codehere 0.6.2 → 0.7.1

package/dist/infrastructure/security/trust-scorer.js

@@ -9,6 +9,30 @@
  *
  * All passes run locally, zero API calls.
  */
+/**
+ * Extract the child_process bindings actually imported in a file, so the
+ * exec() command-injection pattern can tell a real `cp.exec(cmd)` from a
+ * `regex.exec(str)` that happens to live in a file which also uses
+ * child_process (e.g. our own artifacts-extractor: spawns git AND runs a
+ * regex loop). namespaceAliases = the `cp` in `import * as cp` / `const cp =
+ * require(...)`; namedExec = whether `exec`/`execSync` was imported by name so
+ * a bare `exec(cmd)` is callable.
+ */
+export function childProcessBindings(src) {
+    const namespaceAliases = new Set();
+    let namedExec = false;
+    for (const m of src.matchAll(/import\s+(?:\*\s+as\s+)?(\w+)\s+from\s+['"](?:node:)?child_process['"]/g)) {
+        namespaceAliases.add(m[1]);
+    }
+    for (const m of src.matchAll(/(?:const|let|var|import)\s+(\w+)\s*=\s*require\(\s*['"](?:node:)?child_process['"]/g)) {
+        namespaceAliases.add(m[1]);
+    }
+    for (const m of src.matchAll(/(?:import|const|let|var)\s*\{([^}]*)\}\s*(?:from\s*|=\s*require\(\s*)['"](?:node:)?child_process['"]/g)) {
+        if (/\b(?:exec|execSync)\b/.test(m[1]))
+            namedExec = true;
+    }
+    return { namespaceAliases, namedExec };
+}
 export const CODE_PATTERNS = [
     // Secrets (scan with strings visible — must see inside string literals)
     {
@@ -238,12 +262,22 @@ export const CODE_PATTERNS = [
     // requiresContext must match an actual import, not the literal string
     // child_process (which this scanner file itself contains as pattern data).
     {
-        regex: /\.exec\s*\(\s*(?!['"`])(\w+)\s*[,)]/g,
+        // Capture an optional receiver (group 1) so matchFilter can check it:
+        //   cp.exec(cmd)  → receiver "cp"   |  exec(cmd) → no receiver  |  g.exec(s) → "g"
+        regex: /(?:\b(\w+)\s*\.\s*)?\bexec(?:Sync)?\s*\(\s*(?!['"`])(\w+)\s*[,)]/g,
         severity: 'high',
         category: 'Command Injection',
         description: 'exec() called with variable argument — verify input is not user-controlled',
         cwe: 'CWE-78',
         requiresContext: /(?:from|require\()\s*['"](?:node:)?child_process['"]/,
+        // Only a real child_process call counts: a method call on the imported
+        // child_process binding, or a bare exec() when exec was named-imported.
+        // A method call on anything else (a RegExp, a parser, …) is not.
+        matchFilter: (m, src) => {
+            const receiver = m[1];
+            const b = childProcessBindings(src);
+            return receiver === undefined ? b.namedExec : b.namespaceAliases.has(receiver);
+        },
     },
     // SSRF
     {
