codehere 0.4.1 → 0.5.0-alpha.2

package/dist/presentation/cli/commands/protocols-builder.js

@@ -0,0 +1,254 @@
+/**
+ * F3 Task 7 — protocols/hook_patterns.json exporter.
+ *
+ * Reads the trust-scorer's CODE_PATTERNS bank (the in-code TypeScript
+ * source of truth for the safety hook's pattern matchers) and exports it
+ * to .codehere/protocols/hook_patterns.json so the patterns are:
+ *
+ *   - inspectable     (auditors, security reviewers can read the JSON)
+ *   - version-controllable (the file lives in the repo)
+ *   - shareable       (cross-tool: e.g. PR our patterns into the
+ *                      agentic-stack ecosystem per ADR-006)
+ *   - extensible      (project-specific patterns under `patterns_project[]`
+ *                      survive re-exports)
+ *
+ * Schema split (regenerable / preserved):
+ *   patterns_builtin[]  — regenerated from CODE_PATTERNS on each export
+ *   patterns_project[]  — user-edited; preserved across re-exports
+ *
+ * Each pattern is identified by a stable `id` slugified from category +
+ * description. Same code → same id, so users can reference patterns
+ * deterministically (e.g. "ignore the `secrets-hardcoded-credential`
+ * pattern in this folder").
+ *
+ * Forward-compatibility: regex is serialized as a JSON-portable string
+ * (no special characters that would break JSON parsing); the flags are
+ * a separate field. This avoids the JSON-vs-RegExp impedance mismatch.
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { join, dirname } from 'path';
+import { CODE_PATTERNS } from '../../../infrastructure/security/trust-scorer.js';
+/**
+ * Slugify category + description into a stable id.
+ *
+ *   "Secrets" + "Hardcoded credential" → "secrets-hardcoded-credential"
+ *   "SQL Injection" + "String interpolation in SQL query" → "sql-injection-string-interpolation-in-sql-query"
+ *
+ * Stability matters: re-exports must produce the same id from the same
+ * source. Cite this slug in test fixtures, downstream tools, project
+ * overrides etc.
+ */
+function slugifyPatternId(category, description) {
+    return (category + ' ' + description)
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+/**
+ * Serialize a JS RegExp to a JSON-portable {regex, flags} pair.
+ * `regex` is the source string (without surrounding `/`); `flags` is the
+ * flags string ('gi' etc.).
+ */
+function serializeRegex(re) {
+    return { regex: re.source, flags: re.flags };
+}
+/**
+ * Assign stable, source-order-independent ids to a list of patterns.
+ *
+ * The sort key is (category, description, regex.source) — a 3-tier
+ * comparator. The first two tiers come from K2 Round 1 (sort by
+ * category + description so duplicates get deterministic suffix
+ * assignment). The 3rd tier (regex source) is the codex Round 2 fix:
+ * (category, description) alone leaves stable-sort fall-through to
+ * source order when two patterns share both fields, which means
+ * reordering CODE_PATTERNS would still flip which one gets the base id
+ * vs `-2`. Adding regex.source disambiguates definitively — two patterns
+ * with identical category + description + regex are the SAME pattern;
+ * they can't both exist.
+ *
+ * Returns a new sorted array with `id` attached. Pure; safe to test
+ * with arbitrary fixtures.
+ */
+export function assignStableIds(patterns) {
+    const sorted = [...patterns].sort((a, b) => {
+        const c = a.category.localeCompare(b.category);
+        if (c !== 0)
+            return c;
+        const d = a.description.localeCompare(b.description);
+        if (d !== 0)
+            return d;
+        return a.regex.source.localeCompare(b.regex.source);
+    });
+    const seenIds = new Map();
+    return sorted.map((p) => {
+        const baseId = slugifyPatternId(p.category, p.description);
+        const seen = seenIds.get(baseId) ?? 0;
+        seenIds.set(baseId, seen + 1);
+        const id = seen === 0 ? baseId : `${baseId}-${seen + 1}`;
+        return { ...p, id };
+    });
+}
+/**
+ * Build the export object from CODE_PATTERNS. Pure — does not touch disk.
+ *
+ * Delegates id assignment to `assignStableIds` so the source-order-
+ * independence property has a direct unit test (see protocols-export.test.ts).
