codehere 0.6.1 → 0.7.0

package/dist/presentation/cli/commands/help-command.js

@@ -91,7 +91,57 @@ const COMMAND_INFO = {
             { flag: '--json', description: 'Output as JSON' },
             { flag: '--export <fmt>', description: 'Export raw audit feed (jsonl, json, csv, md)' },
         ],
-        related: ['hook', 'trust'],
+        related: ['hook', 'trust', 'verify'],
+    },
+    verify: {
+        name: 'verify',
+        description: "Verify a session's Final Report against the recorded reality (catches optimistic claims)",
+        usage: 'codehere verify [session-id] [options]',
+        examples: ['codehere verify', 'codehere verify a1b2c3d4', 'codehere verify a1b2c3d4 --json'],
+        options: [{ flag: '--json', description: 'Machine-readable verdict for CI' }],
+        related: ['status', 'report', 'audit'],
+    },
+    audit: {
+        name: 'audit',
+        description: 'Inspect the hash-chained audit log · verify integrity or show one entry',
+        usage: 'codehere audit [verify|show <seq>] [options]',
+        examples: ['codehere audit', 'codehere audit verify', 'codehere audit verify --json', 'codehere audit show 42'],
+        options: [{ flag: '--json', description: 'Machine-readable output' }],
+        related: ['status', 'verify', 'hook'],
+    },
+    'context-source': {
+        name: 'context-source',
+        description: 'Connect external tools (Linear, Figma) via OAuth · list status · disconnect',
+        usage: 'codehere context-source [list|connect <provider>|disconnect <provider>]',
+        examples: [
+            'codehere context-source list',
+            'codehere context-source connect linear',
+            'codehere context-source connect figma --no-open',
+            'codehere context-source disconnect linear',
+        ],
+        options: [
+            { flag: '--json', description: 'Machine-readable output' },
+            { flag: '--no-open', description: 'For connect: print URL but skip auto-opening the browser' },
+        ],
+        related: ['serve', 'start'],
+    },
+    thread: {
+        name: 'thread',
+        description: 'Share or import a signed session bundle · local-first, no relay',
+        usage: 'codehere thread <export|import|keys|trust|untrust> [args] [options]',
+        examples: [
+            'codehere thread export <session-id> --out my-task.codehere.json',
+            'codehere thread import my-task.codehere.json',
+            'codehere thread import my-task.codehere.json --trust',
+            'codehere thread keys',
+            'codehere thread trust <pubkey-b64> "alice@laptop"',
+        ],
+        options: [
+            { flag: '--out <file>', description: 'For export: write to file (otherwise stdout)' },
+            { flag: '--trust', description: 'For import: trust the signer key then proceed' },
+            { flag: '--json', description: 'Machine-readable output' },
+        ],
+        related: ['start', 'verify'],
     },
     serve: {
         name: 'serve',

package/dist/presentation/cli/commands/init-command.js

@@ -39,7 +39,7 @@
  * Refuses to follow symlinks (lstat check) so a hostile/misplaced symlink at
  * `.codehere/CONTEXT.md` or `.gitignore` cannot redirect writes outside the repo.
  */
-import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, lstatSync, statSync, symlinkSync, readlinkSync, rmSync } from 'fs';
+import { existsSync, mkdirSync, writeFileSync, readFileSync, appendFileSync, lstatSync, statSync, symlinkSync, readlinkSync, rmSync, } from 'fs';
 import { homedir } from 'os';
 import { join, dirname } from 'path';
 import { colors, success, info, warning, error, newline } from '../../../ui.js';
@@ -316,7 +316,7 @@ function findSymlinkAncestor(codehereDir, relativePath) {
     // Defensive: reject any relative path containing .. — even though templates
     // are hard-coded, this protects against future schema additions slipping a
     // traversal through.
-    if (segments.some(seg => seg === '..' || seg === '')) {
+    if (segments.some((seg) => seg === '..' || seg === '')) {
         return relativePath;
     }
     // Walk codehereDir, codehereDir/seg1, codehereDir/seg1/seg2, ... (excluding
@@ -338,12 +338,13 @@ function ensureGitignore(repoRoot) {
         return { result: 'refused-symlink', addedLines: 0 };
     const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf8') : '';
     // De-duplicate: only append lines that aren't already present.
-    const missing = GITIGNORE_LINES.filter(line => !existing.includes(line));
+    const missing = GITIGNORE_LINES.filter((line) => !existing.includes(line));
     if (missing.length === 0)
         return { result: 'already-present', addedLines: 0 };
     const block = (existing.length > 0 && !existing.endsWith('\n') ? '\n' : '') +
         `\n${GITIGNORE_MARKER}\n` +
-        missing.join('\n') + '\n';
+        missing.join('\n') +
+        '\n';
     appendFileSync(gitignorePath, block);
     return { result: 'updated', addedLines: missing.length };
 }

