codehere 0.6.1 → 0.7.0

package/dist/presentation/cli/commands/thread-command.js

@@ -0,0 +1,288 @@
+/**
+ * CLI: `codehere thread` · v0.8 S4 · signed-payload share + import
+ *
+ * Subcommands:
+ *   export <session-id> [--out <file>] [--json]
+ *       Sign the session bundle and write it to <file> (or stdout when no --out).
+ *   import <file> [--trust] [--json]
+ *       Verify the signature. If the signer's key isn't trusted, refuse unless
+ *       --trust is set OR the user is on a TTY and confirms. On valid+trusted,
+ *       merge the session into ~/.codehere/sessions.jsonl so it appears in the
+ *       dashboard.
+ *   keys                   · print the local public key
+ *   trust <pubkey> [label] · add a public key to the trusted set
+ *   untrust <pubkey>       · remove
+ *
+ * No network. Both export and import are local file operations.
+ */
+import { existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync } from 'fs';
+import { homedir, hostname } from 'os';
+import { dirname, join, isAbsolute, resolve } from 'path';
+import { colors, symbols } from '../../../ui.js';
+import { signBundle, verifyBundle, shortFingerprint, } from '../../../application/use-cases/thread-export.js';
+import { loadOrCreateKeypair, localPublicKeyBase64, trustKey, untrustKey, trustedKeySet, loadTrustedKeys, isKeyTrusted, } from '../../../infrastructure/orchestration/thread-key-store.js';
+import { loadSessionById } from '../../../infrastructure/orchestration/session-persistence.js';
+import { getVersion } from '../../../utils/version.js';
+export function executeThreadCommand(sub, arg, extra, options = {}) {
+    switch (sub) {
+        case 'export':
+            return exportThread(arg, options);
+        case 'import':
+            return importThread(arg, options);
+        case 'keys':
+            return showKeys(options.json ?? false);
+        case 'trust':
+            return trustCmd(arg, options.label, options.json ?? false);
+        case 'untrust':
+            return untrustCmd(arg, options.json ?? false);
+        default:
+            process.stderr.write(colors.error(`${symbols.error} Unknown subcommand: ${sub ?? '(none)'}\n`) +
+                colors.dim('Try: codehere thread export <id> | import <file> | keys | trust <key> | untrust <key>\n'));
+            return 2;
+    }
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* export                                                                    */
+/* ──────────────────────────────────────────────────────────────────────── */
+function exportThread(sessionId, options) {
+    if (!sessionId) {
+        process.stderr.write(colors.error(`${symbols.error} Need a session id\n`));
+        return 2;
+    }
+    const session = loadSessionById(sessionId);
+    if (!session) {
+        process.stderr.write(colors.error(`${symbols.error} No session found matching "${sessionId}"\n`));
+        return 2;
+    }
+    const keys = loadOrCreateKeypair();
+    const body = {
+        schema: 1,
+        kind: 'thread',
+        sessionId: session.sessionId,
+        session,
+        exporter: {
+            hostname: safeHostname(),
+            codehereVersion: getVersion(),
+        },
+        exportedAt: new Date().toISOString(),
+    };
+    const bundle = signBundle(body, keys);
+    const text = JSON.stringify(bundle, null, 2);
+    if (options.out) {
+        const outPath = isAbsolute(options.out) ? options.out : resolve(process.cwd(), options.out);
+        mkdirSync(dirname(outPath), { recursive: true });
+        writeFileSync(outPath, text, 'utf-8');
+        if (options.json) {
+            process.stdout.write(JSON.stringify({ ok: true, path: outPath, fingerprint: shortFingerprint(bundle.publicKey) }) + '\n');
+        }
+        else {
+            process.stdout.write(colors.green(`${symbols.success} Exported`) +
+                colors.dim(`  ${outPath}\n`) +
+                colors.dim(`   signed by ${shortFingerprint(bundle.publicKey)}\n`) +
+                colors.dim(`   share via Slack/email/PR · recipient runs:  `) +
+                colors.bold(`codehere thread import ${outPath}\n`));
+        }
+        return 0;
+    }
+    // No --out · print to stdout (machine-pipe-friendly)
+    process.stdout.write(text + '\n');
+    return 0;
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* import                                                                    */
+/* ──────────────────────────────────────────────────────────────────────── */