+ */
+export function buildHookPatternsExport() {
+    const withIds = assignStableIds(CODE_PATTERNS);
+    const builtin = withIds.map((p) => {
+        const { regex, flags } = serializeRegex(p.regex);
+        const out = {
+            id: p.id,
+            regex,
+            regex_flags: flags,
+            severity: p.severity,
+            category: p.category,
+            description: p.description,
+        };
+        if (p.cwe)
+            out.cwe = p.cwe;
+        if (p.scanRaw)
+            out.scanRaw = p.scanRaw;
+        if (p.requiresContext) {
+            const ctx = serializeRegex(p.requiresContext);
+            out.requiresContext = { regex: ctx.regex, flags: ctx.flags };
+        }
+        return out;
+    });
+    return {
+        version: 'v0.5',
+        generatedAt: new Date().toISOString(),
+        source: 'agent/src/infrastructure/security/trust-scorer.ts',
+        _note: "Exported from codehere's trust-scorer pattern bank via 'codehere protocols export'. " +
+            "DO NOT hand-edit `patterns_builtin[]` — it's regenerated on every export. " +
+            "Add project-specific patterns to `patterns_project[]` — those are preserved across re-exports. " +
+            "Pattern ids are stable slugs of category + description; reference them deterministically.",
+        patterns_builtin: builtin,
+        patterns_project: [],
+    };
+}
+/**
+ * Detect whether the on-disk file is the init-time placeholder.
+ *
+ * Two placeholder shapes are recognized:
+ *
+ *   1. POST-2026-04-28 seed (current init) — split schema, empty arrays:
+ *      { version, patterns_builtin: [], patterns_project: [], _note }
+ *
+ *   2. PRE-2026-04-28 seed (legacy init) — single empty `patterns` array:
+ *      { version, patterns: [], _note }
+ *
+ * Either one is safe to overwrite without --force. A NON-empty legacy
+ * `patterns` array is NOT a placeholder — see `extractLegacyProjectPatterns`
+ * below which migrates user content into `patterns_project[]` rather than
+ * silently discarding it (codex Round 1 fix — the legacy seed's _note
+ * explicitly told users to add patterns to the legacy field, so users may
+ * have followed that guidance).
+ */
+function isInitPlaceholder(parsed) {
+    if (typeof parsed !== 'object' || parsed === null)
+        return false;
+    const obj = parsed;
+    // Current shape: split schema, both arrays empty.
+    if (Array.isArray(obj.patterns_builtin) &&
+        obj.patterns_builtin.length === 0 &&
+        Array.isArray(obj.patterns_project) &&
+        obj.patterns_project.length === 0) {
+        return true;
+    }
+    // Legacy shape: single empty `patterns` array, no _builtin/_project.
+    if (Array.isArray(obj.patterns) &&
+        obj.patterns.length === 0 &&
+        obj.patterns_builtin === undefined &&
+        obj.patterns_project === undefined) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Extract user-added patterns from the LEGACY `patterns[]` field, if any.
+ * Used to migrate non-empty legacy files into `patterns_project[]` so users
+ * who followed the legacy seed's _note advice ("add patterns to `patterns`")
+ * don't lose their work on first export (codex Round 1 fix).
+ *
+ * Returns `null` if the file isn't a legacy-shape file with non-empty
+ * patterns; callers fall through to the normal --rebuild path which reads
+ * `patterns_project[]` directly.
+ */
+function extractLegacyProjectPatterns(parsed) {
+    if (typeof parsed !== 'object' || parsed === null)
+        return null;
+    const obj = parsed;
+    if (Array.isArray(obj.patterns) &&
+        obj.patterns.length > 0 &&
+        obj.patterns_builtin === undefined &&
+        obj.patterns_project === undefined) {
+        return obj.patterns;
+    }
+    return null;
+}
+/**
+ * Disk-side wrapper: build + write to .codehere/protocols/hook_patterns.json.
+ *
+ * If the existing file is the init-time placeholder, overwrite without
+ * requiring --rebuild. Otherwise:
+ *   - existing file present + no --rebuild → 'exists' (refuse)
+ *   - existing file present + --rebuild → preserve patterns_project[],
+ *                                          regenerate patterns_builtin[]
+ *   - no existing file → write fresh
+ */
+export function writeHookPatternsExport(codehereDir, options = {}) {
+    const targetPath = join(codehereDir, 'protocols/hook_patterns.json');
+    let preservedProject = [];
+    if (existsSync(targetPath)) {
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(targetPath, 'utf8'));
+        }
+        catch {
+            return { result: 'failed', path: targetPath, error: 'existing file is not valid JSON' };
+        }
+        // Codex Round 1 fix: migrate non-empty legacy `patterns[]` content into
+        // `patterns_project[]` BEFORE the placeholder/rebuild branches. The
+        // legacy init seed's _note told users to add patterns to the legacy
+        // field; a fresh export must preserve any content they added rather
+        // than silently discard it.
