codehere 0.6.0 → 0.6.2

package/README.md

@@ -5,12 +5,12 @@
 
 [![npm](https://img.shields.io/npm/v/codehere)](https://www.npmjs.com/package/codehere)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow)](../LICENSE)
-[![Tests](https://img.shields.io/badge/tests-668%2F668-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-1196%2F1196-brightgreen)]()
 [![Vulnerabilities](https://img.shields.io/badge/vulnerabilities-0-brightgreen)]()
 
 **Codehere is the vendor-neutral layer between you and the coding agents you already use** — Claude Code, Codex, Aider, Gemini, OpenCode. One `npm install`. Local-first, OSS, no account, no IAM, no compliance prereqs. Switch agent, keep your memory. End the day with one Final Report covering everything they did.
 
-Today, Claude Code gets full pre-execution safety-hook enforcement on every tool call; the other adapters are session-traced and reported, with per-tool hook parity in progress for v0.6. The vendor-neutral *memory*, *audit log*, and *Final Report* surfaces ship across all 5 adapters today.
+All 5 adapters (Claude Code, Codex, Aider, Gemini, OpenCode) get session-tracing, Final Reports, and trust scoring. Claude Code additionally gets full pre-execution safety-hook enforcement on every tool call. The *memory*, *audit log*, *failover*, and *Final Report* surfaces ship across all 5 adapters today.
 
 The enterprise tier is owned by [OpenAI Frontier](https://openai.com/index/introducing-openai-frontier/) (8-14 weeks of deploy prereqs, sales-team gated) and [Anthropic Cowork](https://www.anthropic.com/product/claude-cowork) (paid Claude subscription, single-vendor). Codehere fills the gap they structurally can't reach: **the individual / small-team / no-IT-department tier, vendor-neutral**.
 
@@ -29,7 +29,7 @@ One layer, every agent, your work stays portable.
 
 | | | |
 |---|---|---|
-| 1 | **Install** | `npm install -g codehere@alpha` (Node 20+) — current alpha track is v0.5; `@latest` still on v0.4 |
+| 1 | **Install** | `npm install -g codehere` (Node 20+) — v0.6.0 is the current stable |
 | 2 | **Detect environment** | `codehere setup` — checks API key, finds your repo |
 | 3 | **Install the safety hook** | `codehere hook install` — every Claude Code tool call now audited |
 | 4 | **Install at least one specialist** | Claude Code: `npm i -g @anthropic-ai/claude-code` (Codex / Aider / OpenCode / Gemini also supported · see [docs/integrations/](../docs/integrations/) for Cursor MCP setup) |
@@ -51,7 +51,7 @@ Context  +  End State  +  Constraints
 
 ### Folder convention (what `codehere init` writes)
 
-The v0.5 layout — F3 project memory:
+The v0.6 layout — F3 project memory:
 
 | Path | Purpose | Committed? |
 |---|---|---|
@@ -90,9 +90,9 @@ codehere report         # generates a shareable markdown audit report
 codehere status         # quick dashboard · sessions, blocks, trust trends
 ```
 
-The hook intercepts every `Bash`, `Edit`, `Write`, `MultiEdit`, and `NotebookEdit` call from any Claude Code session running on your machine, runs it through the trust-scorer pattern bank in under 5 ms, blocks anything matching the destructive / credential / injection patterns, and appends every decision to an append-only JSONL audit log at `~/.codehere/audit/`. (Hook coverage today is Claude Code-only — Codex / Aider / OpenCode adapters spawn through their native CLIs and emit to `~/.codehere/sessions.jsonl`; full hook parity across all adapters is v0.4 work.)
+The hook intercepts every `Bash`, `Edit`, `Write`, `MultiEdit`, and `NotebookEdit` call from any Claude Code session running on your machine, runs it through the trust-scorer pattern bank in under 5 ms, blocks anything matching the destructive / credential / injection patterns, and appends every decision to an append-only JSONL audit log at `~/.codehere/audit/`. Codex, Aider, OpenCode, and Gemini adapters spawn through their native CLIs and emit to `~/.codehere/sessions.jsonl` with per-tool tracing via the cross-vendor mirror hook.