+function importThread(filePath, options) {
+    if (!filePath) {
+        process.stderr.write(colors.error(`${symbols.error} Need a file path\n`));
+        return 2;
+    }
+    const fp = isAbsolute(filePath) ? filePath : resolve(process.cwd(), filePath);
+    if (!existsSync(fp)) {
+        process.stderr.write(colors.error(`${symbols.error} Not found: ${fp}\n`));
+        return 2;
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(fp, 'utf-8'));
+    }
+    catch (err) {
+        process.stderr.write(colors.error(`${symbols.error} Invalid JSON: ${err instanceof Error ? err.message : String(err)}\n`));
+        return 2;
+    }
+    const verdict = verifyBundle(raw, trustedKeySet());
+    if (verdict.status === 'malformed') {
+        if (options.json) {
+            process.stdout.write(JSON.stringify({ ok: false, error: 'malformed', detail: verdict.reason }) + '\n');
+        }
+        else {
+            process.stderr.write(colors.error(`${symbols.error} Malformed bundle: ${verdict.reason}\n`));
+        }
+        return 2;
+    }
+    if (verdict.status === 'tampered') {
+        if (options.json) {
+            process.stdout.write(JSON.stringify({ ok: false, error: 'tampered', detail: verdict.reason }) + '\n');
+        }
+        else {
+            process.stderr.write(colors.error(`${symbols.error} Signature INVALID · refusing to import\n`) +
+                colors.dim(`   ${verdict.reason}\n`));
+        }
+        return 1;
+    }
+    // status: 'valid' or 'unknown_key'
+    const bundle = verdict.status === 'valid' ? verdict.bundle : verdict.bundle;
+    const fp_key = shortFingerprint(bundle.publicKey);
+    if (verdict.status === 'unknown_key') {
+        if (!options.trust) {
+            if (options.json) {
+                process.stdout.write(JSON.stringify({
+                    ok: false,
+                    error: 'unknown_key',
+                    publicKey: bundle.publicKey,
+                    fingerprint: fp_key,
+                    hint: 'Re-run with --trust to add this key to your trust store and import.',
+                }) + '\n');
+            }
+            else {
+                process.stderr.write(colors.warning(`${symbols.warning} Signer's key is not in your trust store\n`) +
+                    colors.dim(`   fingerprint: ${fp_key}\n`) +
+                    colors.dim(`   The signature is cryptographically valid but you've never trusted this key.\n`) +
+                    colors.dim(`   To trust + import:  `) +
+                    colors.bold(`codehere thread import ${fp} --trust\n`) +
+                    colors.dim(`   To inspect first:   `) +
+                    colors.bold(`codehere thread trust ${bundle.publicKey} <label>`) +
+                    '\n');
+            }
+            return 2;
+        }
+        // --trust set · add key to store and continue
+        trustKey(bundle.publicKey, options.label);
+    }
+    // Persist into ~/.codehere/sessions.jsonl as 3 records (spawned, completed, finalReport)
+    const ses = bundle.body.session;
+    const home = process.env.CODEHERE_HOME || homedir();
+    const sessionsPath = join(home, '.codehere', 'sessions.jsonl');
+    mkdirSync(dirname(sessionsPath), { recursive: true });
+    const lines = [];
+    lines.push(JSON.stringify({
+        t: 'spawned',
+        id: ses.sessionId,
+        agent: ses.agent,
+        prompt: ses.prompt,
+        cwd: ses.cwd,
+        startedAt: ses.startedAt,
+    }));
+    lines.push(JSON.stringify({
+        t: 'completed',
+        id: ses.sessionId,
+        status: ses.status,
+        durationMs: ses.durationMs,
+        completedAt: ses.completedAt,
+        steps: ses.steps,
+        artifacts: ses.artifacts,
+    }));
+    if (ses.finalReport) {
+        lines.push(JSON.stringify({
+            t: 'finalReport',
+            id: ses.sessionId,
+            summary: ses.finalReport.summary,
+            generatedAt: ses.finalReport.generatedAt,
+            durationMs: ses.finalReport.durationMs,
+        }));
+    }
+    appendFileSync(sessionsPath, lines.join('\n') + '\n', 'utf-8');
+    if (options.json) {
+        process.stdout.write(JSON.stringify({
+            ok: true,
+            sessionId: ses.sessionId,
+            trusted: verdict.status === 'valid' ? true : 'just-added',
+            fingerprint: fp_key,
+        }) + '\n');
+    }
+    else {
+        process.stdout.write(colors.green(`${symbols.success} Imported`) +