+        const legacy = extractLegacyProjectPatterns(parsed);
+        if (legacy !== null) {
+            preservedProject = legacy;
+            // Fall through to writing — we treat a non-empty-legacy file as
+            // overwriteable (the legacy patterns now live in preservedProject).
+        }
+        else if (isInitPlaceholder(parsed)) {
+            // Empty placeholder (either schema shape) — overwrite without --rebuild.
+        }
+        else if (!options.rebuild) {
+            return { result: 'exists', path: targetPath };
+        }
+        else {
+            // --rebuild + non-placeholder, non-legacy existing file → preserve
+            // patterns_project[].
+            const obj = parsed;
+            if (Array.isArray(obj.patterns_project)) {
+                preservedProject = obj.patterns_project;
+            }
+        }
+    }
+    const built = buildHookPatternsExport();
+    built.patterns_project = preservedProject;
+    try {
+        mkdirSync(dirname(targetPath), { recursive: true });
+        writeFileSync(targetPath, JSON.stringify(built, null, 2) + '\n');
+    }
+    catch (e) {
+        return { result: 'failed', path: targetPath, error: e instanceof Error ? e.message : String(e) };
+    }
+    return {
+        result: 'exported',
+        path: targetPath,
+        builtinCount: built.patterns_builtin.length,
+        projectCount: built.patterns_project.length,
+    };
+}
+//# sourceMappingURL=protocols-builder.js.map

package/dist/presentation/cli/commands/protocols-command.js

@@ -0,0 +1,84 @@
+/**
+ * Protocols Command — F3 v0.5 protocols layer operations.
+ *
+ * Today: `codehere protocols export` writes the trust-scorer's pattern
+ * bank to .codehere/protocols/hook_patterns.json. Future: `protocols
+ * import`, `protocols verify`, `protocols diff` etc.
+ *
+ * The dispatch shape mirrors `memory-command.ts` so future actions slot
+ * in without touching index.ts beyond a single .option() addition.
+ */
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { colors, success, info, error, newline } from '../../../ui.js';
+import { findCodebaseRoot } from '../../../domain/services/codebase-detector.js';
+import { writeHookPatternsExport } from './protocols-builder.js';
+function executeProtocolsExport(options) {
+    const codeInfo = findCodebaseRoot();
+    const root = codeInfo?.rootPath ?? process.cwd();
+    const codehereDir = join(root, '.codehere');
+    newline();
+    console.log(colors.bold('codehere protocols export'));
+    console.log(colors.dim(`  exporting trust-scorer pattern bank → ${codehereDir}/protocols/hook_patterns.json`));
+    newline();
+    if (!existsSync(codehereDir)) {
+        console.log(`  ${error('refused')} .codehere/ not found at this root.`);
+        console.log(`  ${colors.dim('Run')} ${colors.cyan('codehere init')} ${colors.dim('first.')}`);
+        newline();
+        process.exitCode = 1;
+        return;
+    }
+    const result = writeHookPatternsExport(codehereDir, { rebuild: !!options.rebuild });
+    switch (result.result) {
+        case 'exported': {
+            const projectNote = result.projectCount && result.projectCount > 0
+                ? ` · ${result.projectCount} project pattern${result.projectCount === 1 ? '' : 's'} preserved`
+                : '';
+            console.log(`  ${success('exported')} ${result.path}  ${colors.dim(`(${result.builtinCount} built-in patterns${projectNote})`)}`);
+            break;
+        }
+        case 'exists':
+            console.log(`  ${info('exists  ')} ${result.path}  ${colors.dim('(use --rebuild to refresh built-in patterns; project patterns are preserved)')}`);
+            break;
+        case 'failed':
+            console.log(`  ${error('failed  ')} ${result.path}  ${colors.dim(`(${result.error})`)}`);
+            process.exitCode = 1;
+            break;
+    }
+    newline();
+    console.log(colors.bold('Next:'));
+    console.log(`  - Inspect ${colors.cyan('.codehere/protocols/hook_patterns.json')} to see what the safety hook matches`);
+    console.log(`  - Add project-specific patterns under ${colors.cyan('patterns_project[]')} — they survive re-exports`);
+    console.log(`  ${colors.dim('(Edit patterns_builtin[] is a no-op — re-exports overwrite it from trust-scorer.ts.)')}`);
+    newline();
+}
+export function executeProtocolsCommand(action, options = {}) {
+    try {
+        switch (action) {
+            case 'export':
+                executeProtocolsExport(options);
+                return;
+            case undefined:
+            case 'help':
+                console.log(`
+codehere protocols <action> — F3 protocols layer operations
+
+  export    Export trust-scorer pattern bank to .codehere/protocols/hook_patterns.json
+
+Coming later:
+  import    Apply patterns from a file (cross-tool ingestion)
+  verify    Check that the on-disk file matches the in-code pattern bank
+`);
+                return;
+            default:
+                console.error(`\n  ${error('failed')} unknown protocols action: ${action}\n  Try: codehere protocols help\n`);
+                process.exitCode = 1;
+        }
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.error(`\n  ${error('failed')} codehere protocols ${action ?? ''} — ${msg}\n`);
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=protocols-command.js.map

package/dist/presentation/cli/commands/repo-map-builder.js

@@ -0,0 +1,247 @@
+/**
+ * F3 Task 4 — repo_map.json builder (v0.5 TS-native MVP).
