codehere 0.6.1 → 0.7.0

package/dist/infrastructure/orchestration/session-persistence.js

@@ -22,16 +22,20 @@
 import { existsSync, mkdirSync, appendFileSync, readFileSync } from 'fs';
 import { homedir } from 'os';
 import { join, dirname } from 'path';
-const SESSIONS_FILE = join(homedir(), '.codehere', 'sessions.jsonl');
+function sessionsFile() {
+    // Honor CODEHERE_HOME like the rest of the codebase (config, audit, threads)
+    // so a scratch home isolates sessions for dogfooding / the mock harness.
+    return join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'sessions.jsonl');
+}
 function ensureDir() {
-    const dir = dirname(SESSIONS_FILE);
+    const dir = dirname(sessionsFile());
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true });
 }
 export function appendSpawned(rec) {
     try {
         ensureDir();
-        appendFileSync(SESSIONS_FILE, JSON.stringify({ t: 'spawned', ...rec }) + '\n', 'utf-8');
+        appendFileSync(sessionsFile(), JSON.stringify({ t: 'spawned', ...rec }) + '\n', 'utf-8');
     }
     catch {
         /* persistence is best-effort; never break the spawn path */
@@ -40,7 +44,7 @@ export function appendSpawned(rec) {
 export function appendCompleted(rec) {
     try {
         ensureDir();
-        appendFileSync(SESSIONS_FILE, JSON.stringify({ t: 'completed', ...rec }) + '\n', 'utf-8');
+        appendFileSync(sessionsFile(), JSON.stringify({ t: 'completed', ...rec }) + '\n', 'utf-8');
     }
     catch {
         /* best-effort */
@@ -61,7 +65,7 @@ export function appendCompleted(rec) {
 export function appendFinalReport(rec) {
     try {
         ensureDir();
-        appendFileSync(SESSIONS_FILE, JSON.stringify({ t: 'finalReport', ...rec }) + '\n', 'utf-8');
+        appendFileSync(sessionsFile(), JSON.stringify({ t: 'finalReport', ...rec }) + '\n', 'utf-8');
     }
     catch {
         /* best-effort */
@@ -76,20 +80,34 @@ export function appendFinalReport(rec) {
  * died, no artifacts), or (b) a concurrent daemon is mid-flight (not ours to
  * show). Either way, not useful in the UI.
  */
-export function loadRecent(limit = 20) {
-    if (!existsSync(SESSIONS_FILE))
-        return [];
+/**
+ * v0.7 — load a single completed session by id. Returns undefined if no
+ * matching session exists or if the session is orphaned (spawned but never
+ * completed). Used by `codehere verify <session-id>` (F-03 S2) and the
+ * upcoming `codehere audit verify` CLI (F-05).
+ *
+ * Walks the whole file once. For 1k+ sessions this is fine; if it ever
+ * becomes hot we can keep an in-memory index.
+ *
+ * Accepts a short-id prefix too (first 7+ chars), mirroring git's UX.
+ * If the prefix is ambiguous we return the most recent match (newest-first
+ * traversal). Returning undefined on ambiguity would surprise users at
+ * the CLI · git's `--abbrev-commit` collisions are very rare in practice
+ * for our id space.