@@ -286,6 +320,42 @@ export const CODE_PATTERNS = [
         cwe: 'CWE-347',
         scanRaw: true,
     },
+    // Secret-file read / exfiltration. Code that touches a private key, cloud
+    // credential, or system password file is almost always exfil or theft.
+    // dogfood 2026-05-27 Phase F: reading ~/.ssh/id_rsa was a false-negative on a
+    // product that claims a trust score on every file. scanRaw — the path lives
+    // inside a string literal. Tight path set keeps false positives near zero.
+    {
+        regex: /(?:\.ssh\/id_(?:rsa|dsa|ecdsa|ed25519)|(?:^|[^\w])id_(?:rsa|ed25519)\b|\.aws\/credentials|\.config\/gcloud\/|\.kube\/config|\.docker\/config\.json|\/etc\/shadow|\.npmrc\b|\.pem['"`])/gi,
+        severity: 'critical',
+        category: 'Secret Exfiltration',
+        description: 'Reads a private key or credential file — likely secret exfiltration',
+        cwe: 'CWE-522',
+        scanRaw: true,
+    },
+    // Destructive shell command. `rm -rf` in agent-written code is worth flagging
+    // even when it looks scoped — a stray variable or trailing slash turns it into
+    // a filesystem wipe. dogfood 2026-05-27 Phase F named this a false-negative.
+    // The runtime PreToolUse hook also blocks the worst forms at execution time;
+    // this is the static signal on the file itself. scanRaw — the command is a
+    // string literal.
+    {
+        regex: /rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r/gi,
+        severity: 'high',
+        category: 'Destructive Operation',
+        description: 'Recursive force-delete (rm -rf) — verify the target can never be empty or a parent path',
+        cwe: 'CWE-78',
+        scanRaw: true,
+    },
+    {
+        // rm -rf targeting root, a home glob, or a variable/concatenation → wipe risk.
+        regex: /rm\s+-[a-z]*[rf][a-z]*\s+(?:\/(?:\s|$|["'`])|~|\$\{?\w|["'`][^"'`]*["'`]\s*\+|\.\.)/gi,
+        severity: 'critical',
+        category: 'Destructive Operation',
+        description: 'rm -rf targeting root, home, or a dynamic path — can wipe unintended files',
+        cwe: 'CWE-78',
+        scanRaw: true,
+    },
 ];
 export function measureComplexity(code) {
     const lines = code.split('\n').length;
@@ -535,6 +605,11 @@ export function scoreFile(filepath, code) {
         let match;
         const re = new RegExp(pattern.regex.source, pattern.regex.flags);
         while ((match = re.exec(scannable)) !== null) {
+            if (pattern.matchFilter && !pattern.matchFilter(match, contextTarget)) {
+                if (!re.global)
+                    break;
+                continue;
+            }
             const line = code.substring(0, match.index).split('\n').length;
             allFindings.push({
                 severity: pattern.severity,