+ *
+ * v0.5 SCOPE:
+ *   - Walks `git ls-files` (respects .gitignore via git itself).
+ *   - For .ts/.tsx/.js/.jsx/.py files, regex-extracts top-level public-surface
+ *     symbols (export function/class/const/interface/type, def/class for Python).
+ *   - Reference count via `git grep -c` per symbol name.
+ *   - Writes JSON to .codehere/memory/episodic/repo_map.json.
+ *
+ * v0.6 PLAN:
+ *   - Replace the regex extractor with proper tree-sitter parsing
+ *     (Aider's repomap.py MIT port — Python helper + TS shell-out, OR
+ *     a TS-native tree-sitter library evaluation).
+ *   - Add PageRank-style symbol importance (currently raw reference count).
+ *   - Incremental rebuild via the per-file `hash` field already in the schema.
+ *
+ * Schema is forward-compatible — only the extractor implementation changes.
+ *
+ * Why regex MVP for v0.5:
+ *   - Zero new deps (tree-sitter would mean Python + 5 packages OR a 30+ MB
+ *     TS dep). codehere is bootstrap-zero-cost; every dep is friction.
+ *   - Closes the F3 episodic/repo_map.json layer enough for spawned agents
+ *     to read it as a starting context block.
+ *   - Honest about limitations — see schema._note in the output JSON.
+ */
+import { spawnSync } from 'child_process';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'fs';
+import { createHash } from 'crypto';
+import { join, dirname, extname } from 'path';
+const SUPPORTED_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.py']);
+/**
+ * Per-language extractors. v0.5 regex-based — line-anchored to avoid
+ * matching identifiers inside string literals. Returns 1-indexed line numbers.
+ *
+ * v0.6 will swap these for AST-based extractors. The interface stays the
+ * same: (body) → RepoMapSymbol[].
+ */
+function extractTsLikeSymbols(body) {
+    const lines = body.split('\n');
+    const symbols = [];
+    // export function NAME(  | export async function NAME(
+    // export class NAME
+    // export const NAME = | export let NAME = | export var NAME =
+    // export interface NAME { | export type NAME =
+    const PATTERNS = [
+        [/^export\s+(?:async\s+)?function\s+(\w+)\s*[<(]/, 'function'],
+        [/^export\s+(?:abstract\s+)?class\s+(\w+)/, 'class'],
+        [/^export\s+(?:const|let|var)\s+(\w+)\s*[:=]/, 'const'],
+        [/^export\s+interface\s+(\w+)/, 'interface'],
+        [/^export\s+type\s+(\w+)\s*=/, 'type'],
+        [/^export\s+enum\s+(\w+)/, 'enum'],
+    ];
+    for (let i = 0; i < lines.length; i++) {
+        for (const [re, kind] of PATTERNS) {
+            const m = lines[i].match(re);
+            if (m) {
+                symbols.push({ kind, name: m[1], line: i + 1 });
+                break;
+            }
+        }
+    }
+    return symbols;
+}
+function extractPythonSymbols(body) {
+    const lines = body.split('\n');
+    const symbols = [];
+    // Top-level (column 0) def NAME(  | class NAME(  | class NAME:
+    const PATTERNS = [
+        [/^def\s+(\w+)\s*\(/, 'def'],
+        [/^class\s+(\w+)\s*[(:]/, 'class'],
+    ];
+    for (let i = 0; i < lines.length; i++) {
+        for (const [re, kind] of PATTERNS) {
+            const m = lines[i].match(re);
+            if (m) {
+                symbols.push({ kind, name: m[1], line: i + 1 });
+                break;
+            }
+        }
+    }
+    return symbols;
+}
+function extractSymbols(filePath, body) {
+    const ext = extname(filePath);
+    if (ext === '.py')
+        return extractPythonSymbols(body);
+    if (SUPPORTED_EXTENSIONS.has(ext))
+        return extractTsLikeSymbols(body);
+    return [];
+}
+/**
+ * Hash file content for incremental-rebuild support in v0.6.