+            colors.dim(`  session ${ses.sessionId.slice(0, 8)} · signed by ${fp_key}\n`) +
+            colors.dim(`   view it:  `) +
+            colors.bold(`codehere start`) +
+            colors.dim(` then click the task in the dashboard\n`));
+    }
+    return 0;
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* keys / trust / untrust                                                    */
+/* ──────────────────────────────────────────────────────────────────────── */
+function showKeys(json) {
+    loadOrCreateKeypair();
+    const localB64 = localPublicKeyBase64() ?? '';
+    const trusted = loadTrustedKeys();
+    if (json) {
+        process.stdout.write(JSON.stringify({
+            local: { publicKey: localB64, fingerprint: shortFingerprint(localB64) },
+            trusted: Object.entries(trusted.keys).map(([k, v]) => ({
+                publicKey: k,
+                fingerprint: shortFingerprint(k),
+                label: v.label,
+                addedAt: v.addedAt,
+            })),
+        }, null, 2) + '\n');
+        return 0;
+    }
+    process.stdout.write('\n' + colors.bold('This machine') + '\n');
+    process.stdout.write('  ' + colors.cyan(shortFingerprint(localB64)) + colors.dim('  signs your exports\n\n'));
+    process.stdout.write(colors.bold('Trusted keys') + colors.dim('  (imports from these accepted silently)\n'));
+    const entries = Object.entries(trusted.keys);
+    if (entries.length === 0) {
+        process.stdout.write('  ' + colors.dim('(empty)\n'));
+    }
+    else {
+        for (const [k, v] of entries) {
+            const label = v.label || '(no label)';
+            process.stdout.write('  ' + colors.cyan(shortFingerprint(k)) + '  ' + colors.dim(label) + '\n');
+        }
+    }
+    process.stdout.write('\n' + colors.dim('Add a key:    ') + colors.bold('codehere thread trust <pubkey> <label>') + '\n');
+    process.stdout.write(colors.dim('Remove a key: ') + colors.bold('codehere thread untrust <pubkey>') + '\n\n');
+    return 0;
+}
+function trustCmd(pubkey, label, json) {
+    if (!pubkey) {
+        process.stderr.write(colors.error(`${symbols.error} Need a public key (base64)\n`));
+        return 2;
+    }
+    trustKey(pubkey, label);
+    if (json) {
+        process.stdout.write(JSON.stringify({ ok: true, fingerprint: shortFingerprint(pubkey) }) + '\n');
+    }
+    else {
+        process.stdout.write(colors.green(`${symbols.success} trusted ${shortFingerprint(pubkey)}\n`));
+    }
+    return 0;
+}
+function untrustCmd(pubkey, json) {
+    if (!pubkey) {
+        process.stderr.write(colors.error(`${symbols.error} Need a public key (base64)\n`));
+        return 2;
+    }
+    const ok = untrustKey(pubkey);
+    if (json) {
+        process.stdout.write(JSON.stringify({ ok }) + '\n');
+    }
+    else if (ok) {
+        process.stdout.write(colors.green(`${symbols.success} untrusted ${shortFingerprint(pubkey)}\n`));
+    }
+    else {
+        process.stdout.write(colors.gray(`${symbols.dot} key not in trust store (or it's this machine's own key — can't remove)\n`));
+    }
+    return 0;
+}
+function safeHostname() {
+    try {
+        return hostname();
+    }
+    catch {
+        return undefined;
+    }
+}
+// Public alias for the connection-status check used in the daemon HTTP routes.
+export { isKeyTrusted };
+//# sourceMappingURL=thread-command.js.map

package/dist/presentation/cli/commands/verify-command.js

@@ -0,0 +1,233 @@
+/**
+ * CLI command: verify
+ *
+ * v0.7 verifier-agent · Slice 2 (CLI surface for the pure verify-claim use case).
+ *
+ * Compares what the agent's Final Report TEXT claims against the structured
+ * reality (artifacts + steps) captured during the session. Catches the
+ * easy lies before they reach a PR description.
+ *
+ * Usage:
+ *   codehere verify <session-id>          # run verifier on a completed session
+ *   codehere verify <session-id> --json   # machine-readable output for CI
+ *   codehere verify                       # list recent sessions to pick from
+ *
+ * Exit codes:
+ *   0 = verified OR partial (warnings only · unverifiable claims)
+ *   0 = no-report (nothing to verify; not a failure)
+ *   1 = broken (at least one claim contradicts recorded reality)
+ *   2 = session not found / invalid input
+ *
+ * The verifier is intentionally conservative: only claims that map to
+ * structured data are checked. Prose claims pass through silently.