package/dist/presentation/cli/commands/memory-command.js

@@ -48,7 +48,7 @@ import { buildMemoryPrefix } from '../../../infrastructure/orchestration/memory-
  * Built lazily from init-command.ts's F3_TEMPLATES so the seed bodies stay
  * in one place — no duplication, no drift.
  */
-const DEFAULT_SEED_BODIES = new Map(F3_TEMPLATES.map(t => [t.filename, t.body]));
+const DEFAULT_SEED_BODIES = new Map(F3_TEMPLATES.map((t) => [t.filename, t.body]));
 function lessonIdForText(text) {
     return createHash('sha256').update(text).digest('hex').slice(0, 16);
 }
@@ -58,8 +58,8 @@ function readLessonsFile(path) {
     return readFileSync(path, 'utf8')
         .trim()
         .split('\n')
-        .filter(l => l.length > 0)
-        .map(l => {
+        .filter((l) => l.length > 0)
+        .map((l) => {
         try {
             return JSON.parse(l);
         }
@@ -83,7 +83,7 @@ function readLessonsFile(path) {
 function appendLessonIfNew(path, text, source) {
     const id = lessonIdForText(text);
     const existing = readLessonsFile(path);
-    const dup = existing.find(l => l.id === id);
+    const dup = existing.find((l) => l.id === id);
     if (dup)
         return { result: 'duplicate', lesson: dup };
     const lesson = {
@@ -326,7 +326,9 @@ function gatherLayerSummary(codehereDir, projectRoot) {
     const episodicLearnings = join(codehereDir, 'memory/episodic/AGENT_LEARNINGS.jsonl');
     const repoMapPath = join(codehereDir, 'memory/episodic/repo_map.json');
     const learningsLine = existsSync(episodicLearnings) || isSymlink(episodicLearnings)
-        ? (isSymlink(episodicLearnings) ? `AGENT_LEARNINGS.jsonl → ${readlinkSync(episodicLearnings)}` : 'AGENT_LEARNINGS.jsonl (real file)')
+        ? isSymlink(episodicLearnings)
+            ? `AGENT_LEARNINGS.jsonl → ${readlinkSync(episodicLearnings)}`
+            : 'AGENT_LEARNINGS.jsonl (real file)'
         : '(no AGENT_LEARNINGS.jsonl)';
     const repoMapLine = existsSync(repoMapPath)
         ? `repo_map.json (${fmtSize(statSync(repoMapPath).size)})`
@@ -354,9 +356,12 @@ function gatherLayerSummary(codehereDir, projectRoot) {
     const skillsDir = join(codehereDir, 'skills');
     if (existsSync(skillsDir)) {
         const subdirs = readdirSync(skillsDir, { withFileTypes: true })
-            .filter(e => e.isDirectory())
-            .filter(e => existsSync(join(skillsDir, e.name, 'SKILL.md')));
-        out.push({ layer: 'skills', line: `skills     · ${subdirs.length} skill folder${subdirs.length === 1 ? '' : 's'}` });
+            .filter((e) => e.isDirectory())
+            .filter((e) => existsSync(join(skillsDir, e.name, 'SKILL.md')));
+        out.push({
+            layer: 'skills',
+            line: `skills     · ${subdirs.length} skill folder${subdirs.length === 1 ? '' : 's'}`,
+        });
     }
     else {
         out.push({ layer: 'skills', line: `skills     · (no skills/ dir)` });
@@ -368,7 +373,10 @@ function gatherLayerSummary(codehereDir, projectRoot) {
             const parsed = JSON.parse(readFileSync(patternsPath, 'utf8'));
             const builtin = Array.isArray(parsed.patterns_builtin) ? parsed.patterns_builtin.length : 0;
             const project = Array.isArray(parsed.patterns_project) ? parsed.patterns_project.length : 0;
-            out.push({ layer: 'protocols', line: `protocols  · hook_patterns.json (${builtin} built-in + ${project} project)` });
+            out.push({
+                layer: 'protocols',
+                line: `protocols  · hook_patterns.json (${builtin} built-in + ${project} project)`,
+            });
         }
         catch {
             out.push({ layer: 'protocols', line: `protocols  · hook_patterns.json (parse error)` });
@@ -389,7 +397,10 @@ function gatherLayerSummary(codehereDir, projectRoot) {
     }
     else {
         const truncNote = inj.truncated ? ' TRUNCATED' : '';
-        out.push({ layer: 'injection', line: `injection  · ${inj.tokens} tokens · ${inj.included.join(', ')}${truncNote}` });
+        out.push({
+            layer: 'injection',
+            line: `injection  · ${inj.tokens} tokens · ${inj.included.join(', ')}${truncNote}`,
+        });
     }
     return out;
 }
@@ -526,7 +537,10 @@ function executeMemoryShow(layerArg) {
                 console.log(`  ${info('empty  ')} no lessons.jsonl yet`);
                 break;
             }
-            const lines = readFileSync(path, 'utf8').trim().split('\n').filter(l => l.length > 0);
+            const lines = readFileSync(path, 'utf8')
+                .trim()
+                .split('\n')
+                .filter((l) => l.length > 0);
             if (lines.length === 0) {
                 console.log(`  ${info('empty  ')} lessons.jsonl is empty — run ${colors.cyan('codehere memory graduate')} (coming in v0.5)`);
                 break;
@@ -561,8 +575,8 @@ function executeMemoryShow(layerArg) {
                 break;
             }
             const subdirs = readdirSync(skillsDir, { withFileTypes: true })
-                .filter(e => e.isDirectory())
-                .filter(e => existsSync(join(skillsDir, e.name, 'SKILL.md')));
+                .filter((e) => e.isDirectory())
+                .filter((e) => existsSync(join(skillsDir, e.name, 'SKILL.md')));
             if (subdirs.length === 0) {
                 console.log(`  ${info('empty  ')} no skill folders yet (skills/<name>/SKILL.md)`);
                 break;
@@ -907,8 +921,8 @@ function executeMemoryInit(options) {
     }
     // Idempotency hint when nothing was actually migrated.
     const allOutcomes = [contextOutcome, handoverOutcome, promptsResult.outcome];
-    const anyMigrated = allOutcomes.some(o => o === 'migrated');
-    const allAlreadyOrMissing = allOutcomes.every(o => o === 'already-migrated' || o === 'missing');
+    const anyMigrated = allOutcomes.some((o) => o === 'migrated');
+    const allAlreadyOrMissing = allOutcomes.every((o) => o === 'already-migrated' || o === 'missing');
     if (!anyMigrated && allAlreadyOrMissing) {
         newline();
         console.log(`  ${info('no-op')} everything already migrated or no source files to migrate.`);

