_FILE = join(AUDIT_DIR, 'hook-events.jsonl');
-function ensureAuditDir() {
-    if (!existsSync(AUDIT_DIR)) {
-        mkdirSync(AUDIT_DIR, { recursive: true });
-    }
-}
+/**
+ * Audit log path — defaults to ~/.codehere/audit/hook-events.jsonl.
+ * Override at process start with CODEHERE_AUDIT_FILE env var (used by tests, optional for users).
+ */
+export const AUDIT_FILE = process.env.CODEHERE_AUDIT_FILE || join(homedir(), '.codehere', 'audit', 'hook-events.jsonl');
 export function appendAuditLog(entry) {
     try {
-        ensureAuditDir();
+        const dir = AUDIT_FILE.substring(0, AUDIT_FILE.lastIndexOf('/'));
+        if (dir && !existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
         appendFileSync(AUDIT_FILE, JSON.stringify(entry) + '\n');
     }
     catch {
@@ -145,10 +417,14 @@ export function appendAuditLog(entry) {
  *   not execution — strip the search term so pattern strings in args don't
  *   trigger the scanner.
  *
- * Write / Edit / MultiEdit: the content is data being written to disk,
- *   not executed. Only scan the file path (destination) and, for Edit,
- *   the old_string (what we're matching). Never scan new_string / content
- *   — that would block writing security documentation, test fixtures, etc.
+ * Write / Edit / MultiEdit: the content is DATA being written to disk, not
+ *   a command being executed. Only scan the file path (destination) — that's
+ *   enough to catch writes to sensitive files (~/.ssh/id_rsa, ~/.aws/credentials).
+ *   Do NOT scan content: it produces false positives on legitimate source code
+ *   that mentions attack-shaped strings (i18n with "system prompt", README docs
+ *   describing what we block, LLM-prompt-engineering code, security tests).
+ *   The Bash surface is the right place to catch prompt-injection / code-injection
+ *   patterns; Edit-time content is data, not execution intent.
  */
 function buildScanPayload(toolName, toolInput) {
     if (toolName === 'Bash') {
@@ -166,11 +442,11 @@ function buildScanPayload(toolName, toolInput) {
         return JSON.stringify({ file_path: toolInput.file_path ?? '' });
     }
     if (toolName === 'Edit') {
-        // Scan destination path + old_string (the selector), not new_string (the replacement)
-        return JSON.stringify({
-            file_path: toolInput.file_path ?? '',
-            old_string: toolInput.old_string ?? '',
-        });
+        // Same model as Write: scan only the destination. The old_string is
+        // EXISTING file content (data), not execution intent — scanning it
+        // produced false positives on legitimate edits to files containing
+        // attack-shaped strings (e.g. i18n.js with a "system prompt" key).
+        return JSON.stringify({ file_path: toolInput.file_path ?? '' });
     }
     if (toolName === 'MultiEdit') {
         // Scan file paths only
@@ -181,7 +457,7 @@ function buildScanPayload(toolName, toolInput) {
     return JSON.stringify(toolInput);
 }
 export function processHookEvent(event) {
-    const { hook_event_name, tool_name = 'unknown', tool_input = {}, session_id = 'unknown', } = event;
+    const { hook_event_name, tool_name = 'unknown', tool_input = {}, session_id = 'unknown' } = event;
     // Only intercept PreToolUse events
     if (hook_event_name !== 'PreToolUse') {
         return null;
@@ -191,7 +467,7 @@ export function processHookEvent(event) {
     // Layer 0 scan — local, no API, ~2ms
     const findings = scanPayload(payload);
     const riskScore = calculateRiskScore(findings);
-    const criticalFindings = findings.filter(f => f.severity === 'critical');
+    const criticalFindings = findings.filter((f) => f.severity === 'critical');
     // Blocking threshold: critical finding OR risk score too high
     const blocked = criticalFindings.length > 0 || riskScore >= 60;
     // Build audit entry
@@ -213,12 +489,12 @@ export function processHookEvent(event) {
     const topFinding = criticalFindings[0] ?? findings[0];
     const categoryVoice = {
         'Prompt Injection': 'Caught a prompt injection attempt',
-        'Credential Theft': 'Stopped — this looks like it\'s trying to access credentials',
-        'Destructive': 'Stopped — this could delete or destroy data',
+        'Credential Theft': "Stopped — this looks like it's trying to access credentials",
+        Destructive: 'Stopped — this could delete or destroy data',
         'Code Injection': 'Blocked — this pattern looks like code injection',
         'Supply Chain': 'Blocked — suspicious package or dependency pattern',
-        'OWASP': 'Blocked — security misconfiguration pattern',
-        'Data Exfiltration': 'Blocked — this looks like it\'s trying to send data out',
+        OWASP: 'Blocked — security misconfiguration pattern',
+        'Data Exfiltration': "Blocked — this looks like it's trying to send data out",
     };
     const reason = topFinding
         ? `[codehere] ${categoryVoice[topFinding.category] ?? 'Blocked'} — ${topFinding.description}. (matched: "${topFinding.matched}")`

package/dist/infrastructure/observability/execution-tracer.js

@@ -76,11 +76,13 @@ export class ExecutionTracer {
             duration: operation.duration,
             input: this.sanitizeInput(operation.input),
             output: this.sanitizeOutput(operation.output),
-            error: operation.error ? {
-                message: operation.error.message,
-                stack: operation.error.stack,
-                code: operation.error.code,
-            } : undefined,
+            error: operation.error
+                ? {
+                    message: operation.error.message,
+                    stack: operation.error.stack,
+                    code: operation.error.code,
+                }
+                : undefined,
             metadata: operation.metadata,
         };
         this.currentRun.traces.push(trace);
@@ -191,7 +193,10 @@ export class ExecutionTracer {
         // Limit size and remove sensitive fields
         const sanitized = JSON.parse(JSON.stringify(input, (key, value) => {
             // Remove API keys and secrets
-            if (typeof key === 'string' && (key.toLowerCase().includes('key') || key.toLowerCase().includes('secret') || key.toLowerCase().includes('password'))) {
+            if (typeof key === 'string' &&
+                (key.toLowerCase().includes('key') ||
+                    key.toLowerCase().includes('secret') ||
+                    key.toLowerCase().includes('password'))) {
                 return '[REDACTED]';
             }
             // Limit string length

package/dist/infrastructure/orchestration/agent-adapter.js

@@ -0,0 +1,13 @@
+/**
+ * AgentAdapter — F2 foundation.
+ *
+ * Uniform interface over every AI coding agent codehere can spawn and manage.
+ * One adapter per backend: ClaudeCodeAdapter, CodexAdapter, AiderAdapter, …
+ *
+ * The interface intentionally carries **optional fields for later PM-UX layers**
+ * so we don't force a breaking change when v0.4/v0.5 ship progress roll-up,
+ * final report, intervention, and project scope. Unused today, ignored by the
+ * current renderer. See memory/project_manager_ux_v1.md for the full shape.
+ */
+export {};
+//# sourceMappingURL=agent-adapter.js.map