codehere 0.6.1 → 0.7.0

package/dist/infrastructure/context/context-source.js

@@ -0,0 +1,114 @@
+/**
+ * Context-source primitive (v0.8 S1).
+ *
+ * The "external tool" abstraction codehere ships instead of building per-tool
+ * integrations. Each adapter takes a URL like `linear://INFRA-247` or
+ * `figma://team/api-design/frame/429-response` and returns a `ContextPayload`
+ * the spawned coding agent can read as plain text. Routing is by URL scheme;
+ * registry is pure data (a Map), so tests can inject mocks without monkey-
+ * patching globals.
+ *
+ * Two principles · captured in chat 2026-05-22:
+ *   1. Composable primitive · ship 2-3 reference adapters · community fills
+ *      the long tail (no enterprise integration matrix).
+ *   2. Local-first · NEVER cloud-realtime. Fetch is a read · writes go
+ *      through the W-PASS gate in v0.9.
+ *
+ * Pure function shape:
+ *   - createRegistry() builds an empty registry.
+ *   - register(reg, source) appends a source · returns the new registry (or
+ *     mutates in place; both are accepted, see api).
+ *   - resolve(reg, url) picks the source that handles the URL's scheme · or
+ *     undefined if none. No throw.
+ *   - fetch(source, url, ctx) actually invokes the adapter and returns a
+ *     ContextPayload. The only path that does I/O. Caller passes ctx with
+ *     network/auth callbacks · the adapter never touches process.env or
+ *     fetch() directly · easier to mock + safer per local-first.
+ */
+export class ContextSourceError extends Error {
+    source;
+    kind;
+    constructor(source, kind, message) {
+        super(`[${source}] ${kind}: ${message}`);
+        this.source = source;
+        this.kind = kind;
+    }
+}
+export function createRegistry() {
+    return { bySchemeOnly: new Map() };
+}
+/**
+ * Register a source. Returns the (mutated) registry so callers can chain.
+ * Throws if the scheme is already claimed · two adapters on one scheme
+ * would silently shadow each other, which is exactly the class of bug
+ * the verifier-agent is meant to catch elsewhere; don't introduce it here.
+ */
+export function register(reg, source) {
+    if (reg.bySchemeOnly.has(source.scheme)) {
+        const existing = reg.bySchemeOnly.get(source.scheme);
+        throw new Error(`context-source: scheme '${source.scheme}' already registered by '${existing.id}'; cannot also register '${source.id}'`);
+    }
+    reg.bySchemeOnly.set(source.scheme, source);
+    return reg;
+}
+/**
+ * Resolve a URL to a source by scheme. Returns undefined when nothing matches
+ * (don't throw · the caller's job to decide if "no adapter" is a user-visible
+ * error).
+ */
+export function resolve(reg, url) {
+    let parsed;
+    try {
+        parsed = typeof url === 'string' ? new URL(url) : url;
+    }
+    catch {
+        return undefined;
+    }
+    // URL.protocol includes the trailing ':' · strip for registry lookup.
+    const scheme = parsed.protocol.replace(/:$/, '').toLowerCase();
+    const source = reg.bySchemeOnly.get(scheme);
+    if (!source)
+        return undefined;
+    return { source, parsed };
+}
+/**
+ * Fetch via the registry. Returns null when the URL has no registered adapter
+ * (so callers can distinguish "no adapter" from "fetch failed").
+ */
+export async function fetchViaRegistry(reg, url, ctx) {
+    const r = resolve(reg, url);
+    if (!r)
+        return null;
+    const ts = ctx.now ? ctx.now() : Date.now();
+    try {
+        if (r.source.isConfigured && !r.source.isConfigured(ctx)) {
+            ctx.emitAuditLine?.({ source: r.source.id, url, status: 'unconfigured', ts });
+            throw new ContextSourceError(r.source.id, 'auth', `adapter '${r.source.id}' is not configured · set ctx.config['${r.source.id}'] (e.g., token, base URL)`);
+        }
+        const payload = await r.source.fetch(r.parsed, ctx);
+        ctx.emitAuditLine?.({ source: r.source.id, url, status: 'ok', ts, bytes: payload.text.length });
+        return payload;
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        ctx.emitAuditLine?.({ source: r.source.id, url, status: 'error', ts, detail });
+        throw err;
+    }
+}
+/** List configured sources for UI rendering. */
+export function listAvailable(reg, ctx) {
+    return Array.from(reg.bySchemeOnly.values()).filter((s) => {
+        if (!s.isConfigured)
+            return true; // adapter doesn't gate · assume usable
+        return s.isConfigured(ctx);
+    });
+}
+/** List ALL sources regardless of config · for `codehere context-source list`. */
+export function listAll(reg) {
+    return Array.from(reg.bySchemeOnly.values());
+}
+/** Default token estimate · `len/4` is the industry-standard rough-tokens. */
+export function estimateTokens(text) {
+    return Math.ceil(text.length / 4);
+}
+//# sourceMappingURL=context-source.js.map