package/dist/presentation/cli/commands/protocols-builder.js

@@ -122,8 +122,8 @@ export function buildHookPatternsExport() {
         source: 'agent/src/infrastructure/security/trust-scorer.ts',
         _note: "Exported from codehere's trust-scorer pattern bank via 'codehere protocols export'. " +
             "DO NOT hand-edit `patterns_builtin[]` — it's regenerated on every export. " +
-            "Add project-specific patterns to `patterns_project[]` — those are preserved across re-exports. " +
-            "Pattern ids are stable slugs of category + description; reference them deterministically.",
+            'Add project-specific patterns to `patterns_project[]` — those are preserved across re-exports. ' +
+            'Pattern ids are stable slugs of category + description; reference them deterministically.',
         patterns_builtin: builtin,
         patterns_project: [],
     };

package/dist/presentation/cli/commands/repo-map-builder.js

@@ -107,8 +107,8 @@ function gitListFiles(repoRoot) {
         return null;
     return r.stdout
         .split('\0')
-        .filter(p => p.length > 0)
-        .filter(p => SUPPORTED_EXTENSIONS.has(extname(p)));
+        .filter((p) => p.length > 0)
+        .filter((p) => SUPPORTED_EXTENSIONS.has(extname(p)));
 }
 /**
  * Count references to a symbol name across the repo via git grep.
@@ -191,13 +191,13 @@ export function buildRepoMap(repoRoot) {
     // acceptable for v0.5 — codehere's own 249-symbol repo runs in ~5s.
     // v0.6's tree-sitter port will swap raw grep for AST-aware reference
     // resolution + PageRank, which is faster AND more accurate.
-    const uniqueNames = Array.from(new Set(allSymbols.map(s => s.name)));
+    const uniqueNames = Array.from(new Set(allSymbols.map((s) => s.name)));
     const refCounts = new Map();
     for (const name of uniqueNames) {
         refCounts.set(name, countReferences(repoRoot, name));
     }
     const topSymbols = allSymbols
-        .map(s => ({ ...s, references: refCounts.get(s.name) ?? 0 }))
+        .map((s) => ({ ...s, references: refCounts.get(s.name) ?? 0 }))
         // Stable sort: references DESC, then name ASC for tie-breaking.
         .sort((a, b) => b.references - a.references || a.name.localeCompare(b.name))
         .slice(0, 50);