+ */
+export function loadSessionById(idOrPrefix) {
+    const file = sessionsFile();
+    if (!existsSync(file))
+        return undefined;
     let content;
     try {
-        content = readFileSync(SESSIONS_FILE, 'utf-8');
+        content = readFileSync(file, 'utf-8');
     }
     catch {
-        return [];
+        return undefined;
     }
     const spawned = new Map();
     const completed = [];
-    /** v0.6.x — Final Reports keyed by sessionId. Last write wins
-     *  (rare in practice; reports fire once per session). */
     const finalReports = new Map();
     for (const line of content.split('\n')) {
         const trimmed = line.trim();
@@ -109,40 +127,131 @@ export function loadRecent(limit = 20) {
         else if (rec.t === 'finalReport')
             finalReports.set(rec.id, rec);
     }
-    const merged = [];
-    // Walk completed in reverse so we return newest-first
-    for (let i = completed.length - 1; i >= 0 && merged.length < limit; i--) {
+    // Newest-first to break prefix-collision ties toward the most recent
+    for (let i = completed.length - 1; i >= 0; i--) {
         const c = completed[i];
+        if (c.id !== idOrPrefix && !c.id.startsWith(idOrPrefix))
+            continue;
         const s = spawned.get(c.id);
         if (!s)
-            continue; // orphan completed (shouldn't happen but harmless)
+            continue;
         const fr = finalReports.get(c.id);
-        merged.push({
+        const failoverFrom = c.failoverFrom ?? s.failoverFrom;
+        const failoverTo = c.failoverTo ?? s.failoverTo;
+        const failoverReason = c.failoverReason ?? s.failoverReason;
+        return {
             sessionId: s.id,
             agent: s.agent,
             prompt: s.prompt,
             cwd: s.cwd,
             startedAt: s.startedAt,
-            // BUG 2 (May 1 2026) — defensive normalization for zombie records.
-            // Pre-fix sessions persisted before commit <THIS> were written with
-            // status='running' even when their completed-record carried real
-            // durationMs/completedAt — the conductor adapter mirrored its status
-            // AFTER emitting the exit event. The fix at the source (conductor-
-            // adapter.ts) prevents new zombies; this normalization repairs old
-            // records on read so the UI doesn't show a "running" badge on a
-            // session that obviously finished. We have no ground truth on what
-            // the actual exit code WAS for these old records, so 'completed' is
-            // the safest default — they'd been displayed as completed in the UI
-            // had this been a session-manager.ts bug. Mark explicitly via a
-            // synthetic note so debug viewers can tell normalization happened.
             status: c.status === 'running' && c.completedAt > 0 ? 'completed' : c.status,
             durationMs: c.durationMs,
             completedAt: c.completedAt,
             steps: c.steps,
             artifacts: c.artifacts,
+            ...(c.turns ? { turns: c.turns } : {}),
             ...(fr ? { finalReport: { summary: fr.summary, generatedAt: fr.generatedAt, durationMs: fr.durationMs } } : {}),
+            ...(failoverFrom ? { failoverFrom } : {}),
+            ...(failoverTo ? { failoverTo } : {}),
+            ...(failoverReason ? { failoverReason } : {}),
+            ...(s.failoverAt ? { failoverAt: s.failoverAt } : {}),
+            ...(c.stalledReason ? { stalledReason: c.stalledReason } : {}),
             provenance: 'persisted',
-        });
+        };
+    }
+    return undefined;
+}
+export function loadRecent(limit = 20) {
+    const file = sessionsFile();
+    if (!existsSync(file))
+        return [];
+    let content;
+    try {
+        content = readFileSync(file, 'utf-8');
+    }
+    catch {
+        return [];
+    }
+    const spawned = new Map();
+    const completed = [];
+    /** v0.6.x — Final Reports keyed by sessionId. Last write wins
+     *  (rare in practice; reports fire once per session). */
+    const finalReports = new Map();
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let rec;
+        try {
+            rec = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        if (rec.t === 'spawned')
+            spawned.set(rec.id, rec);
+        else if (rec.t === 'completed')
+            completed.push(rec);
+        else if (rec.t === 'finalReport')
+            finalReports.set(rec.id, rec);
+    }
+    const merged = [];
+    const includedIds = new Set();
+    const build = (c, s, fr) => ({
+        sessionId: s.id,
+        agent: s.agent,
+        prompt: s.prompt,
+        cwd: s.cwd,
+        startedAt: s.startedAt,
+        // BUG 2 (May 1 2026) — defensive normalization for zombie records.
+        // Pre-fix sessions persisted before commit <THIS> were written with
+        // status='running' even when their completed-record carried real
+        // durationMs/completedAt — the conductor adapter mirrored its status
+        // AFTER emitting the exit event. The fix at the source (conductor-
+        // adapter.ts) prevents new zombies; this normalization repairs old
+        // records on read so the UI doesn't show a "running" badge on a
+        // session that obviously finished. We have no ground truth on what
+        // the actual exit code WAS for these old records, so 'completed' is
+        // the safest default — they'd been displayed as completed in the UI
+        // had this been a session-manager.ts bug. Mark explicitly via a
+        // synthetic note so debug viewers can tell normalization happened.
