codehere 0.6.1 → 0.7.0

package/dist/infrastructure/security/trust-scorer.js

@@ -9,6 +9,30 @@
  *
  * All passes run locally, zero API calls.
  */
+/**
+ * Extract the child_process bindings actually imported in a file, so the
+ * exec() command-injection pattern can tell a real `cp.exec(cmd)` from a
+ * `regex.exec(str)` that happens to live in a file which also uses
+ * child_process (e.g. our own artifacts-extractor: spawns git AND runs a
+ * regex loop). namespaceAliases = the `cp` in `import * as cp` / `const cp =
+ * require(...)`; namedExec = whether `exec`/`execSync` was imported by name so
+ * a bare `exec(cmd)` is callable.
+ */
+export function childProcessBindings(src) {
+    const namespaceAliases = new Set();
+    let namedExec = false;
+    for (const m of src.matchAll(/import\s+(?:\*\s+as\s+)?(\w+)\s+from\s+['"](?:node:)?child_process['"]/g)) {
+        namespaceAliases.add(m[1]);
+    }
+    for (const m of src.matchAll(/(?:const|let|var|import)\s+(\w+)\s*=\s*require\(\s*['"](?:node:)?child_process['"]/g)) {
+        namespaceAliases.add(m[1]);
+    }
+    for (const m of src.matchAll(/(?:import|const|let|var)\s*\{([^}]*)\}\s*(?:from\s*|=\s*require\(\s*)['"](?:node:)?child_process['"]/g)) {
+        if (/\b(?:exec|execSync)\b/.test(m[1]))
+            namedExec = true;
+    }
+    return { namespaceAliases, namedExec };
+}
 export const CODE_PATTERNS = [
     // Secrets (scan with strings visible — must see inside string literals)
     {
@@ -238,12 +262,22 @@ export const CODE_PATTERNS = [
     // requiresContext must match an actual import, not the literal string
     // child_process (which this scanner file itself contains as pattern data).
     {
-        regex: /\.exec\s*\(\s*(?!['"`])(\w+)\s*[,)]/g,
+        // Capture an optional receiver (group 1) so matchFilter can check it:
+        //   cp.exec(cmd)  → receiver "cp"   |  exec(cmd) → no receiver  |  g.exec(s) → "g"
+        regex: /(?:\b(\w+)\s*\.\s*)?\bexec(?:Sync)?\s*\(\s*(?!['"`])(\w+)\s*[,)]/g,
         severity: 'high',
         category: 'Command Injection',
         description: 'exec() called with variable argument — verify input is not user-controlled',
         cwe: 'CWE-78',
         requiresContext: /(?:from|require\()\s*['"](?:node:)?child_process['"]/,
+        // Only a real child_process call counts: a method call on the imported
+        // child_process binding, or a bare exec() when exec was named-imported.
+        // A method call on anything else (a RegExp, a parser, …) is not.
+        matchFilter: (m, src) => {
+            const receiver = m[1];
+            const b = childProcessBindings(src);
+            return receiver === undefined ? b.namedExec : b.namespaceAliases.has(receiver);
+        },
     },
     // SSRF
     {
@@ -286,6 +320,42 @@ export const CODE_PATTERNS = [
         cwe: 'CWE-347',
         scanRaw: true,
     },
+    // Secret-file read / exfiltration. Code that touches a private key, cloud
+    // credential, or system password file is almost always exfil or theft.
+    // dogfood 2026-05-27 Phase F: reading ~/.ssh/id_rsa was a false-negative on a
+    // product that claims a trust score on every file. scanRaw — the path lives
+    // inside a string literal. Tight path set keeps false positives near zero.
+    {
+        regex: /(?:\.ssh\/id_(?:rsa|dsa|ecdsa|ed25519)|(?:^|[^\w])id_(?:rsa|ed25519)\b|\.aws\/credentials|\.config\/gcloud\/|\.kube\/config|\.docker\/config\.json|\/etc\/shadow|\.npmrc\b|\.pem['"`])/gi,
+        severity: 'critical',
+        category: 'Secret Exfiltration',
+        description: 'Reads a private key or credential file — likely secret exfiltration',
+        cwe: 'CWE-522',
+        scanRaw: true,
+    },
+    // Destructive shell command. `rm -rf` in agent-written code is worth flagging
+    // even when it looks scoped — a stray variable or trailing slash turns it into
+    // a filesystem wipe. dogfood 2026-05-27 Phase F named this a false-negative.
+    // The runtime PreToolUse hook also blocks the worst forms at execution time;
+    // this is the static signal on the file itself. scanRaw — the command is a
+    // string literal.
+    {
+        regex: /rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r/gi,
+        severity: 'high',
+        category: 'Destructive Operation',
+        description: 'Recursive force-delete (rm -rf) — verify the target can never be empty or a parent path',
+        cwe: 'CWE-78',
+        scanRaw: true,
+    },
+    {
+        // rm -rf targeting root, a home glob, or a variable/concatenation → wipe risk.
+        regex: /rm\s+-[a-z]*[rf][a-z]*\s+(?:\/(?:\s|$|["'`])|~|\$\{?\w|["'`][^"'`]*["'`]\s*\+|\.\.)/gi,
+        severity: 'critical',
+        category: 'Destructive Operation',
+        description: 'rm -rf targeting root, home, or a dynamic path — can wipe unintended files',
+        cwe: 'CWE-78',
+        scanRaw: true,
+    },
 ];
 export function measureComplexity(code) {
     const lines = code.split('\n').length;
@@ -535,6 +605,11 @@ export function scoreFile(filepath, code) {
         let match;
         const re = new RegExp(pattern.regex.source, pattern.regex.flags);
         while ((match = re.exec(scannable)) !== null) {
+            if (pattern.matchFilter && !pattern.matchFilter(match, contextTarget)) {
+                if (!re.global)
+                    break;
+                continue;
+            }
             const line = code.substring(0, match.index).split('\n').length;
             allFindings.push({
                 severity: pattern.severity,