package/dist/presentation/cli/commands/report-command.js

@@ -49,7 +49,7 @@ function badgeUrl(score, grade) {
     return `https://img.shields.io/badge/codehere%20trust-${score}%25%20${grade}-${color}?logo=shield&logoColor=white`;
 }
 function narrativeSummary(report) {
-    const { overallScore, grade, criticalCount, highCount, mediumCount, lowCount, files } = report;
+    const { overallScore, criticalCount, highCount, mediumCount, files } = report;
     if (criticalCount === 0 && highCount === 0) {
         if (overallScore >= 90) {
             return (`Clean codebase. ${files.length} file${files.length !== 1 ? 's' : ''} scanned, nothing blocking a merge. ` +
@@ -66,7 +66,7 @@ function narrativeSummary(report) {
     return `No critical issues, but ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} worth addressing before merge.`;
 }
 function recommendationsMarkdown(report) {
-    const { criticalCount, highCount, mediumCount, lowCount, overallScore } = report;
+    const { criticalCount, highCount, mediumCount, lowCount } = report;
     const lines = [];
     if (criticalCount > 0) {
         lines.push(`1. **Resolve all ${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} before merging.** These represent active security risks (credentials in code, eval injection, SQL without parameterization, etc.). They're usually quick fixes.`);
@@ -85,7 +85,7 @@ function recommendationsMarkdown(report) {
     }
     return lines.join('\n\n');
 }
-function findingsMarkdown(files, cwd) {
+function findingsMarkdown(files) {
     const sections = [];
     for (const severity of ['critical', 'high', 'medium', 'low']) {
         const allFindings = [];
@@ -133,6 +133,8 @@ ${contextLine}
 
 ## Summary
 
+${summary}
+
 | | |
 |---|---|
 | Files scanned | ${files.length} |
@@ -145,7 +147,7 @@ ${contextLine}
 