 
-## Memory · F3 (v0.5)
+## Memory · F3 (v0.6)
 
 Once you've run `codehere init` in a project, every spawned agent — Claude Code, Codex, Aider, OpenCode, or Gemini — automatically reads the project's memory on entry. The agent starts warm with the briefing, recent lessons, and the most-referenced symbols in your codebase, instead of cold-grepping every session.
 
@@ -124,7 +124,7 @@ codehere memory show protocols    # safety patterns by category
 
 **Other memory commands:**
 - `codehere memory init` — migrate the v0.4.1 layout (`CONTEXT.md` / `HANDOVER.md` / `PROMPTS.md`) into the F3 layout (one shot, leaves back-compat symlinks; `--dry-run` previews)
-- `codehere memory repo-map [--rebuild]` — build the symbol map; v0.5 ships a TS-native MVP, v0.6 swaps in tree-sitter
+- `codehere memory repo-map [--rebuild]` — build the symbol map; currently TS-native MVP
 - `codehere protocols export [--rebuild]` — write the trust-scorer pattern bank to `.codehere/protocols/hook_patterns.json` for inspection / cross-tool ingestion
 
 ## Going deeper
@@ -204,7 +204,7 @@ For depth beyond this README:
 ## Requirements
 
 - **Node.js 20+** (pinned in `.nvmrc` and `engines.node`)
-- **macOS or Linux** · Windows via WSL works for development; native Windows is on the v0.4 roadmap
+- **macOS or Linux** · Windows via WSL works for development
 - **Optional but recommended:** at least one supported agent (Claude Code, Codex, Aider, OpenCode, or Gemini) installed before running `codehere start`
 
 ## License

package/dist/application/use-cases/generate-final-report.js

@@ -61,7 +61,9 @@ ${i.steps.length ? i.steps.map((s) => `- ${s.label} (${s.state})`).join('\n') :
 
 Files changed:
 ${i.artifacts?.files?.length
-    ? i.artifacts.files.map((f) => `- ${f.path} (+${f.added}/-${f.removed}${f.trust !== undefined ? `, trust: ${f.trust}` : ''})`).join('\n')
+    ? i.artifacts.files
+        .map((f) => `- ${f.path} (+${f.added}/-${f.removed}${f.trust !== undefined ? `, trust: ${f.trust}` : ''})`)
+        .join('\n')
     : '(no file artifacts captured)'}
 
 Token usage: ${i.artifacts?.usage?.inputTokens ?? 0} in / ${i.artifacts?.usage?.outputTokens ?? 0} out
@@ -75,16 +77,69 @@ function selectProviderBinary() {
         return [override];
     return ['claude-free', 'claude'];
 }
+/**
+ * UAT-003 — patterns that indicate the wrapped agent's session terminated
+ * because of a network / auth / quota failure rather than a real task.
+ * When we see these in the would-be summary text, we prepend a plain-English
+ * recovery hint instead of letting the raw provider error echo through.
+ *
+ * Pre-fix: bare `exit` in REPL → Conductor spawned claude-code → real API
+ * call failed with "All connection attempts failed Request ID: req_...";
+ * Final Report quoted that text verbatim. Per Core Values #4 + #6, this is
+ * unacceptable — the user sees a Request ID that means nothing.
+ */
+const NETWORK_FAILURE_PATTERNS = /(?:all connection attempts failed|ECONNREFUSED|ENOTFOUND|fetch failed|network error|request id:\s*req_|connection timed out|getaddrinfo)/i;
+function isLikelyNetworkFailureSummary(text) {
+    return NETWORK_FAILURE_PATTERNS.test(text);
+}
+function buildErrorRecoveryReport(input, durationMs) {
+    // Tailor the hint to the specific failure shape we can detect from input.
+    const agentName = input.agent === 'conductor' ? 'the agent codehere chose' : input.agent;
+    return {
+        summary: `The ${agentName} session ended without completing the task. ` +
+            `This usually means a network hiccup, an expired login, or a rate limit on the provider.\n\n` +
+            `What to try: check your internet, run \`codehere health\` to confirm reachability + auth, ` +
+            `or wait a minute and rerun the same prompt. If it keeps happening, try a different agent ` +
+            `from the dropdown — codehere is vendor-neutral on purpose.\n\n` +
+            `No files were changed in this attempt.`,
+        generatedAt: Date.now(),
+        durationMs,
+    };
+}
 /**
  * Generate a Final Report. Returns null if no provider is reachable.