package/dist/infrastructure/storage/cross-tool-agents.js

@@ -236,7 +236,7 @@ export function readCrossToolAgents(cwd, options) {
     const dirs = agentDirsToScan(cwd, options?.homeDir);
     for (const { dir, defaultFormat } of dirs) {
         for (const filePath of listMdFilesRecursive(dir)) {
-            let agent = null;
+            let agent;
             try {
                 agent = parseAgentFile(filePath, defaultFormat);
             }

package/dist/infrastructure/storage/project-thread-migration.js

@@ -158,7 +158,7 @@ export function migrate(options) {
     let threadsWritten = 0;
     let threadsSkippedExisting = 0;
     let unknownCwdSessions = 0;
-    let abandonedSessions = sessions.filter((s) => s.abandoned).length;
+    const abandonedSessions = sessions.filter((s) => s.abandoned).length;
     let tempDirSessionsSkipped = 0;
     for (const group of groups) {
         if (skipTempDirs && isTempDir(group.cwd)) {
@@ -198,7 +198,7 @@ export function dryRun(options) {
     let threadsWritten = 0;
     let threadsSkippedExisting = 0;
     let unknownCwdSessions = 0;
-    let abandonedSessions = sessions.filter((s) => s.abandoned).length;
+    const abandonedSessions = sessions.filter((s) => s.abandoned).length;
     let tempDirSessionsSkipped = 0;
     for (const group of groups) {
         if (skipTempDirs && isTempDir(group.cwd)) {

package/dist/infrastructure/storage/project-thread-title-backfill.js

@@ -145,7 +145,7 @@ export async function backfillThreadTitles(options) {
             result.noTasks++;
             continue;
         }
-        let title = null;
+        let title;
         try {
             title = await generateThreadTitle(scanned.firstPrompt, scanned.firstCwd);
         }