+        status: c.status === 'running' && c.completedAt > 0 ? 'completed' : c.status,
+        durationMs: c.durationMs,
+        completedAt: c.completedAt,
+        steps: c.steps,
+        artifacts: c.artifacts,
+        ...(c.turns ? { turns: c.turns } : {}),
+        ...(fr ? { finalReport: { summary: fr.summary, generatedAt: fr.generatedAt, durationMs: fr.durationMs } } : {}),
+        ...((c.failoverFrom ?? s.failoverFrom) ? { failoverFrom: c.failoverFrom ?? s.failoverFrom } : {}),
+        ...((c.failoverTo ?? s.failoverTo) ? { failoverTo: c.failoverTo ?? s.failoverTo } : {}),
+        ...((c.failoverReason ?? s.failoverReason) ? { failoverReason: c.failoverReason ?? s.failoverReason } : {}),
+        ...(s.failoverAt ? { failoverAt: s.failoverAt } : {}),
+        ...(c.stalledReason ? { stalledReason: c.stalledReason } : {}),
+        provenance: 'persisted',
+    });
+    // Walk completed in reverse so we return newest-first, up to `limit`.
+    for (let i = completed.length - 1; i >= 0 && merged.length < limit; i--) {
+        const c = completed[i];
+        const s = spawned.get(c.id);
+        if (!s || includedIds.has(c.id))
+            continue; // orphan / dup (harmless)
+        merged.push(build(c, s, finalReports.get(c.id)));
+        includedIds.add(c.id);
+    }
+    // Always include seeded demo-* sessions even past the recent-N cap. They're
+    // pinned to FEATURED in the dashboard and are the fixtures /verify observes —
+    // dropping them off the list once you have >limit real runs is a bug (it's
+    // what made /verify report seeded fixtures as "not rendered"). Newest-first.
+    for (let i = completed.length - 1; i >= 0; i--) {
+        const c = completed[i];
+        if (!c.id.startsWith('demo-') || includedIds.has(c.id))
+            continue;
+        const s = spawned.get(c.id);
+        if (!s)
+            continue;
+        merged.push(build(c, s, finalReports.get(c.id)));
+        includedIds.add(c.id);
     }
     return merged;
 }

package/dist/infrastructure/orchestration/thread-key-store.js

@@ -0,0 +1,127 @@
+/**
+ * Thread-export key storage · v0.8 S4.
+ *
+ * Two responsibilities:
+ *   1. Per-machine Ed25519 keypair · generated on first export · persisted
+ *      at ~/.codehere/keys/thread-signing.{pem,pub.pem}. Used to SIGN
+ *      bundles. 0600 on private file.
+ *   2. Trusted-keys registry · ~/.codehere/keys/trusted.json maps base64
+ *      public keys to { label, addedAt }. When importing a bundle whose
+ *      key is in the trust store, replay proceeds silently. Otherwise the
+ *      caller (CLI or web UI) prompts the user to trust + continue.
+ *
+ * Both files live ENTIRELY on the user's machine. Codehere never sends
+ * keys anywhere. The trust model is "users trust their friends' keys" ·
+ * same shape as SSH known_hosts.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { generateKeypair, exportPrivatePem, exportPublicPem, importPrivatePem, importPublicPem, publicKeyToBase64, } from '../../application/use-cases/thread-export.js';
+function keysDir() {
+    const home = process.env.CODEHERE_HOME || homedir();
+    return join(home, '.codehere', 'keys');
+}
+function privPath() {
+    return join(keysDir(), 'thread-signing.pem');
+}
+function pubPath() {
+    return join(keysDir(), 'thread-signing.pub.pem');
+}
+function trustedPath() {
+    return join(keysDir(), 'trusted.json');
+}
+/**
+ * Load (or generate) the local signing keypair. First call creates a new
+ * one and persists it; subsequent calls re-read from disk.