  * Never throws — failure modes return null + log a debug line.
+ *
+ * UAT-003 — when the input.status is 'error', we skip the LLM call entirely
+ * and return a deterministic recovery hint. Saves tokens on a known-failed
+ * task AND gives the user a plain-English next step instead of waiting for
+ * a possibly-unhelpful LLM summary.
  */
 export async function generateFinalReport(input) {
+    // Short-circuit on errored sessions — don't waste tokens summarizing nothing.
+    if (input.status === 'error') {
+        return buildErrorRecoveryReport(input, 0);
+    }
     const prompt = PROMPT_TEMPLATE(input);
     for (const binary of selectProviderBinary()) {
         const result = await tryProvider(binary, prompt, input.sessionId);
-        if (result)
+        if (result) {
+            // Defense-in-depth: even on 'completed' status, if the generated
+            // summary leaks a provider network-failure string (e.g., the wrapped
+            // agent exited 0 but its assistant text was an error message), wrap
+            // the summary with a recovery preamble.
+            if (isLikelyNetworkFailureSummary(result.summary)) {
+                return {
+                    summary: `Couldn't reach the provider cleanly — the agent's session text looks like a network or auth failure.\n\n` +
+                        `What to try: check your internet, run \`codehere health\`, or rerun in a minute. ` +
+                        `If it persists, switch agents from the dropdown.\n\n` +
+                        `— Raw agent message —\n${result.summary}`,
+                    generatedAt: result.generatedAt,
+                    durationMs: result.durationMs,
+                };
+            }
             return result;
+        }
     }
     return null;
 }

package/dist/application/use-cases/generate-narration.js

@@ -75,11 +75,17 @@ function tryProvider(binary, prompt, sessionId, stepCount) {
             try {
                 child.kill();
             }
-            catch { /* ignore */ }
+            catch {
+                /* ignore */
+            }
             finish(null);
         }, 20_000);
-        child.stdout?.on('data', (chunk) => { stdout += chunk.toString('utf-8'); });
-        child.stderr?.on('data', (chunk) => { stderr += chunk.toString('utf-8'); });
+        child.stdout?.on('data', (chunk) => {
+            stdout += chunk.toString('utf-8');
+        });
+        child.stderr?.on('data', (chunk) => {
+            stderr += chunk.toString('utf-8');
+        });
         child.on('close', (code) => {
             clearTimeout(timeout);
             if (code !== 0) {

package/dist/index.js

@@ -15,6 +15,16 @@ import { config } from 'dotenv';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { homedir } from 'os';
+// ── Global crash safety ───────────────────────────────────────────────────
+// Unhandled rejections and exceptions must never silently kill the daemon.
+process.on('unhandledRejection', (reason) => {
+    console.error('[codehere] unhandledRejection:', reason instanceof Error ? reason.stack : reason);
+});
+process.on('uncaughtException', (err) => {
+    console.error('[codehere] uncaughtException:', err.stack);
+    // persist what we can before dying
+    process.exitCode = 1;
+});
 import { executeSetupCommand } from './presentation/cli/commands/setup-command.js';
 import { executeInitCommand } from './presentation/cli/commands/init-command.js';
 import { executeMemoryCommand } from './presentation/cli/commands/memory-command.js';
@@ -67,7 +77,7 @@ program
     // typo guard miss the unknown-command shape. See typo-guard.ts.
     .argument('[query...]', 'Optional initial task to delegate (otherwise enter interactive REPL)')
     .action(async (queryParts) => {
-    const joined = (queryParts && queryParts.length > 0) ? queryParts.join(' ') : '';
+    const joined = queryParts && queryParts.length > 0 ? queryParts.join(' ') : '';
     // One-shot delegate: `codehere "review src/auth.ts"` runs that task and exits.