package/dist/monitoring.js

@@ -159,7 +159,7 @@ function checkMemory() {
             usage: usagePercent,
         };
     }
-    catch (error) {
+    catch {
         return {
             status: 'ok',
             message: 'Memory check unavailable',

package/dist/presentation/cli/commands/audit-command.js

@@ -0,0 +1,126 @@
+/**
+ * CLI: `codehere audit`
+ *
+ * F-05 of the demo-v12 backlog · expose the hash-chained audit log verifier
+ * + a "show" subcommand for forensic inspection. The chain is the source of
+ * truth, NOT codehere itself · this command lets reviewers and CI verify it
+ * without trusting our daemon.
+ *
+ * Subcommands:
+ *   codehere audit verify [--json]   Walk the chain · report intact/tampered
+ *                                    + entry counts + every break point.
+ *                                    Exit 0 = valid, 1 = invalid.
+ *   codehere audit show <seq> [--json]
+ *                                    Print one entry by sequence number.
+ *
+ * Default audit file: ~/.codehere/audit/hook-events.jsonl
+ * Override via CODEHERE_AUDIT_FILE env var (mirrors the hook's own resolution).
+ */
+import { existsSync, readFileSync } from 'fs';
+import { colors, symbols } from '../../../ui.js';
+import { AUDIT_FILE, verifyAuditChain } from '../../../infrastructure/hooks/claude-sdk-hook.js';
+export function executeAuditCommand(sub, arg, options = {}) {
+    if (!sub || sub === 'verify')
+        return verify(options.json ?? false);
+    if (sub === 'show')
+        return show(arg, options.json ?? false);
+    process.stderr.write(colors.error(`${symbols.error} Unknown audit subcommand: ${sub}\n`) +
+        colors.dim('Try: codehere audit verify   |   codehere audit show <seq>\n'));
+    return 2;
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* verify · the F-05 headline                                                */
+/* ──────────────────────────────────────────────────────────────────────── */
+function verify(json) {
+    const result = verifyAuditChain(AUDIT_FILE);
+    if (json) {
+        process.stdout.write(JSON.stringify({
+            path: AUDIT_FILE,
+            valid: result.valid,
+            totalEntries: result.totalEntries,
+            chainedEntries: result.chainedEntries,
+            legacyEntries: result.legacyEntries,
+            errors: result.errors,
+        }, null, 2) + '\n');
+        return result.valid ? 0 : 1;
+    }
+    // Human output · header, verdict line, counts, then errors if any.
+    process.stdout.write('\n' + colors.dim('audit log: ') + colors.gray(AUDIT_FILE) + '\n\n');
+    if (result.totalEntries === 0) {
+        process.stdout.write(colors.gray(`${symbols.dot} No audit entries yet.`) +
+            colors.dim(' Install the hook first: ') +
+            colors.bold('codehere hook install') +
+            '\n\n');
+        return 0;
+    }
+    if (result.valid) {
+        process.stdout.write(colors.green(`${symbols.success} Chain intact`) +
+            colors.dim('  every entry verified against its predecessor hash.') +
+            '\n\n');
+    }
+    else {
+        process.stdout.write(colors.error(`${symbols.error} Chain BROKEN`) +
+            colors.dim(`  ${result.errors.length} break point${result.errors.length === 1 ? '' : 's'} detected.`) +
+            '\n\n');
+    }
+    process.stdout.write(colors.bold('Counts:\n'));
+    process.stdout.write(`  ${result.totalEntries.toString().padStart(6)} total entries\n`);
+    process.stdout.write(`  ${result.chainedEntries.toString().padStart(6)} hash-chained (verifiable)\n`);
+    process.stdout.write(`  ${result.legacyEntries.toString().padStart(6)} legacy pre-chain (un-verifiable)\n\n`);
+    if (result.errors.length > 0) {
+        process.stdout.write(colors.bold('Break points:\n'));
+        for (const err of result.errors) {
+            process.stdout.write('  ' +
+                colors.error(`line ${err.lineNumber}`) +
+                colors.dim('  ') +
+                colors.gray(err.reason) +
+                colors.dim('  ') +
+                err.detail +
+                '\n');
+        }
+        process.stdout.write('\n');
+    }
+    return result.valid ? 0 : 1;
+}
+function show(seqStr, json) {
+    if (!seqStr || !/^\d+$/.test(seqStr)) {
+        process.stderr.write(colors.error(`${symbols.error} Need a numeric sequence: codehere audit show <seq>\n`));
+        return 2;
+    }
+    const target = parseInt(seqStr, 10);
+    if (!existsSync(AUDIT_FILE)) {
+        process.stderr.write(colors.gray(`${symbols.dot} No audit log yet.\n`));
+        return 2;
+    }
+    const lines = readFileSync(AUDIT_FILE, 'utf-8').split('\n').filter(Boolean);
+    for (const line of lines) {
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (entry.seq !== target)
+            continue;
+        if (json) {
+            process.stdout.write(JSON.stringify(entry, null, 2) + '\n');
+        }
+        else {
+            process.stdout.write('\n' +
+                colors.bold(`Entry #${target}`) +
+                (entry.ts ? colors.dim('  ' + new Date(entry.ts).toISOString()) : '') +
+                '\n\n');
+            for (const [k, v] of Object.entries(entry)) {
+                const val = typeof v === 'string' && v.length > 120 ? v.slice(0, 117) + '...' : JSON.stringify(v);
+                process.stdout.write(`  ${colors.dim(k.padEnd(12))} ${val}\n`);
+            }
+            process.stdout.write('\n');
+        }
+        return 0;
+    }
+    process.stderr.write(colors.error(`${symbols.error} No entry with seq=${target}.\n`) +
+        colors.dim('   Tip: run `codehere audit verify` to see the chained-entry count.\n'));
+    return 2;
+}
+//# sourceMappingURL=audit-command.js.map