package/dist/infrastructure/storage/cross-tool-agents.js

@@ -143,7 +143,10 @@ export function parseAgentFile(filePath, defaultFormat = 'unknown') {
     // Tools normalization
     let tools = null;
     if (typeof fm.tools === 'string') {
-        tools = fm.tools.split(',').map((t) => t.trim().toLowerCase()).filter(Boolean);
+        tools = fm.tools
+            .split(',')
+            .map((t) => t.trim().toLowerCase())
+            .filter(Boolean);
     }
     else if (hasObjectTools) {
         tools = [];
@@ -162,7 +165,21 @@ export function parseAgentFile(filePath, defaultFormat = 'unknown') {
             ? 'subagent'
             : 'all';
     // Track unknown frontmatter keys (everything outside our normalized set)
-    const knownKeys = new Set(['name', 'description', 'mode', 'model', 'temperature', 'tools', 'permission', 'color', 'hidden', 'top_p', 'steps', 'prompt', 'disable']);
+    const knownKeys = new Set([
+        'name',
+        'description',
+        'mode',
+        'model',
+        'temperature',
+        'tools',
+        'permission',
+        'color',
+        'hidden',
+        'top_p',
+        'steps',
+        'prompt',
+        'disable',
+    ]);
     const unknownKeys = Object.keys(fm).filter((k) => !knownKeys.has(k));
     return {
         name: typeof fm.name === 'string' ? fm.name : filenameName,
@@ -219,7 +236,7 @@ export function readCrossToolAgents(cwd, options) {
     const dirs = agentDirsToScan(cwd, options?.homeDir);
     for (const { dir, defaultFormat } of dirs) {
         for (const filePath of listMdFilesRecursive(dir)) {
-            let agent = null;
+            let agent;
             try {
                 agent = parseAgentFile(filePath, defaultFormat);
             }