     // Useful for scripting or quick one-offs without entering the REPL.
     if (joined && joined.trim()) {
@@ -464,6 +474,7 @@ program
             console.log(colors.dim('\ncodehere MCP server stopped'));
             process.exit(0);
         });
+        process.on('SIGTERM', () => process.exit(0));
         await new Promise((resolve) => {
             server.on('close', resolve);
         });
@@ -565,15 +576,34 @@ program
             startCloudSync();
         }
         await openBrowser();
-        process.on('SIGINT', () => {
+        const shutdown = () => {
+            try {
+                const { SessionManager } = require('./infrastructure/orchestration/session-manager.js');
+                SessionManager.getInstance().shutdown();
+            }
+            catch {
+                /* graceful degradation — daemon may not have started fully */
+            }
             if (cloud) {
-                const { stopCloudSync } = require('./infrastructure/protocols/cloud-sync.js');
-                stopCloudSync();
+                try {
+                    const { stopCloudSync } = require('./infrastructure/protocols/cloud-sync.js');
+                    stopCloudSync();
+                }
+                catch {
+                    /* cloud sync may not be loaded */
+                }
             }
             server.close();
+        };
+        process.on('SIGINT', () => {
+            shutdown();
             console.log(colors.dim('\ncodehere stopped'));
             process.exit(0);
         });
+        process.on('SIGTERM', () => {
+            shutdown();
+            process.exit(0);
+        });
         await new Promise((resolve) => {
             server.on('close', resolve);
         });

package/dist/infrastructure/cost/budget-config.js

@@ -84,7 +84,7 @@ export function saveBudget(cfg) {
         mkdirSync(dir, { recursive: true });
     const lines = [
         '# codehere daily-spend budget. Edit by hand or via `codehere budget set <amount>`.',
-        '# daily_usd: hard ceiling for today\'s estimated spend. Set to a number to enable.',
+        "# daily_usd: hard ceiling for today's estimated spend. Set to a number to enable.",
         '# Leave commented out / omit to disable budget enforcement entirely.',
     ];
     if (cfg.dailyUsd !== null) {

package/dist/infrastructure/cost/spend-aggregator.js

@@ -36,11 +36,11 @@ function sessionsFile() {
  *  under-promise and miss a real bill. */
 const COST_PER_M_OUTPUT_TOKENS_USD = {
     'claude-code': 15.0, // Sonnet 4.6 baseline
-    'codex': 10.0, // GPT-5 / codex baseline
-    'aider': 15.0, // typically Sonnet
-    'gemini': 0, // free tier (Google AI Studio)
-    'opencode': 0, // typically free local / NIM-routed
-    'conductor': 15.0, // routes to Claude Code by default
+    codex: 10.0, // GPT-5 / codex baseline
+    aider: 15.0, // typically Sonnet
+    gemini: 0, // free tier (Google AI Studio)
+    opencode: 0, // typically free local / NIM-routed
+    conductor: 15.0, // routes to Claude Code by default
 };
 const INPUT_RATE_RATIO = 0.2; // input ≈ 1/5 of output
 const CACHE_READ_RATIO = 0.1; // cache reads ≈ 1/10 of input (so 1/50 output)

package/dist/infrastructure/hooks/claude-sdk-hook.js

@@ -13,13 +13,20 @@
  *
  * Docs: https://docs.anthropic.com/en/docs/claude-code/hooks
  */
-import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, closeSync, readSync, statSync, readFileSync, } from 'fs';
+import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, closeSync, readSync, statSync, readFileSync, unlinkSync, } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import { createHash } from 'crypto';
 // P18 slice 2 — Tier 1 hook honors per-cwd permissions.yaml.
 import { filterAllowed } from '../security/permissions-config.js';
-const PATTERNS = [
+/**
+ * Instruction-level scan pattern bank used by `scanPayload()`. Exported so
+ * docs and the landing page can quote `PATTERNS.length` instead of hardcoding
+ * a number that silently drifts (May 2026 audit found 50 / 47 / 60+ all in
+ * the same PRD). Pair this with `CODE_PATTERNS` from `trust-scorer.ts` — the
+ * two banks are scanned in different passes and counted separately.
+ */
+export const PATTERNS = [
     // Prompt Injection
     // Allow chained modifiers: "ignore all previous instructions", "ignore all your prior rules", etc.