+ */
+import { colors, symbols } from '../../../ui.js';
+import { loadSessionById, loadRecent, } from '../../../infrastructure/orchestration/session-persistence.js';
+import { verifyClaim } from '../../../application/use-cases/verify-claim.js';
+export async function executeVerifyCommand(sessionId, options = {}) {
+    // No session id: show a picker list and exit gracefully.
+    if (!sessionId) {
+        return showSessionPicker(options.json ?? false);
+    }
+    const session = loadSessionById(sessionId);
+    if (!session) {
+        if (options.json) {
+            process.stdout.write(JSON.stringify({
+                error: 'session-not-found',
+                sessionId,
+                hint: 'Run `codehere verify` (no args) to list recent sessions.',
+            }, null, 2) + '\n');
+        }
+        else {
+            process.stderr.write(colors.error(`${symbols.error} No completed session found matching "${sessionId}".\n`) +
+                colors.dim('   Tip: run `codehere verify` (no args) to see recent sessions.\n'));
+        }
+        return 2;
+    }
+    const result = verifyClaim({
+        summary: session.finalReport?.summary,
+        artifacts: session.artifacts,
+        steps: session.steps,
+    });
+    if (options.json) {
+        process.stdout.write(JSON.stringify(serializeResult(session, result), null, 2) + '\n');
+    }
+    else {
+        printHumanReadable(session, result);
+    }
+    // Exit code: only `broken` is a hard failure (CI-friendly).
+    return result.status === 'broken' ? 1 : 0;
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* Picker mode · no session id given                                         */
+/* ──────────────────────────────────────────────────────────────────────── */
+function showSessionPicker(json) {
+    const recent = loadRecent(15);
+    if (recent.length === 0) {
+        if (json) {
+            process.stdout.write(JSON.stringify({ sessions: [], note: 'No completed sessions found.' }, null, 2) + '\n');
+        }
+        else {
+            process.stdout.write(colors.dim('No completed sessions found. Run a task first, then verify it:\n') +
+                colors.dim('   codehere task "describe what you want done"\n'));
+        }
+        return 0;
+    }
+    if (json) {
+        const items = recent.map((s) => ({
+            sessionId: s.sessionId,
+            agent: s.agent,
+            prompt: s.prompt,
+            completedAt: s.completedAt,
+            hasFinalReport: Boolean(s.finalReport),
+        }));
+        process.stdout.write(JSON.stringify({ sessions: items }, null, 2) + '\n');
+        return 0;
+    }
+    process.stdout.write('\n' + colors.bold('Recent sessions') + colors.dim('  (pass --json for machine output)\n\n'));
+    for (const s of recent) {
+        const shortId = s.sessionId.slice(0, 8);
+        const when = formatRelativeTime(s.completedAt);
+        const reportTag = s.finalReport ? colors.gray('· report ✓') : colors.gray('· no report');
+        const promptLine = truncate(s.prompt.replace(/\s+/g, ' ').trim(), 70);
+        process.stdout.write(`  ${colors.cyan(shortId)}  ${colors.gray(s.agent.padEnd(11))}${colors.dim(when.padEnd(14))} ${reportTag}\n` +
+            `             ${colors.dim(promptLine)}\n\n`);
+    }
+    process.stdout.write(colors.dim('To verify one of these:  ') + colors.bold('codehere verify <id>') + '\n\n');
+    return 0;
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* Human-readable output                                                     */
+/* ──────────────────────────────────────────────────────────────────────── */
+function printHumanReadable(session, result) {
+    const shortId = session.sessionId.slice(0, 8);
+    const when = formatRelativeTime(session.completedAt);
+    // Header
+    process.stdout.write('\n' +
+        colors.dim('session ') +
+        colors.cyan(shortId) +
+        colors.dim(' · ') +
+        colors.gray(session.agent) +
+        colors.dim(' · ') +
+        colors.gray(when) +
+        '\n' +
+        colors.dim('task: ') +
+        truncate(session.prompt.replace(/\s+/g, ' ').trim(), 80) +
+        '\n\n');
+    // What the agent did — lead with the deliverable, not the audit. A
+    // non-technical user opening this wants "what happened" first, then "does
+    // it check out". Both come straight from recorded state (no screen lies).