package/dist/infrastructure/storage/project-thread-migration.js

@@ -32,12 +32,7 @@ import { readFileSync, writeFileSync, mkdirSync, rmSync, existsSync, readdirSync
 import { join } from 'path';
 import { createHash } from 'crypto';
 /** Path patterns considered ephemeral and skipped from project list. */
-const DEFAULT_TEMP_DIR_PATTERNS = [
-    /^\/tmp\//,
-    /^\/var\/folders\//,
-    /^\/private\/var\/folders\//,
-    /^\/private\/tmp\//,
-];
+const DEFAULT_TEMP_DIR_PATTERNS = [/^\/tmp\//, /^\/var\/folders\//, /^\/private\/var\/folders\//, /^\/private\/tmp\//];
 /** sha1(cwd)[:12] — stable, short, filesystem-safe. */
 function slugForCwd(cwd, unknownLabel) {
     if (!cwd)
@@ -79,7 +74,17 @@ function rollupSessions(events) {
             completedIds.add(id);
         const existing = byId.get(id) ?? { id, abandoned: true };
         const existingAny = existing;
-        for (const k of ['agent', 'prompt', 'cwd', 'startedAt', 'status', 'durationMs', 'completedAt', 'steps', 'artifacts']) {
+        for (const k of [
+            'agent',
+            'prompt',
+            'cwd',
+            'startedAt',
+            'status',
+            'durationMs',
+            'completedAt',
+            'steps',
+            'artifacts',
+        ]) {
             if (e[k] !== undefined && existingAny[k] === undefined) {
                 existingAny[k] = e[k];
             }
@@ -153,7 +158,7 @@ export function migrate(options) {
     let threadsWritten = 0;
     let threadsSkippedExisting = 0;
     let unknownCwdSessions = 0;
-    let abandonedSessions = sessions.filter((s) => s.abandoned).length;
+    const abandonedSessions = sessions.filter((s) => s.abandoned).length;
     let tempDirSessionsSkipped = 0;
     for (const group of groups) {
         if (skipTempDirs && isTempDir(group.cwd)) {
@@ -193,7 +198,7 @@ export function dryRun(options) {
     let threadsWritten = 0;
     let threadsSkippedExisting = 0;
     let unknownCwdSessions = 0;
-    let abandonedSessions = sessions.filter((s) => s.abandoned).length;
+    const abandonedSessions = sessions.filter((s) => s.abandoned).length;
     let tempDirSessionsSkipped = 0;
     for (const group of groups) {
         if (skipTempDirs && isTempDir(group.cwd)) {

package/dist/infrastructure/storage/project-thread-reader.js

@@ -133,7 +133,17 @@ export function readProjectThread(slug, options) {
             };
             // Merge fields — later entries override earlier (covers
             // spawn → completion update pattern from forward-mirror)
-            for (const k of ['agent', 'prompt', 'cwd', 'startedAt', 'status', 'durationMs', 'completedAt', 'steps', 'artifacts']) {
+            for (const k of [
+                'agent',
+                'prompt',
+                'cwd',
+                'startedAt',
+                'status',
+                'durationMs',
+                'completedAt',
+                'steps',
+                'artifacts',
+            ]) {
                 if (rec[k] !== undefined) {
                     existing[k] = rec[k];
                 }

package/dist/infrastructure/storage/project-thread-title-backfill.js

@@ -145,7 +145,7 @@ export async function backfillThreadTitles(options) {
             result.noTasks++;
             continue;
         }
-        let title = null;
+        let title;
         try {
             title = await generateThreadTitle(scanned.firstPrompt, scanned.firstCwd);
         }
@@ -178,10 +178,14 @@ export async function backfillThreadTitles(options) {
                         break;
                     }
                 }
-                catch { /* skip malformed */ }
+                catch {
+                    /* skip malformed */
+                }
             }
         }
-        catch { /* if we can't read, fall through and let the append fail */ }
+        catch {
+            /* if we can't read, fall through and let the append fail */
+        }
         if (userBeatUs) {
             result.alreadyTitled++;
             continue;