     {
@@ -494,6 +501,42 @@ function readChainTip(filepath) {
     return null;
 }
 export function appendAuditLog(entry) {
+    // Cross-process file locking. Multiple Claude Code sessions (e.g., two
+    // terminals, or IDE + terminal) can trigger PreToolUse concurrently.
+    // Without a lock, two hook processes read the same chain tip and both
+    // write seq 43 — corrupting the hash chain. We use an exclusive-create
+    // lock file (+O_EXCL) which is atomic on all POSIX systems.
+    const LOCK_FILE = AUDIT_FILE + '.lock';
+    const lockAcquired = () => {
+        for (let attempt = 0; attempt < 20; attempt++) {
+            try {
+                const fd = openSync(LOCK_FILE, 'wx');
+                closeSync(fd);
+                return true;
+            }
+            catch {
+                // Lock held by another process — spin-wait ~10ms
+                const deadline = Date.now() + 10;
+                while (Date.now() < deadline) {
+                    /* busy-wait — sync context */
+                }
+            }
+        }
+        return false;
+    };
+    const lockReleased = () => {
+        try {
+            unlinkSync(LOCK_FILE);
+        }
+        catch {
+            /* best effort */
+        }
+    };
+    if (!lockAcquired()) {
+        // Fall through unlocked rather than drop the entry. The entry still
+        // appends; verification may flag a chain break, but the audit data
+        // is preserved.
+    }
     try {
         const dir = AUDIT_FILE.substring(0, AUDIT_FILE.lastIndexOf('/'));
         if (dir && !existsSync(dir)) {
@@ -526,6 +569,9 @@ export function appendAuditLog(entry) {
     catch {
         // Audit log failure must not block tool execution
     }
+    finally {
+        lockReleased();
+    }
 }
 /**
  * Walk the audit file and verify the hash chain. Returns:

package/dist/infrastructure/orchestration/codex-adapter.js

@@ -216,9 +216,7 @@ export function spawnCodex(prompt, options = {}) {
                 continue;
             try {
                 const data = JSON.parse(line);
-                if (codexThreadId === undefined &&
-                    data.type === 'thread.started' &&
-                    typeof data.thread_id === 'string') {
+                if (codexThreadId === undefined && data.type === 'thread.started' && typeof data.thread_id === 'string') {
                     codexThreadId = data.thread_id;
                 }
                 emit({ type: data.type ?? 'codex_event', timestamp: Date.now(), data });
@@ -325,8 +323,15 @@ export function spawnCodex(prompt, options = {}) {
                 let stdout = '';
                 let stderr = '';
                 // codex exec resume <SESSION_ID> -  → reads prompt from stdin
-                const followup = spawn('codex', ['exec', '--json', '--skip-git-repo-check', '--dangerously-bypass-approvals-and-sandbox',
-                    'resume', codexThreadId, '-'], {
+                const followup = spawn('codex', [
+                    'exec',
+                    '--json',
+                    '--skip-git-repo-check',
+                    '--dangerously-bypass-approvals-and-sandbox',
+                    'resume',
+                    codexThreadId,
+                    '-',
+                ], {
                     cwd,
                     env: spawnEnv,
                     stdio: ['pipe', 'pipe', 'pipe'],
@@ -371,7 +376,7 @@ export function spawnCodex(prompt, options = {}) {
 export const CodexAdapter = {
     id: 'codex',
     label: 'Codex',
-    description: 'OpenAI\'s coding agent. Good when the task needs reading a lot of code first, then changing several files together.',
+    description: "OpenAI's coding agent. Good when the task needs reading a lot of code first, then changing several files together.",
     processPattern: /(?:^|\/)codex(?:\s|$)/,
     isInstalled() {
         try {

package/dist/infrastructure/orchestration/context-handoff.js

@@ -58,7 +58,7 @@ export function loadHandoffContext(cwd, { fromSessionId, maxAgeMs = DEFAULT_MAX_
     // Filter by age
     const recent = packs.filter((p) => {
         const ts = p.timestamp;
-        return ts && (now - ts) < maxAgeMs;
+        return ts && now - ts < maxAgeMs;
     });
     // Prefer packs with enough graph structure to be useful
     const structured = recent.filter((p) => {

package/dist/infrastructure/orchestration/gemini-adapter.js

@@ -48,13 +48,7 @@ import { snapshotCwd, extractArtifacts } from './artifacts-extractor.js';
 //
 // `--skip-trust` — skip the per-workspace trust prompt that gemini shows on
 // first run in a new directory.