package/dist/infrastructure/context/oauth-flow.js

@@ -0,0 +1,207 @@
+/**
+ * OAuth 2.0 + PKCE flow for context-source providers (v0.8 S2.5).
+ *
+ * Provider-agnostic state machine that handles the four steps of the
+ * code-grant flow with PKCE (RFC 7636) so we don't need a client secret on
+ * the user's machine:
+ *
+ *   1. begin(provider)          · build authorize URL · stash state + verifier
+ *   2. (browser) user approves  · provider redirects to our callback
+ *   3. complete(code, state)    · exchange code for {access_token, refresh_token, user}
+ *   4. refresh(refresh_token)   · swap for a fresh access_token
+ *
+ * Tokens persist in ~/.codehere/context-sources.json (the same file manual
+ * configs use). User can revoke from the provider's web UI any time; our
+ * disconnect command just deletes the local config.
+ *
+ * Provider client IDs come from env vars (CODEHERE_LINEAR_CLIENT_ID,
+ * CODEHERE_FIGMA_CLIENT_ID) so binaries can ship without secrets baked in.
+ * The codehere app registrations are public client IDs · PKCE removes the
+ * need for a client secret on the user's machine. Anyone running codehere
+ * locally uses the same `codehere-local` app at each provider, no per-user
+ * registration needed.
+ *
+ * IMPORTANT · this module is pure logic. All I/O (httpPost, filesystem,
+ * clock) is injected. The daemon's HTTP route at /oauth/callback supplies
+ * the production wiring (registry-bootstrap.ts) and tests use mocks.
+ */
+import { createHash, randomBytes } from 'crypto';
+const DEFAULT_REDIRECT = 'http://127.0.0.1:3773/oauth/callback';
+export const PROVIDERS = {
+    linear: {
+        id: 'linear',
+        label: 'Linear',
+        authorizeUrl: 'https://linear.app/oauth/authorize',
+        tokenUrl: 'https://api.linear.app/oauth/token',
+        scopes: ['read'],
+        clientIdEnv: 'CODEHERE_LINEAR_CLIENT_ID',
+        redirectUri: DEFAULT_REDIRECT,
+        tokenPostMode: 'form',
+        userInfoUrl: 'https://api.linear.app/graphql', // POST { query: '{ viewer { name email } }' }
+    },
+    figma: {
+        id: 'figma',
+        label: 'Figma',
+        authorizeUrl: 'https://www.figma.com/oauth',
+        tokenUrl: 'https://api.figma.com/v1/oauth/token',
+        scopes: ['file_read'],
+        clientIdEnv: 'CODEHERE_FIGMA_CLIENT_ID',
+        redirectUri: DEFAULT_REDIRECT,
+        tokenPostMode: 'form',
+        userInfoUrl: 'https://api.figma.com/v1/me',
+    },
+};
+export function listProviders() {
+    return Object.values(PROVIDERS);
+}
+export function getProvider(id) {
+    return PROVIDERS[id];
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* PKCE helpers                                                              */
+/* ──────────────────────────────────────────────────────────────────────── */
+function base64UrlEncode(buf) {
+    return buf.toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
+}
+/** Random 43-128 char string · we pick 64 bytes (86 chars after b64url). */
+export function generateCodeVerifier() {
+    return base64UrlEncode(randomBytes(64));
+}
+export function deriveCodeChallenge(verifier) {
+    return base64UrlEncode(createHash('sha256').update(verifier).digest());
+}
+/** Opaque CSRF defense · returned by provider unchanged · we verify on callback. */
+export function generateState() {
+    return base64UrlEncode(randomBytes(24));
+}
+export function begin(provider, ctx) {
+    if (!ctx.clientId) {
+        return { kind: 'not_registered', provider: provider.id, envVar: provider.clientIdEnv };
+    }
+    const codeVerifier = ctx.rng?.verifier() ?? generateCodeVerifier();
+    const codeChallenge = deriveCodeChallenge(codeVerifier);
+    const state = ctx.rng?.state() ?? generateState();
+    const startedAt = ctx.now ? ctx.now() : Date.now();
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: ctx.clientId,
+        redirect_uri: provider.redirectUri,
+        scope: provider.scopes.join(' '),
+        state,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+    });
+    return {