+    if (session.finalReport?.summary) {
+        process.stdout.write(session.finalReport.summary.trim() + '\n\n');
+    }
+    // Files changed + trust, or the honest can't-track note.
+    const files = session.artifacts?.files ?? [];
+    if (session.artifacts?.noGitTracking) {
+        process.stdout.write(colors.dim("Files: codehere couldn't track changes here (this folder isn't a git repository).\n\n"));
+    }
+    else if (files.length > 0) {
+        process.stdout.write(colors.bold('Files changed:\n'));
+        for (const f of files) {
+            const trust = typeof f.trust === 'number' ? colors.dim(` · trust ${f.trust}/100`) : '';
+            process.stdout.write(`  • ${f.path}  ${colors.success('+' + f.added)}/${colors.error('-' + f.removed)}${trust}\n`);
+        }
+        process.stdout.write('\n');
+    }
+    // Verdict line · color-coded by status
+    const verdict = verdictLine(result);
+    process.stdout.write(colors.bold('Fact-check: ') + verdict + '\n\n');
+    // Findings detail
+    if (result.findings.length > 0 && result.status !== 'no-report') {
+        process.stdout.write(colors.bold('Findings:\n\n'));
+        for (let i = 0; i < result.findings.length; i++) {
+            const f = result.findings[i];
+            const num = colors.dim(`  ${(i + 1).toString().padStart(2)}. `);
+            const sev = severityTag(f.severity);
+            const kind = colors.gray(`[${f.kind}]`);
+            process.stdout.write(`${num}${sev} ${kind} ${f.message}\n`);
+            process.stdout.write(`      ${colors.dim('claim:')}   ${colors.gray(f.claim)}\n`);
+            process.stdout.write(`      ${colors.dim('reality:')} ${colors.gray(f.reality)}\n\n`);
+        }
+    }
+    // What was checked (so users know the verifier's scope)
+    process.stdout.write(colors.dim('What was checked:\n'));
+    process.stdout.write(colors.dim('  · numeric test claims (X tests passed, X of Y, etc) vs artifacts.tests\n'));
+    process.stdout.write(colors.dim('  · universal claims (all tests pass, no failures) vs artifacts.tests.failed\n'));
+    process.stdout.write(colors.dim('  · file claims (X files changed, no files changed) vs artifacts.files\n'));
+    process.stdout.write(colors.dim('Not checked: prose claims, intent, semantic correctness of changes.\n\n'));
+}
+function verdictLine(result) {
+    switch (result.status) {
+        case 'verified':
+            return colors.green(`${symbols.success} Verified`) + colors.dim('  ' + result.summary);
+        case 'partial':
+            return colors.warning(`${symbols.warning} Partial`) + colors.dim('  ' + result.summary);
+        case 'broken':
+            return colors.error(`${symbols.error} Broken`) + colors.dim('  ' + result.summary);
+        case 'no-report':
+            return colors.gray(`${symbols.dot} No report`) + colors.dim('  ' + result.summary);
+    }
+}
+function severityTag(sev) {
+    switch (sev) {
+        case 'fail':
+            return colors.error('fail');
+        case 'warn':
+            return colors.warning('warn');
+        case 'info':
+            return colors.info('info');
+    }
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* JSON serialization                                                        */
+/* ──────────────────────────────────────────────────────────────────────── */
+function serializeResult(session, result) {
+    return {
+        sessionId: session.sessionId,
+        agent: session.agent,
+        prompt: session.prompt,
+        completedAt: session.completedAt,
+        durationMs: session.durationMs,
+        hasFinalReport: Boolean(session.finalReport),
+        verdict: {
+            status: result.status,
+            summary: result.summary,
+            findings: result.findings.map((f) => ({
+                severity: f.severity,
+                kind: f.kind,
+                claim: f.claim,
+                reality: f.reality,
+                message: f.message,
+            })),
+        },
+    };
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* Small utilities                                                            */
+/* ──────────────────────────────────────────────────────────────────────── */
+function formatRelativeTime(ts) {
+    if (!ts || ts <= 0)
+        return 'unknown';
+    const deltaMs = Date.now() - ts;
+    if (deltaMs < 0)
+        return 'just now';