+ * Format: `sha256:<64-hex>` so the algorithm is self-describing.
+ */
+function hashContent(body) {
+    return 'sha256:' + createHash('sha256').update(body).digest('hex');
+}
+/**
+ * `git ls-files` returns paths relative to the repo root. Filters out
+ * non-supported extensions in one pass. If `git` isn't a repo, returns null
+ * so the caller can refuse with a clear message.
+ */
+function gitListFiles(repoRoot) {
+    const r = spawnSync('git', ['ls-files', '-z'], { cwd: repoRoot, encoding: 'utf-8' });
+    if (r.status !== 0)
+        return null;
+    return r.stdout
+        .split('\0')
+        .filter(p => p.length > 0)
+        .filter(p => SUPPORTED_EXTENSIONS.has(extname(p)));
+}
+/**
+ * Count references to a symbol name across the repo via git grep.
+ * `-c` returns "<file>:<count>" per matching file; sum the counts.
+ *
+ * Uses word-boundary regex so `popular` doesn't match `unpopular`. The grep
+ * finds DEFINITIONS too, so subtract the definition count to get pure refs.
+ */
+function countReferences(repoRoot, symbolName) {
+    // -F = fixed string, -w = word boundary. Combined with grep itself.
+    const r = spawnSync('git', ['grep', '-c', '-w', '-F', '--', symbolName], { cwd: repoRoot, encoding: 'utf-8' });
+    if (r.status !== 0 && r.status !== 1)
+        return 0;
+    let total = 0;
+    for (const line of r.stdout.split('\n')) {
+        const m = line.match(/:(\d+)$/);
+        if (m)
+            total += parseInt(m[1], 10);
+    }
+    // Subtract 1 for the definition line itself (best-effort — undercounts if
+    // the symbol is defined in multiple files; v0.6 with AST will be accurate).
+    return Math.max(0, total - 1);
+}
+/**
+ * Build the repo_map for the repo at `repoRoot`. Returns the JSON object —
+ * caller writes to disk. Pure-ish (still spawns git), no codehere-specific
+ * paths inside.
+ *
+ * The `_stats` block in the returned RepoMap persists to disk so downstream
+ * agents know whether the map is incomplete (e.g. >1MB files skipped during
+ * walk).
+ */
+export function buildRepoMap(repoRoot) {
+    if (!existsSync(join(repoRoot, '.git'))) {
+        return { error: 'not a git repo (run `git init` first)' };
+    }
+    const files = gitListFiles(repoRoot);
+    if (files === null) {
+        return { error: 'git ls-files failed' };
+    }
+    const fileMap = {};
+    const allSymbols = [];
+    let skippedLargeFiles = 0;
+    for (const rel of files) {
+        const abs = join(repoRoot, rel);
+        // Skip giant files (>1MB) — surfaced in the result so users see the count.
+        try {
+            if (statSync(abs).size > 1_000_000) {
+                skippedLargeFiles++;
+                continue;
+            }
+        }
+        catch {
+            continue;
+        }
+        let body;
+        try {
+            body = readFileSync(abs, 'utf-8');
+        }
+        catch {
+            // File deleted between ls-files and read — skip.
+            continue;
+        }
+        const symbols = extractSymbols(rel, body);
+        fileMap[rel] = {
+            hash: hashContent(body),
+            symbols,
+        };
+        for (const s of symbols) {
+            allSymbols.push({ name: s.name, file: rel, line: s.line });
+        }
+    }
+    // Rank by reference count.