+        authorizeUrl: `${provider.authorizeUrl}?${params.toString()}`,
+        pending: { provider: provider.id, state, codeVerifier, startedAt },
+    };
+}
+export async function complete(code, state, ctx) {
+    const pending = ctx.pending.get(state);
+    if (!pending) {
+        return { kind: 'state_unknown', detail: `no pending flow for state '${state.slice(0, 8)}...'` };
+    }
+    ctx.pending.delete(state); // single-use
+    const provider = getProvider(pending.provider);
+    if (!provider) {
+        return { kind: 'state_unknown', detail: `unknown provider '${pending.provider}'` };
+    }
+    const maxAge = ctx.maxAgeMs ?? 10 * 60 * 1000;
+    const now = ctx.now ? ctx.now() : Date.now();
+    if (now - pending.startedAt > maxAge) {
+        return { kind: 'state_expired', detail: `pending flow older than ${Math.round(maxAge / 1000)}s` };
+    }
+    if (!ctx.clientId) {
+        return { kind: 'not_registered', detail: provider.clientIdEnv };
+    }
+    const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: provider.redirectUri,
+        client_id: ctx.clientId,
+        code_verifier: pending.codeVerifier,
+    });
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        Accept: 'application/json',
+    };
+    const res = await ctx.httpPost(provider.tokenUrl, params.toString(), headers);
+    if (res.status !== 200) {
+        return {
+            kind: 'provider_error',
+            detail: `${provider.label} token endpoint returned ${res.status}: ${res.body.slice(0, 200)}`,
+        };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(res.body);
+    }
+    catch (err) {
+        return {
+            kind: 'parse_error',
+            detail: `token response not JSON: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    if (!payload.access_token) {
+        return { kind: 'parse_error', detail: 'token response missing access_token' };
+    }
+    const token = {
+        provider: provider.id,
+        accessToken: payload.access_token,
+        refreshToken: payload.refresh_token,
+        expiresAt: typeof payload.expires_in === 'number' ? now + payload.expires_in * 1000 : null,
+        scope: payload.scope ?? provider.scopes.join(' '),
+    };
+    // Best-effort user-info fetch · failure here doesn't undo the connect
+    if (ctx.fetchUserInfo && provider.userInfoUrl) {
+        try {
+            const u = await ctx.fetchUserInfo(token.accessToken, provider.userInfoUrl);
+            if (u) {
+                const label = u.email || u.name;
+                if (label)
+                    token.userLabel = label;
+            }
+        }
+        catch {
+            // ignore · token is valid, user label is decoration
+        }
+    }
+    return token;
+}
+export async function refresh(provider, refreshToken, ctx) {
+    if (!ctx.clientId)
+        return { kind: 'not_registered', detail: provider.clientIdEnv };
+    const params = new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        client_id: ctx.clientId,
+    });
+    const res = await ctx.httpPost(provider.tokenUrl, params.toString(), {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        Accept: 'application/json',
+    });
+    if (res.status !== 200) {
+        return { kind: 'provider_error', detail: `${provider.label} refresh returned ${res.status}` };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(res.body);
+    }
+    catch (err) {
+        return {
+            kind: 'parse_error',
+            detail: `refresh response not JSON: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    if (!payload.access_token)
+        return { kind: 'parse_error', detail: 'refresh missing access_token' };
+    const now = ctx.now ? ctx.now() : Date.now();
+    return {
+        provider: provider.id,
+        accessToken: payload.access_token,
+        refreshToken: payload.refresh_token ?? refreshToken,
+        expiresAt: typeof payload.expires_in === 'number' ? now + payload.expires_in * 1000 : null,
+        scope: payload.scope ?? null,
+    };
+}
+//# sourceMappingURL=oauth-flow.js.map