+    const seconds = Math.floor(deltaMs / 1000);
+    if (seconds < 60)
+        return `${seconds}s ago`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 24)
+        return `${hours}h ago`;
+    const days = Math.floor(hours / 24);
+    if (days < 30)
+        return `${days}d ago`;
+    return new Date(ts).toISOString().split('T')[0];
+}
+function truncate(s, max) {
+    if (s.length <= max)
+        return s;
+    return s.slice(0, max - 1).trimEnd() + '…';
+}
+//# sourceMappingURL=verify-command.js.map

package/dist/presentation/cli/error-display.js

@@ -266,7 +266,7 @@ export function displayError(error, options = {}) {
 /**
  * Get recovery suggestions based on error type
  */
-function getErrorSuggestions(errorType, errorMessage, context) {
+function getErrorSuggestions(errorType, errorMessage, _context) {
     const suggestions = [];
     const lowerMessage = errorMessage.toLowerCase();
     switch (errorType) {

package/dist/presentation/cli/repl.js

@@ -119,6 +119,38 @@ const SLASH_COMMANDS = [
         noKey: true,
         subcommand: 'status',
     },
+    {
+        name: 'verify',
+        args: '[session-id]',
+        description: "Verify a session's Final Report against recorded reality",
+        kind: 'sub',
+        noKey: true,
+        subcommand: 'verify',
+    },
+    {
+        name: 'audit',
+        args: '[verify|show]',
+        description: 'Inspect the hash-chained audit log',
+        kind: 'sub',
+        noKey: true,
+        subcommand: 'audit',
+    },
+    {
+        name: 'context-source',
+        args: '[list|connect|disconnect]',
+        description: 'Connect Linear/Figma via OAuth',
+        kind: 'sub',
+        noKey: true,
+        subcommand: 'context-source',
+    },
+    {
+        name: 'thread',
+        args: '<sub> [arg]',
+        description: 'Share or import a signed session bundle',
+        kind: 'sub',
+        noKey: true,
+        subcommand: 'thread',
+    },
     { name: 'health', args: '', description: 'System health check', kind: 'sub', noKey: true, subcommand: 'health' },
     {
         name: 'setup',
@@ -278,7 +310,6 @@ export async function runInteractiveRepl() {
     let escTimer = null;
     const cols = () => stdout.columns || 80;
     function truncate(s, maxWidth) {
-        // eslint-disable-next-line no-control-regex -- ANSI escape stripping requires the literal ESC byte
         const visible = s.replace(/\x1b\[[0-9;]*m/g, '');
         if (visible.length <= maxWidth)
             return s;
@@ -648,7 +679,24 @@ async function runSubcommand(name, extraArgs) {
         });
     });
 }
+/**
+ * UAT-002 — exit-intent words typed at the REPL prompt without a leading
+ * slash should leave the session, not get routed to a Conductor spawn.
+ *
+ * Pre-fix: typing bare `exit` (no `/`) fell through to spawnViaConductor,
+ * which booted Conductor, picked claude-code under default routing, made
+ * a real API call (network or quota), and emitted a confusing Final Report
+ * echoing the provider error verbatim. First-impression UX bug found by
+ * UAT 2026-05-19.
+ */
+const EXIT_INTENT_WORDS = new Set(['exit', 'quit', 'q', 'bye', 'goodbye', 'logout', ':q']);
 async function spawnViaConductor(prompt, state) {
+    // UAT-002 guard — exit-intent before any spawn / API call.
+    const trimmed = prompt.trim().toLowerCase();
+    if (EXIT_INTENT_WORDS.has(trimmed)) {
+        console.log(colors.dim('Goodbye! 👋'));
+        process.exit(0);
+    }
     const installed = availableAgents().filter((a) => a.installed);
     if (installed.length === 0) {
         console.log(warning('No specialist installed — install one and try again.'));
@@ -711,7 +759,9 @@ function renderEvent(event) {
                 console.log(colors.dim('  │ ') + icon + ' ' + label);
                 // P22 / Track B #8 — render last 3 lines of step output for done/failed
                 if (lastStep.output && String(lastStep.output).trim()) {
-                    const outLines = String(lastStep.output).split(String.fromCharCode(10)).filter(l => l.trim());
+                    const outLines = String(lastStep.output)
+                        .split(String.fromCharCode(10))
+                        .filter((l) => l.trim());
                     const preview = outLines.slice(-3);
                     for (const ln of preview) {
                         console.log(colors.dim('  │   ') + colors.gray(ln));