-const HEADLESS_FLAGS = [
-    '--approval-mode',
-    'yolo',
-    '--skip-trust',
-    '-o',
-    'stream-json',
-];
+const HEADLESS_FLAGS = ['--approval-mode', 'yolo', '--skip-trust', '-o', 'stream-json'];
 // Error patterns scoped to STDERR / result.error / error events only — NOT
 // every JSON-serialized event (which would false-positive on tool output).
 const ERROR_PATTERNS = [
@@ -340,13 +334,7 @@ export function spawnGemini(prompt, options = {}) {
             }
         }
         statusValue =
-            killRequested || signal !== null
-                ? 'killed'
-                : errorEmitted
-                    ? 'error'
-                    : code === 0
-                        ? 'completed'
-                        : 'error';
+            killRequested || signal !== null ? 'killed' : errorEmitted ? 'error' : code === 0 ? 'completed' : 'error';
         if (aggregator.finalize(statusValue === 'completed' ? 'completed' : statusValue === 'killed' ? 'killed' : 'error')) {
             stepsSnapshot = aggregator.steps.map((s) => ({ ...s }));
             emit({ type: 'codehere:steps', timestamp: Date.now(), data: { steps: stepsSnapshot } });
@@ -518,7 +506,7 @@ export function spawnGemini(prompt, options = {}) {
 export const GeminiAdapter = {
     id: 'gemini',
     label: 'Gemini',
-    description: 'Google\'s coding agent. Has a free tier and can read very large amounts of code or docs at once. Useful when the paid agents are out of credits.',
+    description: "Google's coding agent. Has a free tier and can read very large amounts of code or docs at once. Useful when the paid agents are out of credits.",
     // Match `gemini`, `node /path/.../gemini`, and `./gemini` invocations.
     processPattern: /(?:^|\/)gemini(?:\s|$)|node\s+\S*gemini/,
     isInstalled() {

package/dist/infrastructure/orchestration/graphify-context.js

@@ -74,7 +74,7 @@ export function buildGraphSync(cwd, { incremental = true } = {}) {
  * Compile a compact context pack for a prompt + workspace.
  * Synchronous — calls graphify-ts pack and returns the payload.
  */
-export function compileContextPackSync(prompt, cwd, { task = 'explain', budget = 3000, } = {}) {
+export function compileContextPackSync(prompt, cwd, { task = 'explain', budget = 3000 } = {}) {
     const startTime = Date.now();
     const graphPath = getGraphPath(cwd);
     // Build graph if it doesn't exist yet
@@ -86,12 +86,7 @@ export function compileContextPackSync(prompt, cwd, { task = 'explain', budget =
         return null;
     }
     try {
-        const output = execFileSync('npx', [
-            'graphify-ts', 'pack', prompt,
-            '--graph', graphPath,
-            '--task', task,
-            '--budget', String(budget),
-        ], {
+        const output = execFileSync('npx', ['graphify-ts', 'pack', prompt, '--graph', graphPath, '--task', task, '--budget', String(budget)], {
             cwd,
             encoding: 'utf-8',
             maxBuffer: 512 * 1024,
@@ -125,7 +120,9 @@ export function compileSessionPackSync(cwd, { prompt, artifacts, steps, agent })
         agent ? `Agent: ${agent}` : undefined,
         artifacts ? `Artifacts:\n${artifacts}` : undefined,
         steps ? `Steps taken:\n${steps}` : undefined,
-    ].filter(Boolean).join('\n\n');
+    ]
+        .filter(Boolean)
+        .join('\n\n');
     return compileContextPackSync(sessionContext, cwd, { task: 'impact', budget: 2500 });
 }
 // ── Context pack persistence ───────────────────────────────────────────────────
@@ -232,11 +229,7 @@ export function queryGraphSync(question, cwd, { maxTokens = 2000 } = {}) {
         return null;
     }
     try {
-        const output = execFileSync('npx', [
-            'graphify-ts', 'query', question,