package/dist/infrastructure/context/oauth-store.js

@@ -0,0 +1,119 @@
+/**
+ * OAuth token storage · v0.8 S2.5.
+ *
+ * Persists OAuth tokens to ~/.codehere/context-sources.json next to manual
+ * configs. File shape evolved · backward-compatible:
+ *
+ *   {
+ *     "linear": {
+ *       "apiKey": "...",                  // manual mode · still supported
+ *       "oauth": {                        // OAuth mode · NEW
+ *         "accessToken": "...",
+ *         "refreshToken": "...",
+ *         "expiresAt": 1700000000000,
+ *         "scope": "read",
+ *         "userLabel": "ega@example.com",
+ *         "connectedAt": 1700000000000
+ *       }
+ *     },
+ *     "figma": { ... }
+ *   }
+ *
+ * The linear-source / figma-source adapters read EITHER apiKey OR
+ * oauth.accessToken (in S3 we'll merge them under one access path; for now
+ * S2.5 just lands the storage shape so the OAuth flow has somewhere to put
+ * the token).
+ *
+ * File permissions · 0600 on write so a multi-user machine can't read each
+ * other's tokens.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { dirname, join } from 'path';
+function configPath() {
+    const home = process.env.CODEHERE_HOME || homedir();
+    return join(home, '.codehere', 'context-sources.json');
+}
+export function readAllConfig(path) {
+    const target = path ?? configPath();
+    if (!existsSync(target))
+        return {};
+    try {
+        const raw = readFileSync(target, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null)
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+function writeAllConfig(cfg, path) {
+    const target = path ?? configPath();
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, JSON.stringify(cfg, null, 2) + '\n', 'utf-8');
+    try {
+        chmodSync(target, 0o600);
+    }
+    catch {
+        // chmod can fail on FATs · the local-first promise still holds; we just
+        // can't enforce 0600. Real-world users on macOS/Linux always succeed.
+    }
+}
+/** Persist a freshly-minted OAuth token for the given provider. */
+export function saveToken(token, path) {
+    const cfg = readAllConfig(path);
+    const existing = cfg[token.provider] ?? {};
+    cfg[token.provider] = {
+        ...existing,
+        oauth: {
+            accessToken: token.accessToken,
+            refreshToken: token.refreshToken,
+            expiresAt: token.expiresAt,
+            scope: token.scope,
+            userLabel: token.userLabel,
+            connectedAt: Date.now(),
+        },
+    };
+    writeAllConfig(cfg, path);
+}
+/** Disconnect · drops only the oauth subtree, preserves any manual apiKey. */
+export function clearToken(providerId, path) {
+    const cfg = readAllConfig(path);
+    const entry = cfg[providerId];
+    if (!entry || !entry.oauth)
+        return false;
+    delete entry.oauth;
+    // If the entry is now empty (no manual apiKey either), drop the whole row.
+    const isEmpty = Object.keys(entry).filter((k) => k !== 'oauth').length === 0;
+    if (isEmpty)
+        delete cfg[providerId];
+    writeAllConfig(cfg, path);
+    return true;
+}
+/** Read the persisted OAuth token for a provider (undefined if not connected). */
+export function loadToken(providerId, path) {
+    const cfg = readAllConfig(path);
+    return cfg[providerId]?.oauth;
+}
+export function connectionStatus(providerId, path) {
+    const cfg = readAllConfig(path);
+    const entry = cfg[providerId];
+    if (!entry)
+        return { status: 'disconnected' };
+    if (entry.oauth?.accessToken) {
+        const exp = entry.oauth.expiresAt;
+        const expired = typeof exp === 'number' && exp < Date.now();
+        return {
+            status: expired ? 'expired' : 'connected',
+            userLabel: entry.oauth.userLabel,
+            connectedAt: entry.oauth.connectedAt,
+            expiresAt: exp,
+        };
+    }
+    if (entry.apiKey || entry.token)
+        return { status: 'manual' };
+    return { status: 'disconnected' };
+}
+//# sourceMappingURL=oauth-store.js.map