package/dist/monitoring.js

@@ -159,7 +159,7 @@ function checkMemory() {
             usage: usagePercent,
         };
     }
-    catch (error) {
+    catch {
         return {
             status: 'ok',
             message: 'Memory check unavailable',

package/dist/presentation/cli/commands/audit-command.js

@@ -0,0 +1,126 @@
+/**
+ * CLI: `codehere audit`
+ *
+ * F-05 of the demo-v12 backlog · expose the hash-chained audit log verifier
+ * + a "show" subcommand for forensic inspection. The chain is the source of
+ * truth, NOT codehere itself · this command lets reviewers and CI verify it
+ * without trusting our daemon.
+ *
+ * Subcommands:
+ *   codehere audit verify [--json]   Walk the chain · report intact/tampered
+ *                                    + entry counts + every break point.
+ *                                    Exit 0 = valid, 1 = invalid.
+ *   codehere audit show <seq> [--json]
+ *                                    Print one entry by sequence number.
+ *
+ * Default audit file: ~/.codehere/audit/hook-events.jsonl
+ * Override via CODEHERE_AUDIT_FILE env var (mirrors the hook's own resolution).
+ */
+import { existsSync, readFileSync } from 'fs';
+import { colors, symbols } from '../../../ui.js';
+import { AUDIT_FILE, verifyAuditChain } from '../../../infrastructure/hooks/claude-sdk-hook.js';
+export function executeAuditCommand(sub, arg, options = {}) {
+    if (!sub || sub === 'verify')
+        return verify(options.json ?? false);
+    if (sub === 'show')
+        return show(arg, options.json ?? false);
+    process.stderr.write(colors.error(`${symbols.error} Unknown audit subcommand: ${sub}\n`) +
+        colors.dim('Try: codehere audit verify   |   codehere audit show <seq>\n'));
+    return 2;
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* verify · the F-05 headline                                                */
+/* ──────────────────────────────────────────────────────────────────────── */
+function verify(json) {
+    const result = verifyAuditChain(AUDIT_FILE);
+    if (json) {
+        process.stdout.write(JSON.stringify({
+            path: AUDIT_FILE,
+            valid: result.valid,
+            totalEntries: result.totalEntries,
+            chainedEntries: result.chainedEntries,
+            legacyEntries: result.legacyEntries,
+            errors: result.errors,
+        }, null, 2) + '\n');
+        return result.valid ? 0 : 1;
+    }
+    // Human output · header, verdict line, counts, then errors if any.
+    process.stdout.write('\n' + colors.dim('audit log: ') + colors.gray(AUDIT_FILE) + '\n\n');
+    if (result.totalEntries === 0) {
+        process.stdout.write(colors.gray(`${symbols.dot} No audit entries yet.`) +
+            colors.dim(' Install the hook first: ') +
+            colors.bold('codehere hook install') +
+            '\n\n');
+        return 0;
+    }
+    if (result.valid) {
+        process.stdout.write(colors.green(`${symbols.success} Chain intact`) +
+            colors.dim('  every entry verified against its predecessor hash.') +
+            '\n\n');
+    }
+    else {
+        process.stdout.write(colors.error(`${symbols.error} Chain BROKEN`) +
+            colors.dim(`  ${result.errors.length} break point${result.errors.length === 1 ? '' : 's'} detected.`) +
+            '\n\n');
+    }
+    process.stdout.write(colors.bold('Counts:\n'));
+    process.stdout.write(`  ${result.totalEntries.toString().padStart(6)} total entries\n`);
+    process.stdout.write(`  ${result.chainedEntries.toString().padStart(6)} hash-chained (verifiable)\n`);
+    process.stdout.write(`  ${result.legacyEntries.toString().padStart(6)} legacy pre-chain (un-verifiable)\n\n`);
+    if (result.errors.length > 0) {
+        process.stdout.write(colors.bold('Break points:\n'));
+        for (const err of result.errors) {
+            process.stdout.write('  ' +
+                colors.error(`line ${err.lineNumber}`) +
+                colors.dim('  ') +
+                colors.gray(err.reason) +
+                colors.dim('  ') +
+                err.detail +
+                '\n');
+        }
+        process.stdout.write('\n');
+    }
+    return result.valid ? 0 : 1;
+}
+function show(seqStr, json) {
+    if (!seqStr || !/^\d+$/.test(seqStr)) {
+        process.stderr.write(colors.error(`${symbols.error} Need a numeric sequence: codehere audit show <seq>\n`));
+        return 2;
+    }
+    const target = parseInt(seqStr, 10);
+    if (!existsSync(AUDIT_FILE)) {
+        process.stderr.write(colors.gray(`${symbols.dot} No audit log yet.\n`));
+        return 2;
+    }
+    const lines = readFileSync(AUDIT_FILE, 'utf-8').split('\n').filter(Boolean);
+    for (const line of lines) {
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (entry.seq !== target)
+            continue;
+        if (json) {
+            process.stdout.write(JSON.stringify(entry, null, 2) + '\n');
+        }
+        else {
+            process.stdout.write('\n' +
+                colors.bold(`Entry #${target}`) +
+                (entry.ts ? colors.dim('  ' + new Date(entry.ts).toISOString()) : '') +
+                '\n\n');
+            for (const [k, v] of Object.entries(entry)) {
+                const val = typeof v === 'string' && v.length > 120 ? v.slice(0, 117) + '...' : JSON.stringify(v);
+                process.stdout.write(`  ${colors.dim(k.padEnd(12))} ${val}\n`);
+            }
+            process.stdout.write('\n');
+        }
+        return 0;
+    }
+    process.stderr.write(colors.error(`${symbols.error} No entry with seq=${target}.\n`) +
+        colors.dim('   Tip: run `codehere audit verify` to see the chained-entry count.\n'));
+    return 2;
+}
+//# sourceMappingURL=audit-command.js.map