-            '--graph', graphPath,
-            '--budget', String(maxTokens),
-        ], {
+        const output = execFileSync('npx', ['graphify-ts', 'query', question, '--graph', graphPath, '--budget', String(maxTokens)], {
             cwd,
             encoding: 'utf-8',
             maxBuffer: 256 * 1024,

package/dist/infrastructure/orchestration/memory-injector.js

@@ -65,17 +65,13 @@ function looksLikeInitSeed(content, kind) {
             /\[Tone for generated code\./,
             /\[Don't do X\. Always do Y\./,
         ];
-        const hits = markers.filter(re => re.test(content)).length;
+        const hits = markers.filter((re) => re.test(content)).length;
         return hits >= 2;
     }
     if (kind === 'session') {
         // The init session.md seed has this header + structure
-        const markers = [
-            /^# Working session/m,
-            /^> Per-machine, gitignored/m,
-            /^## In flight\s*\n+- \[ \]\s*$/m,
-        ];
-        const hits = markers.filter(re => re.test(content)).length;
+        const markers = [/^# Working session/m, /^> Per-machine, gitignored/m, /^## In flight\s*\n+- \[ \]\s*$/m];
+        const hits = markers.filter((re) => re.test(content)).length;
         return hits >= 2;
     }
     return false;
@@ -142,9 +138,9 @@ function readLessons(codehereDir, n) {
         const body = readFileSync(p, 'utf8');
         return body
             .split('\n')
-            .filter(line => line.trim().length > 0)
+            .filter((line) => line.trim().length > 0)
             .slice(0, n)
-            .map(line => {
+            .map((line) => {
             try {
                 const obj = JSON.parse(line);
                 return typeof obj.text === 'string' ? obj.text : line;
@@ -182,11 +178,11 @@ function formatSession(session) {
     return `# Current session scratch (.codehere/memory/working/session.md)\n\n${session}\n`;
 }
 function formatLessons(lessons) {
-    const items = lessons.map(l => `- ${l}`).join('\n');
+    const items = lessons.map((l) => `- ${l}`).join('\n');
     return `# Project lessons (.codehere/memory/semantic/lessons.jsonl)\n\n${items}\n`;
 }
 function formatSymbols(symbols) {
-    const lines = symbols.map(s => `- \`${s.name}\` — ${s.file}:${s.line} (${s.references} refs)`).join('\n');
+    const lines = symbols.map((s) => `- \`${s.name}\` — ${s.file}:${s.line} (${s.references} refs)`).join('\n');
     return `# Top symbols in this repo (.codehere/memory/episodic/repo_map.json)\n\n${lines}\n`;
 }
 /**
@@ -232,7 +228,7 @@ export function buildMemoryPrefix(projectRoot, options = {}) {
     let kept = [...candidates];
     while (kept.length > 0) {
         const totalChars = kept.reduce((acc, c) => acc + c.body.length, 0);
-        const totalTokens = estimateTokens(kept.map(c => c.body).join('\n')) + separatorTokens;
+        const totalTokens = estimateTokens(kept.map((c) => c.body).join('\n')) + separatorTokens;
         if (totalTokens <= maxTokens)
             break;
         // Drop the last (least-essential) section.
@@ -250,10 +246,10 @@ export function buildMemoryPrefix(projectRoot, options = {}) {
     if (kept.length === 0) {
         return { prefix: '', included: [], tokens: 0, truncated };
     }
-    const prefix = kept.map(c => c.body).join('\n') + SEPARATOR;
+    const prefix = kept.map((c) => c.body).join('\n') + SEPARATOR;
     return {
         prefix,
-        included: kept.map(c => c.key),
+        included: kept.map((c) => c.key),
         tokens: estimateTokens(prefix),
         truncated,
     };
@@ -296,8 +292,7 @@ function findProjectRoot(startPath) {
     }
     // Bound the loop at the filesystem root by checking dirname stability.
