codehere 0.7.1 → 1.0.1

package/dist/infrastructure/protocols/mcp-tools.js

@@ -0,0 +1,401 @@
+// MCP tool layer extracted from mcp-server-impl.ts (god-file split, 2026-06-29).
+// The JSON-RPC surface: tool definitions + the read-only handlers + the dispatcher.
+// The HTTP daemon (startMCPServer) stays in mcp-server-impl.ts and imports dispatch+TOOLS.
+import { existsSync, readFileSync } from 'fs';
+import { relative, resolve as resolvePath, sep } from 'path';
+import { computeSpendToday } from '../cost/spend-aggregator.js';
+import { loadBudget, budgetUsedPct } from '../cost/budget-config.js';
+import { loadTeamConfig, writeMyShare, buildTeamView } from '../cost/team-ledger.js';
+import { collectFilesForMCP, scoreFileForMCP, aggregateTrust } from './mcp-helpers.js';
+import { scanPayload, calculateRiskScore, AUDIT_FILE, verifyAuditChain } from '../hooks/claude-sdk-hook.js';
+import { getVersion } from '../../utils/version.js';
+// ── Tool definitions ─────────────────────────────────────────────────────────
+// Tool annotations follow the MCP spec (the github/github-mcp-server pattern:
+// toolsets + an explicit read-only declaration). Every codehere MCP tool is
+// ANALYSIS-ONLY — none writes files, spawns agents, or mutates state — and the
+// annotations SAY so at the protocol level (readOnlyHint), so a cautious client
+// can mount codehere's MCP knowing the whole surface is inspect-only. The
+// 'toolset' grouping mirrors gh-mcp's toolset concept (security · audit).
+// NOTE: readOnlyHint/title are MCP-spec (rev 2025-03-26) fields — we still
+// declare protocolVersion 2024-11-05, where clients ignore unknown fields, so
+// this is additive; 'toolset' is a CUSTOM extension (gh-mcp's toolsets are a
+// server-side flag, not a wire field) and annotations are self-declarations,
+// not proofs. If a WRITE tool is ever added, it must carry readOnlyHint:false
+// + its own destructiveHint — and the README line "Exposes 4 read-only tools"
+// (README.md §MCP) must change in the same commit (binding honesty rule).
+export const TOOLS = [
+    {
+        name: 'codehere_trust',
+        annotations: { title: 'Trust-score a file or snippet', readOnlyHint: true, toolset: 'security' },
+        description: 'Scan a file or code snippet for security vulnerabilities. Returns a trust score 0-100, grade, and plain-English findings. Zero API calls — runs entirely locally.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                filepath: { type: 'string', description: 'Path to file (relative to cwd)' },
+                code: { type: 'string', description: 'Code content to scan (alternative to filepath)' },
+                verbose: { type: 'boolean', description: 'Include all findings with line numbers' },
+            },
+        },
+    },
+    {
+        name: 'codehere_scan',
+        annotations: { title: 'Scan text for prompt-injection / threats', readOnlyHint: true, toolset: 'security' },
+        description: 'Scan an instruction, prompt, or command text for injection attacks, credential theft attempts, destructive operations, and other threats. Returns block/allow decision with findings.',
+        inputSchema: {
+            type: 'object',
+            required: ['text'],
+            properties: {
+                text: { type: 'string', description: 'Text to scan (instruction, prompt, command)' },
+            },
+        },
+    },
+    {
+        name: 'codehere_review',
+        annotations: { title: 'Review a directory, rank riskiest files', readOnlyHint: true, toolset: 'security' },
+        description: 'Review all files in a directory and return trust scores. Identifies the riskiest files to focus review effort.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                path: { type: 'string', description: 'Directory path (default: current directory)' },
+                topN: { type: 'number', description: 'Return top N riskiest files (default: 10)' },
+            },
+        },
+    },
+    {
+        name: 'codehere_audit',
+        annotations: { title: 'Read / verify the hash-chained audit log', readOnlyHint: true, toolset: 'audit' },
+        description: 'Read recent hook audit log entries — shows which tool calls codehere blocked, allowed, or overrode (fail-open paths) in Claude Code sessions. Pass verify:true to instead validate the SHA-256 hash chain and return any tampering detected.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                limit: { type: 'number', description: 'Number of recent entries to return (default: 20)' },
+                blockedOnly: { type: 'boolean', description: 'Only return blocked events' },
+                overrideOnly: {
+                    type: 'boolean',
+                    description: 'Only return trust-override events — cases where the scanner was bypassed (stdin failure, parse failure, --log-only, scan exception). Per CC frontier Q1 (auditable permission trails) — surface every bypass for review.',
+                },
+                verify: {
+                    type: 'boolean',