+ */
+export function loadOrCreateKeypair() {
+    mkdirSync(keysDir(), { recursive: true });
+    if (existsSync(privPath()) && existsSync(pubPath())) {
+        const priv = readFileSync(privPath(), 'utf-8');
+        const pub = readFileSync(pubPath(), 'utf-8');
+        return {
+            privateKey: importPrivatePem(priv),
+            publicKey: importPublicPem(pub),
+        };
+    }
+    const fresh = generateKeypair();
+    writeFileSync(privPath(), exportPrivatePem(fresh.privateKey), 'utf-8');
+    writeFileSync(pubPath(), exportPublicPem(fresh.publicKey), 'utf-8');
+    try {
+        chmodSync(privPath(), 0o600);
+    }
+    catch { }
+    return fresh;
+}
+/**
+ * Return the local key's base64 string (used in bundle equality + UI display).
+ * Doesn't generate · only reads. Returns null if no key exists yet.
+ */
+export function localPublicKeyBase64() {
+    if (!existsSync(pubPath()))
+        return null;
+    try {
+        const pub = readFileSync(pubPath(), 'utf-8');
+        return publicKeyToBase64(importPublicPem(pub));
+    }
+    catch {
+        return null;
+    }
+}
+export function loadTrustedKeys() {
+    const path = trustedPath();
+    const local = localPublicKeyBase64();
+    const seed = { schema: 1, keys: {} };
+    if (local)
+        seed.keys[local] = { label: 'this machine', addedAt: Date.now() };
+    if (!existsSync(path))
+        return seed;
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf-8'));
+        if (raw && typeof raw === 'object' && raw.schema === 1 && typeof raw.keys === 'object') {
+            // Always include the local key implicitly even if the trusted file
+            // doesn't list it (avoids "can't import my own export" if file is
+            // wiped or corrupted).
+            if (local && !raw.keys[local]) {
+                raw.keys[local] = { label: 'this machine', addedAt: Date.now() };
+            }
+            return raw;
+        }
+    }
+    catch {
+        /* fall through to seed */
+    }
+    return seed;
+}
+export function saveTrustedKeys(file) {
+    mkdirSync(keysDir(), { recursive: true });
+    writeFileSync(trustedPath(), JSON.stringify(file, null, 2) + '\n', 'utf-8');
+    try {
+        chmodSync(trustedPath(), 0o600);
+    }
+    catch { }
+}
+export function isKeyTrusted(publicKeyB64) {
+    return !!loadTrustedKeys().keys[publicKeyB64];
+}
+export function trustKey(publicKeyB64, label) {
+    const file = loadTrustedKeys();
+    file.keys[publicKeyB64] = { label, addedAt: Date.now() };
+    saveTrustedKeys(file);
+}
+export function untrustKey(publicKeyB64) {
+    const file = loadTrustedKeys();
+    const local = localPublicKeyBase64();
+    if (local && publicKeyB64 === local)
+        return false; // can't untrust own key
+    if (!file.keys[publicKeyB64])
+        return false;
+    delete file.keys[publicKeyB64];
+    saveTrustedKeys(file);
+    return true;
+}
+export function trustedKeySet() {
+    return new Set(Object.keys(loadTrustedKeys().keys));
+}
+//# sourceMappingURL=thread-key-store.js.map

package/dist/infrastructure/orchestration/write-pass-store.js

@@ -0,0 +1,46 @@
+/**
+ * Write-pass store · v0.9 S6 part B · in-memory holding tank for pending
+ * write-passes. Lives only in the daemon process · cleared on restart by
+ * design. The audit chain is the durable record · this store just holds
+ * the intent between emission and decision so the UI can poll it.
+ *
+ * Scope decisions:
+ *   - In-memory only. A pending write that survives a daemon restart is
+ *     a half-thought · the agent should re-emit. Persistence would invite
+ *     replay attacks (an old approval against a payload the user no longer
+ *     remembers).