     for (;;) {
-        if (existsSync(join(current, '.codehere')) ||
-            existsSync(join(current, 'AGENTS.md'))) {
+        if (existsSync(join(current, '.codehere')) || existsSync(join(current, 'AGENTS.md'))) {
             return current;
         }
         const parent = dirname(current);

package/dist/infrastructure/orchestration/opencode-adapter.js

@@ -19,6 +19,7 @@ import { join } from 'path';
 import { promisify } from 'util';
 import { ProgressAggregator } from './progress-aggregator.js';
 import { applyMemoryPrefix } from './memory-injector.js';
+import { mirrorToolCallToAudit } from '../hooks/mirror-tool-call-to-audit.js';
 import { snapshotCwd, extractArtifacts } from './artifacts-extractor.js';
 const execFileAsync = promisify(execFile);
 const HEADLESS_FLAGS = ['run', '--format', 'json'];
@@ -142,6 +143,46 @@ export function spawnOpenCode(prompt, options = {}) {
             if (txt)
                 textAccum += txt + '\n';
         }
+        // #114 — cross-vendor audit mirror for opencode (closes the gap left by
+        // #110 slice 4, which wired Codex/Aider/Gemini but deferred opencode).
+        // OpenCode's `run --format json` emits `tool_use` events with shape
+        // { type: 'tool_use', part: { tool: 'bash'|'read'|'write'|..., state:
+        // { input: {...}, output, status, ... } } } (verified via deepwiki +
+        // takopi cheatsheet). Same post-hoc visibility surface as Codex/Aider/
+        // Gemini — no synchronous block until upstream pre-tool hooks land.
+        if (event.type === 'tool_use') {
+            const part = event.data?.part;
+            const rawTool = String(part?.tool ?? 'tool').toLowerCase();
+            // Normalize to Claude-cased tool names so /history filter chips group
+            // cross-vendor (a bash call from claude-code and opencode show under
+            // the same "Bash" filter chip).
+            const toolNameMap = {
+                bash: 'Bash',
+                read: 'Read',
+                write: 'Write',
+                edit: 'Edit',
+                grep: 'Grep',
+                glob: 'Glob',
+                webfetch: 'WebFetch',
+                websearch: 'WebSearch',
+                task: 'Task',
+            };
+            const toolName = toolNameMap[rawTool] ?? rawTool;
+            const input = part?.state?.input ?? {};
+            const inputStr = (typeof input.command === 'string' && input.command) ||
+                (typeof input.file_path === 'string' && input.file_path) ||
+                (typeof input.path === 'string' && input.path) ||
+                (typeof input.pattern === 'string' && input.pattern) ||
+                (typeof input.query === 'string' && input.query) ||
+                JSON.stringify(input).slice(0, 500);
+            mirrorToolCallToAudit({
+                sessionId,
+                agent: 'opencode',
+                toolName,
+                toolInput: String(inputStr),
+                cwd,
+            });
+        }
         if (!errorEmitted) {
             const data = event.data;
             let text = '';
@@ -393,7 +434,7 @@ export function spawnOpenCode(prompt, options = {}) {
 export const OpenCodeAdapter = {
     id: 'opencode',
     label: 'OpenCode',
-    description: 'Runs several agents at once for genuinely independent jobs. You won\'t see live progress while it works — the trade-off for the speed of doing things in parallel.',
+    description: "Runs several agents at once for genuinely independent jobs. You won't see live progress while it works — the trade-off for the speed of doing things in parallel.",
     processPattern: /(?:^|\/)opencode(?:\s|$)/,
     isInstalled() {
         try {

package/dist/infrastructure/orchestration/progress-aggregator.js

@@ -464,8 +464,7 @@ export class ProgressAggregator {
         if (itemType === 'tool_call' || itemType === 'local_shell_call') {
             const name = String(item.tool_name ?? item.name ?? 'tool');
             // Tool-call items may carry a `result` or `output` field too.
-            const result = (typeof item.result === 'string' ? item.result : '') ||
-                (typeof item.output === 'string' ? item.output : '');
+            const result = (typeof item.result === 'string' ? item.result : '') || (typeof item.output === 'string' ? item.output : '');
             this._steps.push({
                 label: truncate(name),
                 state: 'done',