+    //
+    // codex Round 1 fix: the previous version applied .slice(0, 200) BEFORE
+    // grepping, which meant "first 200 discovered names" not "top 200
+    // candidates." Symbols defined in files traversed late silently got
+    // references=0 and dropped out of topSymbols, regardless of how heavily
+    // they were referenced. Now we grep ALL unique names. O(N) git greps is
+    // acceptable for v0.5 — codehere's own 249-symbol repo runs in ~5s.
+    // v0.6's tree-sitter port will swap raw grep for AST-aware reference
+    // resolution + PageRank, which is faster AND more accurate.
+    const uniqueNames = Array.from(new Set(allSymbols.map(s => s.name)));
+    const refCounts = new Map();
+    for (const name of uniqueNames) {
+        refCounts.set(name, countReferences(repoRoot, name));
+    }
+    const topSymbols = allSymbols
+        .map(s => ({ ...s, references: refCounts.get(s.name) ?? 0 }))
+        // Stable sort: references DESC, then name ASC for tie-breaking.
+        .sort((a, b) => b.references - a.references || a.name.localeCompare(b.name))
+        .slice(0, 50);
+    return {
+        version: 'v0.5',
+        generatedAt: new Date().toISOString(),
+        rootPath: repoRoot,
+        _note: 'TS-native regex MVP — KNOWN MISSES (v0.5, addressed in v0.6 tree-sitter port): ' +
+            '`export default function/class` (no name on the export line), ' +
+            '`export { foo, bar }` blocks, `export { foo } from "..."` re-exports, ' +
+            '`export * from "..."` star re-exports, multi-line `export { ... }` blocks, ' +
+            '`export declare`, CommonJS `module.exports` / `exports.X` assignments, ' +
+            'symbols not at column 0 in Python. Reference counts via word-bounded ' +
+            'git grep undercount when a name is defined in multiple files. ' +
+            'Read `_stats.skippedLargeFiles` to detect files left out of the walk.',
+        _stats: { skippedLargeFiles },
+        files: fileMap,
+        topSymbols,
+    };
+}
+/**
+ * Disk-side wrapper: build + write to .codehere/memory/episodic/repo_map.json.
+ *
+ * `_stats` is preserved in the on-disk JSON (codex Round 2 fix) so spawned
+ * agents reading the map can tell "no symbols in this file" from "this file
+ * was skipped during the walk." The CLI also surfaces it on the return value.
+ */
+export function writeRepoMap(repoRoot, codehereDir, options = {}) {
+    const targetPath = join(codehereDir, 'memory/episodic/repo_map.json');
+    if (existsSync(targetPath) && !options.rebuild) {
+        return { result: 'exists', path: targetPath };
+    }
+    const built = buildRepoMap(repoRoot);
+    if ('error' in built) {
+        return { result: 'failed', path: targetPath, error: built.error };
+    }
+    mkdirSync(dirname(targetPath), { recursive: true });
+    writeFileSync(targetPath, JSON.stringify(built, null, 2) + '\n');
+    return {
+        result: 'written',
+        path: targetPath,
+        fileCount: Object.keys(built.files).length,
+        symbolCount: Object.values(built.files).reduce((acc, f) => acc + f.symbols.length, 0),
+        skippedLargeFiles: built._stats.skippedLargeFiles,
+    };
+}
+//# sourceMappingURL=repo-map-builder.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "codehere",
-  "version": "0.4.1",
-  "description": "A PM for your AI coding agents. Delegate, orchestrate, and audit Claude Code, Codex, Aider, and OpenCode from one local web UI — every AI action traced, every file scored.",
+  "version": "0.5.0-alpha.2",
+  "description": "A PM for your AI coding agents. Delegate, orchestrate, and audit Claude Code, Codex, Aider, OpenCode, Gemini, and any user-configured CLI agent from one local web UI — every AI action traced, every file scored, every spawn warmed with project memory.",
   "main": "dist/index.js",
   "type": "module",
   "bin": {
@@ -29,7 +29,8 @@
     "lint": "eslint src/ --ext .ts",
     "format": "prettier --write 'src/**/*.ts' 'test/**/*.ts'",
     "format:check": "prettier --check 'src/**/*.ts' 'test/**/*.ts'",
-    "sbom": "npm sbom --sbom-format=spdx --omit=dev"
+    "sbom": "npm sbom --sbom-format=spdx --omit=dev",
+    "pretag:check": "../scripts/pretag-npm-check.sh"
   },
   "keywords": [
     "ai-coding-agents",