+ *   - Per-id Map. O(1) get/set. No iteration ordering guarantees · the
+ *     UI lists them by intent.emittedAt for display.
+ *   - Status transitions go through applyDecision / applyResponse in
+ *     write-pass.ts so the store stays dumb · it's just a typed Map.
+ */
+const store = new Map();
+/** Place a freshly-validated intent in the store as 'pending'. */
+export function putPending(intent) {
+    const status = { kind: 'pending', intent };
+    store.set(intent.id, status);
+    return status;
+}
+export function getById(passId) {
+    return store.get(passId);
+}
+export function setStatus(status) {
+    store.set(status.intent.id, status);
+}
+export function listPending() {
+    return [...store.values()].filter((s) => s.kind === 'pending');
+}
+export function listForSession(sessionId) {
+    return [...store.values()]
+        .filter((s) => s.intent.sessionId === sessionId)
+        .sort((a, b) => a.intent.emittedAt - b.intent.emittedAt);
+}
+/** Drop a pass · for tests + the "discard" admin action. */
+export function discard(passId) {
+    return store.delete(passId);
+}
+/** Test-only · clear the store between cases. */
+export function _resetForTests() {
+    store.clear();
+}
+//# sourceMappingURL=write-pass-store.js.map

package/dist/infrastructure/protocols/cloud-sync.js

@@ -62,11 +62,10 @@ export function collectSessionMetadata() {
     }
     try {
         const content = readFileSync(SESSIONS_FILE, 'utf-8');
-        const lines = content.split('\n').filter(l => l.trim().length > 0);
+        const lines = content.split('\n').filter((l) => l.trim().length > 0);
         // Parse records and pair spawned + completed
         const spawnedMap = new Map();
         const completedMap = new Map();
-        const finalReportMap = new Map();
         for (const line of lines) {
             try {
                 const record = JSON.parse(line);
@@ -76,9 +75,6 @@ export function collectSessionMetadata() {
                 else if (record.t === 'completed') {
                     completedMap.set(record.id, record);
                 }
-                else if (record.t === 'finalReport') {
-                    finalReportMap.set(record.id, record);
-                }
             }
             catch {
                 // Skip malformed lines
@@ -87,11 +83,14 @@ export function collectSessionMetadata() {
         const sessions = [];
         for (const [id, spawned] of spawnedMap.entries()) {
             const completed = completedMap.get(id);
-            const finalReport = finalReportMap.get(id);
             const status = completed
-                ? (completed.status === 'completed' ? 'done' : completed.status === 'failed' ? 'failed' : 'done')
+                ? completed.status === 'completed'
+                    ? 'done'
+                    : completed.status === 'failed'
+                        ? 'failed'
+                        : 'done'
                 : 'running';
-            const durationMs = completed?.durationMs ?? (Date.now() - spawned.startedAt);
+            const durationMs = completed?.durationMs ?? Date.now() - spawned.startedAt;
             const tools = completed?.steps?.length ?? 0;
             const files = completed?.artifacts?.filesChanged?.length ?? 0;
             const trustScore = extractTrustScore(completed?.artifacts);
@@ -151,7 +150,7 @@ export function startCloudSync(machineName) {
                 console.error(`  Cloud sync failed: ${res.status} ${body}`);
             }
             else {
-                const data = await res.json();
+                const data = (await res.json());
                 if (data.sessionsPushed && data.sessionsPushed > 0) {
                     console.log(`  Cloud sync: ${data.sessionsPushed} session(s) pushed`);
                 }
@@ -166,7 +165,7 @@ export function startCloudSync(machineName) {
             const res = await fetch(`${CLOUD_URL}?action=pull-tasks&machineId=${machineId}`);
             if (!res.ok)
                 return;
-            const data = await res.json();
+            const data = (await res.json());
             const tasks = data.tasks || [];
             for (const task of tasks) {
                 if (task.prompt) {
@@ -187,7 +186,7 @@ export function startCloudSync(machineName) {
                 }
             }
         }
-        catch (err) {
+        catch {
             // Silent fail for task pull — not critical
         }
     };