 ## Findings
 
-${findingsMarkdown(files, cwd)}
+${findingsMarkdown(files)}
 
 ---
 

package/dist/presentation/cli/commands/setup-command.js

@@ -6,9 +6,47 @@
 import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { getConfigManager } from '../../../infrastructure/config/config-manager.js';
-import { colors, separator, newline, sectionHeader, success, error, warning, info, } from '../../../ui.js';
+import { colors, separator, newline, sectionHeader, success, error, warning, info } from '../../../ui.js';
 import { executionTracer } from '../../../infrastructure/observability/execution-tracer.js';
 import { findCodebaseRoot } from '../../../domain/services/codebase-detector.js';
+import { readinessForAllAgents } from '../../../infrastructure/orchestration/session-manager.js';
+/**
+ * What codehere actually needs to run a task: at least one coding-agent CLI
+ * that's installed AND signed in. Most engineers have `claude` or `codex`
+ * logged in by subscription with no API key set, so framing setup around
+ * `ANTHROPIC_API_KEY` told them they were blocked when they weren't. This
+ * reuses the same readiness check that powers the web dashboard's squad bar.
+ */
+function summarizeAgents() {
+    let all;
+    try {
+        all = readinessForAllAgents();
+    }
+    catch {
+        all = [];
+    }
+    return { ready: all.filter((a) => a.state === 'ready'), all };
+}
+/** One status line per agent, plain English. Used by both the TTY wizard and
+ *  the non-TTY summary so they say the same thing. */
+function printAgentLines(all) {
+    for (const a of all) {
+        if (a.state === 'ready') {
+            console.log(success(`${a.label}: ready`));
+        }
+        else if (a.state === 'needs_auth') {
+            const hint = a.authHint?.command ? colors.dim(`  (sign in: ${a.authHint.command})`) : '';
+            console.log(warning(`${a.label}: installed, needs sign-in`) + hint);
+        }
+        else if (a.state === 'billed_key_required') {
+            console.log(colors.dim(`○ ${a.label}: needs a billed API key (paid)`));
+        }
+        else {
+            const hint = a.installHint?.command ? colors.dim(`  (install: ${a.installHint.command})`) : '';
+            console.log(colors.dim(`○ ${a.label}: not installed`) + hint);
+        }
+    }
+}
 /**
  * Check if any API key is configured
  */
@@ -113,19 +151,26 @@ export async function executeSetupCommand(force = false) {
     // Check for interactive terminal
     const isTTY = process.stdin.isTTY && process.stdout.isTTY;
     if (!isTTY) {
-        console.log(colors.bold('Setup Wizard'));
+        const { ready, all } = summarizeAgents();
+        console.log(colors.bold('Setup'));
         console.log();
-        console.log(warning('Interactive terminal required.'));
+        if (all.length)
+            printAgentLines(all);
         console.log();
-        console.log('Set an API key in your environment:');
-        console.log(colors.cyan('  export ANTHROPIC_API_KEY=sk-ant-...') + colors.dim('  (recommended)'));
-        console.log(colors.cyan('  export OPENAI_API_KEY=sk-...'));
-        console.log(colors.cyan('  export COHERE_API_KEY=...'));
+        if (ready.length) {
+            console.log(success(`You're ready. ${ready[0].label} is set up.`));
+            console.log(colors.dim('  Next: codehere start   (open the dashboard)'));
+        }
+        else {
+            console.log(warning('No coding agent is set up yet. Install or sign in to one:'));
+            console.log(colors.cyan('  npm i -g @anthropic-ai/claude-code') + colors.dim('   then run: claude   (sign in)'));
+            console.log(colors.dim('  Already use one by API key? export ANTHROPIC_API_KEY=sk-ant-...'));
+        }
         return;
     }
     // Start execution tracing
     const codebaseInfo = findCodebaseRoot(process.cwd());
-    const runId = executionTracer.startRun('setup', {
+    executionTracer.startRun('setup', {
         codebaseId: codebaseInfo?.rootPath || process.cwd(),
     });
     try {
@@ -147,21 +192,29 @@ export async function executeSetupCommand(force = false) {
             codebaseDetected: false,
             configPath: join(process.cwd(), 'data'),
         };
-        // Step 1: API Key
-        sectionHeader('Step 1: API Key Configuration');
+        // Step 1: Coding agents — codehere drives agent CLIs, not raw API keys.
+        sectionHeader('Step 1: Your coding agents');
+        const { ready, all } = summarizeAgents();
+        if (all.length)
+            printAgentLines(all);
+        newline();
         const apiKeyCheck = checkAPIKey();
-        if (apiKeyCheck.configured) {
-            console.log(success(`API Key: ${apiKeyCheck.provider} key found`));
-            console.log(colors.dim(`  Key preview: ${apiKeyCheck.key?.substring(0, 8)}...${apiKeyCheck.key?.substring(apiKeyCheck.key.length - 4)}`));
+        if (ready.length) {
+            console.log(success(`You're ready. ${ready[0].label} is set up.`));
+            result.apiKeyConfigured = true; // at least one agent can spawn right now
+        }
+        else if (apiKeyCheck.configured) {
+            // No agent CLI ready, but a key is present — some adapters (e.g. Aider) run off it.
+            console.log(success(`${apiKeyCheck.provider} API key found.`));
+            console.log(colors.dim('  No agent CLI detected yet — install one for the full experience.'));
             result.apiKeyConfigured = true;
         }
         else {
-            console.log(warning('API Key: Not configured'));
+            console.log(warning('No coding agent is set up yet.'));
             newline();
-            console.log(colors.bold('Set one of these environment variables:'));
-            console.log(colors.cyan('  export ANTHROPIC_API_KEY=sk-ant-...') + colors.dim('  (recommended)'));
-            console.log(colors.cyan('  export OPENAI_API_KEY=sk-...'));
-            console.log(colors.cyan('  export COHERE_API_KEY=...'));
+            console.log(colors.bold('Install or sign in to at least one:'));
+            console.log(colors.cyan('  npm i -g @anthropic-ai/claude-code') + colors.dim('   then run: claude   (sign in)'));
+            console.log(colors.dim('  Already use one by API key? export ANTHROPIC_API_KEY=sk-ant-...'));
             newline();
         }
         newline();

package/dist/presentation/cli/commands/status-command.js

@@ -185,10 +185,6 @@ function extractFilePath(entry) {
     }
     return null;
 }
-function shortReason(entry, maxLen = 60) {
-    const r = extractBlockReason(entry);
-    return r.length <= maxLen ? r : r.substring(0, maxLen - 1) + '…';
-}
 const BLOCK_CATEGORY_LABEL = {
     'self-test': "codehere's own canary tests",
     'cache-cleanup': 'routine cache/tmp deletion',