package/dist/presentation/cli/commands/budget-command.js

@@ -39,7 +39,7 @@ function showBudget() {
     const cfg = loadBudget();
     const spend = computeSpendToday();
     newline();
-    console.log(info('Today\'s estimated spend:'), fmtUsd(spend.totalUsd), `(${spend.sessionCount} session${spend.sessionCount === 1 ? '' : 's'})`);
+    console.log(info("Today's estimated spend:"), fmtUsd(spend.totalUsd), `(${spend.sessionCount} session${spend.sessionCount === 1 ? '' : 's'})`);
     if (cfg.dailyUsd === null) {
         console.log(info('Daily budget:'), 'none — no enforcement');
         console.log(info('Set one with:'), 'codehere budget set 5');
@@ -67,7 +67,7 @@ function setBudget(value) {
     cfg.dailyUsd = n;
     saveBudget(cfg);
     console.log(success('Daily budget set to'), fmtUsd(n));
-    console.log(info('Spawns will be blocked once today\'s estimated spend reaches this amount.'));
+    console.log(info("Spawns will be blocked once today's estimated spend reaches this amount."));
     console.log(info('Disable with:'), 'codehere budget off');
 }
 function disableBudget() {

package/dist/presentation/cli/commands/config-command.js

@@ -2,7 +2,7 @@
  * Config Command
  * Manage Codehere configuration and preferences
  */
-import { colors, separator, newline, sectionHeader, success, error, createTable, isMinimalStyle, } from '../../../ui.js';
+import { colors, separator, newline, sectionHeader, success, error, createTable, isMinimalStyle } from '../../../ui.js';
 import { getConfigManager } from '../../../infrastructure/config/config-manager.js';
 import { executionTracer } from '../../../infrastructure/observability/execution-tracer.js';
 import { findCodebaseRoot } from '../../../domain/services/codebase-detector.js';
@@ -43,7 +43,7 @@ function displayConfig(config) {
 export async function executeConfigCommand(action, key, value) {
     // Start execution tracing
     const codebaseInfo = findCodebaseRoot(process.cwd());
-    const runId = executionTracer.startRun('config', {
+    executionTracer.startRun('config', {
         codebaseId: codebaseInfo?.rootPath || process.cwd(),
     });
     try {