package/dist/presentation/cli/commands/config-command.js

@@ -2,7 +2,7 @@
  * Config Command
  * Manage Codehere configuration and preferences
  */
-import { colors, separator, newline, sectionHeader, success, error, createTable, isMinimalStyle, } from '../../../ui.js';
+import { colors, separator, newline, sectionHeader, success, error, createTable, isMinimalStyle } from '../../../ui.js';
 import { getConfigManager } from '../../../infrastructure/config/config-manager.js';
 import { executionTracer } from '../../../infrastructure/observability/execution-tracer.js';
 import { findCodebaseRoot } from '../../../domain/services/codebase-detector.js';
@@ -43,7 +43,7 @@ function displayConfig(config) {
 export async function executeConfigCommand(action, key, value) {
     // Start execution tracing
     const codebaseInfo = findCodebaseRoot(process.cwd());
-    const runId = executionTracer.startRun('config', {
+    executionTracer.startRun('config', {
         codebaseId: codebaseInfo?.rootPath || process.cwd(),
     });
     try {

package/dist/presentation/cli/commands/context-source-command.js

@@ -0,0 +1,198 @@
+/**
+ * CLI: `codehere context-source` · v0.8 S2.5
+ *
+ * Subcommands:
+ *   list                  · show every registered provider + connection status
+ *   connect <provider>    · open the browser to begin OAuth · prints URL
+ *   disconnect <provider> · clear the stored OAuth token
+ *
+ * Talks to the running daemon at 127.0.0.1:3773. If the daemon isn't running,
+ * we print a clear message rather than starting one silently.
+ */
+import { colors, symbols } from '../../../ui.js';
+import { spawn } from 'child_process';
+const DAEMON_BASE = process.env.CODEHERE_DAEMON_URL || 'http://127.0.0.1:3773';
+export async function executeContextSourceCommand(sub, arg, options = {}) {
+    switch (sub) {
+        case undefined:
+        case 'list':
+            return list(options.json ?? false);
+        case 'connect':
+            return connect(arg, options.json ?? false, options.open !== false);
+        case 'disconnect':
+            return disconnect(arg, options.json ?? false);
+        default:
+            process.stderr.write(colors.error(`${symbols.error} Unknown subcommand: ${sub}\n`) +
+                colors.dim('Try: codehere context-source list | connect <provider> | disconnect <provider>\n'));
+            return 2;
+    }
+}
+async function fetchJson(path, init = {}) {
+    try {
+        const r = await fetch(DAEMON_BASE + path, init);
+        if (!r.ok) {
+            const text = await r.text();
+            return { ok: false, status: r.status, error: text };
+        }
+        return { ok: true, status: r.status, data: (await r.json()) };
+    }
+    catch (err) {
+        return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
+    }
+}
+function daemonUnreachableNote(err) {
+    return (colors.error(`${symbols.error} Daemon not reachable at ${DAEMON_BASE}.\n`) +
+        colors.dim(`   Start it with: `) +
+        colors.bold('codehere start') +
+        '\n' +
+        colors.dim(`   Detail: ${err}\n`));
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* list                                                                      */
+/* ──────────────────────────────────────────────────────────────────────── */
+async function list(json) {
+    const r = await fetchJson('/api/context-sources');
+    if (!r.ok) {
+        if (json) {
+            process.stdout.write(JSON.stringify({ error: 'daemon_unreachable', detail: r.error }, null, 2) + '\n');
+        }
+        else {
+            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
+        }
+        return 2;
+    }
+    const items = r.data?.providers ?? [];
+    if (json) {
+        process.stdout.write(JSON.stringify({ providers: items }, null, 2) + '\n');
+        return 0;
+    }
+    process.stdout.write('\n' + colors.bold('Context sources') + '\n\n');
+    if (!items.length) {
+        process.stdout.write(colors.dim('  (no providers registered)\n\n'));
+        return 0;
+    }
+    for (const p of items) {
+        const tag = statusTag(p.status);
+        const who = p.userLabel ? colors.gray('· ' + p.userLabel) : '';
+        process.stdout.write(`  ${tag}  ${colors.bold(p.label.padEnd(10))} ${colors.dim(p.scheme + '://')} ${who}\n`);
+        if (!p.clientIdConfigured) {
+            process.stdout.write('       ' + colors.warning(`set CODEHERE_${p.id.toUpperCase()}_CLIENT_ID before connect()`) + '\n');
+        }
+    }