package/dist/infrastructure/context/registry-bootstrap.js

@@ -0,0 +1,99 @@
+/**
+ * Registry bootstrap · v0.8 S2.
+ *
+ * Builds the default ContextSourceRegistry at daemon startup with our 1st-
+ * party adapters (Linear, Figma), loads adapter config from
+ * `~/.codehere/context-sources.json`, and provides a default
+ * ContextSourceFetchContext that wraps node's fetch() for the network path
+ * and the audit chain for telemetry.
+ *
+ * This file is the ONLY place where context-sources touch process.env, the
+ * filesystem, and global fetch · everything else is pure code + injected
+ * primitives. Makes tests trivial and the security boundary explicit.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { createRegistry, register, } from './context-source.js';
+import { linearSource } from './adapters/linear-source.js';
+import { figmaSource } from './adapters/figma-source.js';
+import { drawioSource } from './adapters/drawio-source.js';
+import { githubIssueSource } from './adapters/github-issue-source.js';
+/** Built once per daemon · in-memory · re-read from disk on demand via `reload`. */
+let cached = null;
+export function getDefaultRegistry() {
+    if (cached)
+        return cached;
+    const reg = createRegistry();
+    register(reg, linearSource);
+    register(reg, figmaSource);
+    register(reg, drawioSource);
+    register(reg, githubIssueSource);
+    cached = reg;
+    return reg;
+}
+/** Forget the cached registry · used by tests + future `codehere context-source reload`. */
+export function resetDefaultRegistry() {
+    cached = null;
+}
+/**
+ * Resolve config path · respects CODEHERE_HOME env so tests can isolate.
+ * File format: a JSON object keyed by adapter id, e.g.
+ *   { "linear": { "apiKey": "..." }, "figma": { "token": "..." } }
+ */
+function configPath() {
+    const home = process.env.CODEHERE_HOME || homedir();
+    return join(home, '.codehere', 'context-sources.json');
+}
+function loadConfig() {
+    const path = configPath();
+    if (!existsSync(path))
+        return {};
+    try {
+        const raw = readFileSync(path, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null)
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Real-network FetchContext · used by the daemon at runtime. Tests inject
+ * a fake context so this code path never runs in CI.
+ */
+export function createDefaultFetchContext(opts) {
+    const config = opts.configOverride ?? loadConfig();
+    return {
+        config,
+        async httpGet(target, headers) {
+            const r = await fetch(target, { method: 'GET', headers: headers ?? {} });
+            const body = await r.text();
+            const hOut = {};
+            r.headers.forEach((v, k) => {
+                hOut[k.toLowerCase()] = v;
+            });
+            return { status: r.status, body, headers: hOut };
+        },
+        emitAuditLine: opts.emitAuditLine,
+        now: () => Date.now(),
+    };
+}
+export function createDefaultFetchContextWithPost(opts) {
+    const base = createDefaultFetchContext(opts);
+    return {
+        ...base,
+        async httpPost(target, body, headers) {
+            const r = await fetch(target, { method: 'POST', headers: headers ?? {}, body });
+            const text = await r.text();
+            const hOut = {};
+            r.headers.forEach((v, k) => {
+                hOut[k.toLowerCase()] = v;
+            });
+            return { status: r.status, body: text, headers: hOut };
+        },
+    };
+}
+//# sourceMappingURL=registry-bootstrap.js.map