package/dist/presentation/cli/commands/context-source-command.js

@@ -0,0 +1,198 @@
+/**
+ * CLI: `codehere context-source` · v0.8 S2.5
+ *
+ * Subcommands:
+ *   list                  · show every registered provider + connection status
+ *   connect <provider>    · open the browser to begin OAuth · prints URL
+ *   disconnect <provider> · clear the stored OAuth token
+ *
+ * Talks to the running daemon at 127.0.0.1:3773. If the daemon isn't running,
+ * we print a clear message rather than starting one silently.
+ */
+import { colors, symbols } from '../../../ui.js';
+import { spawn } from 'child_process';
+const DAEMON_BASE = process.env.CODEHERE_DAEMON_URL || 'http://127.0.0.1:3773';
+export async function executeContextSourceCommand(sub, arg, options = {}) {
+    switch (sub) {
+        case undefined:
+        case 'list':
+            return list(options.json ?? false);
+        case 'connect':
+            return connect(arg, options.json ?? false, options.open !== false);
+        case 'disconnect':
+            return disconnect(arg, options.json ?? false);
+        default:
+            process.stderr.write(colors.error(`${symbols.error} Unknown subcommand: ${sub}\n`) +
+                colors.dim('Try: codehere context-source list | connect <provider> | disconnect <provider>\n'));
+            return 2;
+    }
+}
+async function fetchJson(path, init = {}) {
+    try {
+        const r = await fetch(DAEMON_BASE + path, init);
+        if (!r.ok) {
+            const text = await r.text();
+            return { ok: false, status: r.status, error: text };
+        }
+        return { ok: true, status: r.status, data: (await r.json()) };
+    }
+    catch (err) {
+        return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
+    }
+}
+function daemonUnreachableNote(err) {
+    return (colors.error(`${symbols.error} Daemon not reachable at ${DAEMON_BASE}.\n`) +
+        colors.dim(`   Start it with: `) +
+        colors.bold('codehere start') +
+        '\n' +
+        colors.dim(`   Detail: ${err}\n`));
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* list                                                                      */
+/* ──────────────────────────────────────────────────────────────────────── */
+async function list(json) {
+    const r = await fetchJson('/api/context-sources');
+    if (!r.ok) {
+        if (json) {
+            process.stdout.write(JSON.stringify({ error: 'daemon_unreachable', detail: r.error }, null, 2) + '\n');
+        }
+        else {
+            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
+        }
+        return 2;
+    }
+    const items = r.data?.providers ?? [];
+    if (json) {
+        process.stdout.write(JSON.stringify({ providers: items }, null, 2) + '\n');
+        return 0;
+    }
+    process.stdout.write('\n' + colors.bold('Context sources') + '\n\n');
+    if (!items.length) {
+        process.stdout.write(colors.dim('  (no providers registered)\n\n'));
+        return 0;
+    }
+    for (const p of items) {
+        const tag = statusTag(p.status);
+        const who = p.userLabel ? colors.gray('· ' + p.userLabel) : '';
+        process.stdout.write(`  ${tag}  ${colors.bold(p.label.padEnd(10))} ${colors.dim(p.scheme + '://')} ${who}\n`);
+        if (!p.clientIdConfigured) {
+            process.stdout.write('       ' + colors.warning(`set CODEHERE_${p.id.toUpperCase()}_CLIENT_ID before connect()`) + '\n');
+        }
+    }
+    process.stdout.write('\n' + colors.dim('Connect: ') + colors.bold('codehere context-source connect <provider>') + '\n\n');
+    return 0;
+}
+function statusTag(s) {
+    switch (s) {
+        case 'connected':
+            return colors.green('● connected   ');
+        case 'expired':
+            return colors.warning('● expired     ');
+        case 'manual':
+            return colors.gray('● manual      ');
+        case 'disconnected':
+            return colors.gray('○ disconnected');
+    }