+    process.stdout.write('\n' + colors.dim('Connect: ') + colors.bold('codehere context-source connect <provider>') + '\n\n');
+    return 0;
+}
+function statusTag(s) {
+    switch (s) {
+        case 'connected':
+            return colors.green('● connected   ');
+        case 'expired':
+            return colors.warning('● expired     ');
+        case 'manual':
+            return colors.gray('● manual      ');
+        case 'disconnected':
+            return colors.gray('○ disconnected');
+    }
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* connect                                                                    */
+/* ──────────────────────────────────────────────────────────────────────── */
+async function connect(providerArg, json, openBrowser) {
+    if (!providerArg) {
+        process.stderr.write(colors.error(`${symbols.error} Need a provider id: codehere context-source connect <id>\n`));
+        return 2;
+    }
+    const r = await fetchJson(`/api/context-sources/${encodeURIComponent(providerArg)}/connect`, { method: 'POST' });
+    if (!r.ok) {
+        let detail = null;
+        try {
+            detail = JSON.parse(r.error ?? '{}');
+        }
+        catch {
+            /* ignore */
+        }
+        if (detail?.error === 'provider_not_registered') {
+            const envVar = detail.envVar ?? `CODEHERE_${providerArg.toUpperCase()}_CLIENT_ID`;
+            if (json) {
+                process.stdout.write(JSON.stringify({ error: 'provider_not_registered', envVar, message: detail.message }, null, 2) + '\n');
+            }
+            else {
+                process.stderr.write(colors.error(`${symbols.error} ${providerArg} OAuth app not registered.\n`) +
+                    colors.dim(`   ${detail.message ?? ''}\n`) +
+                    colors.dim(`   Set the env var: `) +
+                    colors.bold(envVar) +
+                    '\n');
+            }
+            return 2;
+        }
+        if (json) {
+            process.stdout.write(JSON.stringify({ error: 'connect_failed', detail: r.error }, null, 2) + '\n');
+        }
+        else {
+            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
+        }
+        return 2;
+    }
+    const url = r.data?.authorizeUrl;
+    if (!url) {
+        process.stderr.write(colors.error(`${symbols.error} Daemon did not return an authorize URL.\n`));
+        return 1;
+    }
+    if (json) {
+        process.stdout.write(JSON.stringify({ authorizeUrl: url }, null, 2) + '\n');
+        return 0;
+    }
+    process.stdout.write('\n' +
+        colors.bold(`Opening ${providerArg} OAuth flow`) +
+        '\n\n' +
+        colors.dim('  URL: ') +
+        url +
+        '\n\n' +
+        colors.dim('  Codehere will store the token at ~/.codehere/context-sources.json.\n') +
+        colors.dim('  You can close the browser tab when it says "connected".\n\n'));
+    if (openBrowser) {
+        openInBrowser(url);
+    }
+    return 0;
+}
+function openInBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    try {
+        const child = spawn(cmd, [url], { detached: true, stdio: 'ignore' });
+        child.unref();
+    }
+    catch {
+        // best-effort · the URL is already printed
+    }
+}
+/* ──────────────────────────────────────────────────────────────────────── */
+/* disconnect                                                                 */
+/* ──────────────────────────────────────────────────────────────────────── */
+async function disconnect(providerArg, json) {
+    if (!providerArg) {
+        process.stderr.write(colors.error(`${symbols.error} Need a provider id: codehere context-source disconnect <id>\n`));
+        return 2;
+    }
+    const r = await fetchJson(`/api/context-sources/${encodeURIComponent(providerArg)}/disconnect`, { method: 'POST' });
+    if (!r.ok) {
+        if (json) {
+            process.stdout.write(JSON.stringify({ error: 'disconnect_failed', detail: r.error }, null, 2) + '\n');
+        }
+        else {
+            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
+        }
+        return 2;
+    }
+    if (json) {
+        process.stdout.write(JSON.stringify(r.data) + '\n');
+        return 0;
+    }
+    if (r.data?.ok) {
+        process.stdout.write(colors.green(`${symbols.success} disconnected ${providerArg}\n`));
+    }
+    else {
+        process.stdout.write(colors.gray(`${symbols.dot} ${providerArg} was not connected\n`));
+    }
+    return 0;
+}
+//# sourceMappingURL=context-source-command.js.map