package/dist/infrastructure/context/write-pass-resolver.js

@@ -0,0 +1,106 @@
+/**
+ * Write-pass target resolver · v0.9 S6 part B.
+ *
+ * Turns a W-PASS target like `linear://INFRA-247` into a concrete
+ * HTTPS request the daemon can fire on the user's behalf, AFTER the
+ * user has approved the payload. The resolver layer mirrors the
+ * context-source registry · same scheme namespace, opposite direction
+ * (read vs write).
+ *
+ * Resolved request shape:
+ *   - url      · absolute HTTPS
+ *   - method   · same as the intent (POST/PUT/PATCH/DELETE)
+ *   - headers  · auth + content-type · loaded from ctx.config[scheme]
+ *   - body     · JSON-stringified payload
+ *
+ * Tests pass a fake httpRequest · production uses node's fetch. Same
+ * seam as context-source so adapters look symmetric.
+ *
+ * S6 ships ONE resolver (Linear) to prove the shape. github + figma +
+ * drawio + notion follow in subsequent slices · each is a self-contained
+ * function in this file, so adding one is a copy-paste-modify, not an
+ * architectural change.
+ */
+import { gradeDomain, hostOf } from '../../application/use-cases/domain-trust.js';
+export class WritePassResolveError extends Error {
+    code;
+    constructor(code, message) {
+        super(`[w-pass resolve] ${code}: ${message}`);
+        this.code = code;
+    }
+}
+/**
+ * Resolve an intent + effective payload into a concrete HTTP request.
+ * Throws WritePassResolveError if the scheme isn't supported OR auth
+ * is missing · the daemon turns those into a 4xx response BEFORE
+ * touching the network.
+ */
+export function resolveWriteRequest(intent, effectivePayload, config) {
+    const m = intent.target.match(/^([a-z][a-z0-9+.-]*):\/\/(.+)$/);
+    if (!m) {
+        throw new WritePassResolveError('invalid_target', `bad URL: ${intent.target}`);
+    }
+    const scheme = m[1];
+    const rest = m[2];
+    const built = scheme === 'linear'
+        ? resolveLinear(rest, intent.method, effectivePayload, config.linear)
+        : scheme === 'github'
+            ? resolveGitHub(rest, intent.method, effectivePayload, config.github)
+            : null;
+    if (built) {
+        return { ...built, trust: gradeDomain(hostOf(built.url)) };
+    }
+    throw new WritePassResolveError('unsupported_scheme', `no W-PASS resolver for "${scheme}" yet · supported in S6: linear, github`);
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* Linear                                                                    */
+/* ──────────────────────────────────────────────────────────────────────── */
+function resolveLinear(rest, method, payload, cfg) {
+    const auth = cfg?.oauth?.accessToken ? `Bearer ${cfg.oauth.accessToken}` : cfg?.apiKey;
+    if (!auth) {
+        throw new WritePassResolveError('auth_missing', 'no Linear apiKey or OAuth token in config["linear"] · agent cannot write without explicit credentials');
+    }
+    // Linear's API is GraphQL · we send mutations via POST. The agent's
+    // intent.payload is expected to be { query, variables } or { mutation, variables }.
+    // We pass it through verbatim · the human saw + approved it.
+    const endpoint = cfg?.endpoint ?? 'https://api.linear.app/graphql';
+    return {
+        url: endpoint,
+        // Linear writes always POST (it's GraphQL) · intent.method is recorded
+        // for audit but doesn't change the transport. We log a one-line audit
+        // hint when method != POST so the user sees the mediation.
+        method: 'POST',
+        headers: {
+            Authorization: auth,
+            'Content-Type': 'application/json',
+            'X-Codehere-Mediated': 'w-pass',
+            'X-Codehere-Original-Method': method,
+            'X-Codehere-Identifier': rest,
+        },
+        body: JSON.stringify(payload),
+    };
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* GitHub                                                                    */
+/* ──────────────────────────────────────────────────────────────────────── */
+function resolveGitHub(rest, method, payload, cfg) {
+    if (!cfg?.token) {
+        throw new WritePassResolveError('auth_missing', 'no GitHub token in config["github"] · public-by-URL is READ only · writes need an explicit PAT');
+    }
+    // rest is e.g. owner/repo/issues/42/comments or owner/repo/issues/42
+    const endpoint = cfg.endpoint ?? 'https://api.github.com';
+    return {
+        url: `${endpoint}/repos/${rest}`,
+        method,
+        headers: {
+            Authorization: `Bearer ${cfg.token}`,
+            Accept: 'application/vnd.github+json',
+            'X-GitHub-Api-Version': '2022-11-28',
+            'Content-Type': 'application/json',
+            'User-Agent': 'codehere/0.9 w-pass',
+            'X-Codehere-Mediated': 'w-pass',
+        },
+        body: JSON.stringify(payload),
+    };
+}
+//# sourceMappingURL=write-pass-resolver.js.map

package/dist/infrastructure/cost/budget-config.js

@@ -84,7 +84,7 @@ export function saveBudget(cfg) {
         mkdirSync(dir, { recursive: true });
     const lines = [
         '# codehere daily-spend budget. Edit by hand or via `codehere budget set <amount>`.',
-        '# daily_usd: hard ceiling for today\'s estimated spend. Set to a number to enable.',
+        "# daily_usd: hard ceiling for today's estimated spend. Set to a number to enable.",
         '# Leave commented out / omit to disable budget enforcement entirely.',
     ];
     if (cfg.dailyUsd !== null) {

package/dist/infrastructure/cost/spend-aggregator.js

@@ -36,11 +36,11 @@ function sessionsFile() {
  *  under-promise and miss a real bill. */
 const COST_PER_M_OUTPUT_TOKENS_USD = {
     'claude-code': 15.0, // Sonnet 4.6 baseline
-    'codex': 10.0, // GPT-5 / codex baseline
-    'aider': 15.0, // typically Sonnet
-    'gemini': 0, // free tier (Google AI Studio)
-    'opencode': 0, // typically free local / NIM-routed
-    'conductor': 15.0, // routes to Claude Code by default
+    codex: 10.0, // GPT-5 / codex baseline
+    aider: 15.0, // typically Sonnet
+    gemini: 0, // free tier (Google AI Studio)
+    opencode: 0, // typically free local / NIM-routed
+    conductor: 15.0, // routes to Claude Code by default
 };
 const INPUT_RATE_RATIO = 0.2; // input ≈ 1/5 of output
 const CACHE_READ_RATIO = 0.1; // cache reads ≈ 1/10 of input (so 1/50 output)