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* connect                                                                    */
+/* ──────────────────────────────────────────────────────────────────────── */
+async function connect(providerArg, json, openBrowser) {
+    if (!providerArg) {
+        process.stderr.write(colors.error(`${symbols.error} Need a provider id: codehere context-source connect <id>\n`));
+        return 2;
+    }
+    const r = await fetchJson(`/api/context-sources/${encodeURIComponent(providerArg)}/connect`, { method: 'POST' });
+    if (!r.ok) {
+        let detail = null;
+        try {
+            detail = JSON.parse(r.error ?? '{}');
+        }
+        catch {
+            /* ignore */
+        }
+        if (detail?.error === 'provider_not_registered') {
+            const envVar = detail.envVar ?? `CODEHERE_${providerArg.toUpperCase()}_CLIENT_ID`;
+            if (json) {
+                process.stdout.write(JSON.stringify({ error: 'provider_not_registered', envVar, message: detail.message }, null, 2) + '\n');
+            }
+            else {
+                process.stderr.write(colors.error(`${symbols.error} ${providerArg} OAuth app not registered.\n`) +
+                    colors.dim(`   ${detail.message ?? ''}\n`) +
+                    colors.dim(`   Set the env var: `) +
+                    colors.bold(envVar) +
+                    '\n');
+            }
+            return 2;
+        }
+        if (json) {
+            process.stdout.write(JSON.stringify({ error: 'connect_failed', detail: r.error }, null, 2) + '\n');
+        }
+        else {
+            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
+        }
+        return 2;
+    }
+    const url = r.data?.authorizeUrl;
+    if (!url) {
+        process.stderr.write(colors.error(`${symbols.error} Daemon did not return an authorize URL.\n`));
+        return 1;
+    }
+    if (json) {
+        process.stdout.write(JSON.stringify({ authorizeUrl: url }, null, 2) + '\n');
+        return 0;
+    }
+    process.stdout.write('\n' +
+        colors.bold(`Opening ${providerArg} OAuth flow`) +
+        '\n\n' +
+        colors.dim('  URL: ') +
+        url +
+        '\n\n' +
+        colors.dim('  Codehere will store the token at ~/.codehere/context-sources.json.\n') +
+        colors.dim('  You can close the browser tab when it says "connected".\n\n'));
+    if (openBrowser) {
+        openInBrowser(url);
+    }
+    return 0;
+}
+function openInBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    try {
+        const child = spawn(cmd, [url], { detached: true, stdio: 'ignore' });
+        child.unref();
+    }
+    catch {
+        // best-effort · the URL is already printed
+    }
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* disconnect                                                                 */
+/* ──────────────────────────────────────────────────────────────────────── */
+async function disconnect(providerArg, json) {
+    if (!providerArg) {
+        process.stderr.write(colors.error(`${symbols.error} Need a provider id: codehere context-source disconnect <id>\n`));
+        return 2;
+    }
+    const r = await fetchJson(`/api/context-sources/${encodeURIComponent(providerArg)}/disconnect`, { method: 'POST' });
+    if (!r.ok) {
+        if (json) {
+            process.stdout.write(JSON.stringify({ error: 'disconnect_failed', detail: r.error }, null, 2) + '\n');
+        }
+        else {
+            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
+        }
+        return 2;
+    }
+    if (json) {
+        process.stdout.write(JSON.stringify(r.data) + '\n');
+        return 0;
+    }
+    if (r.data?.ok) {
+        process.stdout.write(colors.green(`${symbols.success} disconnected ${providerArg}\n`));
+    }
+    else {
+        process.stdout.write(colors.gray(`${symbols.dot} ${providerArg} was not connected\n`));
+    }
+    return 0;
+}
+//# sourceMappingURL=context-source-command.js.map