package/dist/presentation/cli/commands/help-command.js

@@ -91,7 +91,57 @@ const COMMAND_INFO = {
             { flag: '--json', description: 'Output as JSON' },
             { flag: '--export <fmt>', description: 'Export raw audit feed (jsonl, json, csv, md)' },
         ],
-        related: ['hook', 'trust'],
+        related: ['hook', 'trust', 'verify'],
+    },
+    verify: {
+        name: 'verify',
+        description: "Verify a session's Final Report against the recorded reality (catches optimistic claims)",
+        usage: 'codehere verify [session-id] [options]',
+        examples: ['codehere verify', 'codehere verify a1b2c3d4', 'codehere verify a1b2c3d4 --json'],
+        options: [{ flag: '--json', description: 'Machine-readable verdict for CI' }],
+        related: ['status', 'report', 'audit'],
+    },
+    audit: {
+        name: 'audit',
+        description: 'Inspect the hash-chained audit log · verify integrity or show one entry',
+        usage: 'codehere audit [verify|show <seq>] [options]',
+        examples: ['codehere audit', 'codehere audit verify', 'codehere audit verify --json', 'codehere audit show 42'],
+        options: [{ flag: '--json', description: 'Machine-readable output' }],
+        related: ['status', 'verify', 'hook'],
+    },
+    'context-source': {
+        name: 'context-source',
+        description: 'Connect external tools (Linear, Figma) via OAuth · list status · disconnect',
+        usage: 'codehere context-source [list|connect <provider>|disconnect <provider>]',
+        examples: [
+            'codehere context-source list',
+            'codehere context-source connect linear',
+            'codehere context-source connect figma --no-open',
+            'codehere context-source disconnect linear',
+        ],
+        options: [
+            { flag: '--json', description: 'Machine-readable output' },
+            { flag: '--no-open', description: 'For connect: print URL but skip auto-opening the browser' },
+        ],
+        related: ['serve', 'start'],
+    },
+    thread: {
+        name: 'thread',
+        description: 'Share or import a signed session bundle · local-first, no relay',
+        usage: 'codehere thread <export|import|keys|trust|untrust> [args] [options]',
+        examples: [
+            'codehere thread export <session-id> --out my-task.codehere.json',
+            'codehere thread import my-task.codehere.json',
+            'codehere thread import my-task.codehere.json --trust',
+            'codehere thread keys',
+            'codehere thread trust <pubkey-b64> "alice@laptop"',
+        ],
+        options: [
+            { flag: '--out <file>', description: 'For export: write to file (otherwise stdout)' },
+            { flag: '--trust', description: 'For import: trust the signer key then proceed' },
+            { flag: '--json', description: 'Machine-readable output' },
+        ],
+        related: ['start', 'verify'],
     },
     serve: {
         name: 'serve',

package/dist/presentation/cli/commands/report-command.js

@@ -49,7 +49,7 @@ function badgeUrl(score, grade) {
     return `https://img.shields.io/badge/codehere%20trust-${score}%25%20${grade}-${color}?logo=shield&logoColor=white`;
 }
 function narrativeSummary(report) {
-    const { overallScore, grade, criticalCount, highCount, mediumCount, lowCount, files } = report;
+    const { overallScore, criticalCount, highCount, mediumCount, files } = report;
     if (criticalCount === 0 && highCount === 0) {
         if (overallScore >= 90) {
             return (`Clean codebase. ${files.length} file${files.length !== 1 ? 's' : ''} scanned, nothing blocking a merge. ` +
@@ -66,7 +66,7 @@ function narrativeSummary(report) {
     return `No critical issues, but ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} worth addressing before merge.`;
 }
 function recommendationsMarkdown(report) {
-    const { criticalCount, highCount, mediumCount, lowCount, overallScore } = report;
+    const { criticalCount, highCount, mediumCount, lowCount } = report;
     const lines = [];
     if (criticalCount > 0) {
         lines.push(`1. **Resolve all ${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} before merging.** These represent active security risks (credentials in code, eval injection, SQL without parameterization, etc.). They're usually quick fixes.`);
@@ -85,7 +85,7 @@ function recommendationsMarkdown(report) {
     }
     return lines.join('\n\n');
 }
-function findingsMarkdown(files, cwd) {
+function findingsMarkdown(files) {
     const sections = [];
     for (const severity of ['critical', 'high', 'medium', 'low']) {
         const allFindings = [];
@@ -133,6 +133,8 @@ ${contextLine}
 
 ## Summary
 
+${summary}
+
 | | |
 |---|---|
 | Files scanned | ${files.length} |
@@ -145,7 +147,7 @@ ${contextLine}
 
 ## Findings
 
-${findingsMarkdown(files, cwd)}
+${findingsMarkdown(files)}
 
 ---