+                    description: 'Verify the SHA-256 hash chain instead of returning entries. Returns { valid, totalEntries, chainedEntries, legacyEntries, errors[] } where errors lists every detected tampering point (modification / deletion / insertion / parse failure). Per CC frontier Q1 (cryptographic commitment + tamper evidence).',
+                },
+            },
+        },
+    },
+    {
+        name: 'codehere_spend',
+        annotations: { title: "Today's estimated spend by agent and project", readOnlyHint: true, toolset: 'cost' },
+        description: "Today's estimated coding-agent spend on this machine, broken down by agent and project, against the daily budget. So you can answer 'what have we spent today' from inside the session. Estimate from real token counts at published rates, not a provider invoice.",
+        inputSchema: { type: 'object', properties: {} },
+    },
+    {
+        name: 'codehere_team',
+        annotations: { title: 'Merged team cost + record across machines', readOnlyHint: true, toolset: 'cost' },
+        description: "The team's merged cost and integrity-checked record across every machine that shares the team git repo (spend by machine, total recorded actions, any broken audit chains). Falls back to this machine's solo view when no team is configured. Pass strict:true to REFUSE a total when any share is tampered or its audit chain is broken, instead of reporting a number that can't be trusted.",
+        inputSchema: {
+            type: 'object',
+            properties: {
+                strict: {
+                    type: 'boolean',
+                    description: 'When true, if any share is tampered or its audit chain is broken, return a refusal naming the untrustworthy machines instead of a team total.',
+                },
+            },
+        },
+    },
+];
+/** codehere_spend MCP tool: today's estimated spend, structured numbers plus a
+ *  one-line summary the agent can quote. Reads local state only. */
+function handleSpend(_params) {
+    const s = computeSpendToday();
+    const cfg = loadBudget();
+    const fmt = (n) => '$' + (Number(n) || 0).toFixed(2);
+    const pct = budgetUsedPct(s.totalUsd, cfg);
+    const head = cfg.dailyUsd != null
+        ? `codehere spend today: ${fmt(s.totalUsd)} of ${fmt(cfg.dailyUsd)} daily budget (${pct ?? 0}% used), across ${s.sessionCount} session${s.sessionCount === 1 ? '' : 's'}.`
+        : `codehere spend today: ${fmt(s.totalUsd)} across ${s.sessionCount} session${s.sessionCount === 1 ? '' : 's'}, no budget set.`;
+    const agents = Object.entries(s.byAgent || {})
+        .map(([a, v]) => `  ${a}: ${fmt(v.usd)} (${v.sessions} session${v.sessions === 1 ? '' : 's'})`)
+        .join('\n') || '  (no agent spend today)';
+    const projects = Object.entries(s.byProject || {})
+        .map(([p, v]) => `  ${p}: ${fmt(v.usd)}`)
+        .join('\n') || '  (no project spend today)';
+    const raw = JSON.stringify({
+        totalUsd: s.totalUsd,
+        sessionCount: s.sessionCount,
+        dailyBudgetUsd: cfg.dailyUsd,
+        pctUsed: pct,
+        byAgent: s.byAgent,
+        byProject: s.byProject,
+        tokens: s.tokens,
+    });
+    return `${head}\nEstimate from real token counts at published rates, not a provider invoice.\n\nBy agent:\n${agents}\n\nBy project:\n${projects}\n\nRaw: ${raw}`;
+}
+/** codehere_team MCP tool: the merged team view, or this machine's solo view when
+ *  no team git repo is configured. Reads local + the team dir only. */
+function handleTeam(_params) {
+    const strict = Boolean(_params?.strict);
+    const fmt = (n) => '$' + (Number(n) || 0).toFixed(2);
+    const cfg = loadTeamConfig();
+    if (!cfg.dir) {
+        const s = computeSpendToday();
+        return `No team configured. This machine today: ${fmt(s.totalUsd)} across ${s.sessionCount} session${s.sessionCount === 1 ? '' : 's'}. Run "codehere team set-dir <a git repo>" on each machine to merge the whole team, local-first.`;
+    }
+    try {
+        writeMyShare(cfg.dir);
+    }
+    catch {
+        /* dir not writable; still read what is there */
+    }
+    const v = buildTeamView(cfg.dir, cfg.dailyUsd);
+    const count = (v.machines || []).length;
+    const machines = (v.machines || []).map((m) => `  ${m.machineId}: ${fmt(m.totalUsd)}`).join('\n') || '  (none)';
+    const agents = Object.entries(v.perAgent || {}).sort((a, b) => b[1] - a[1]);
+    const byAgent = agents.length
+        ? '\n\nBy agent (cost · what each did):\n' +
+            agents
+                .map(([a, usd]) => {
+                const s = v.perAgentSessions?.[a] ?? 0;
+                return `  ${a}: ${fmt(usd)} · ${s} session${s === 1 ? '' : 's'}`;
+            })
+                .join('\n')
+        : '';
+    const broken = v.brokenChains || [];
+    const brokenLine = broken.length
+        ? `\nBROKEN audit chain on: ${broken.join(', ')}. Investigate before trusting that record.`
+        : '';
+    const tampered = v.tamperedShares || [];
+    const unsigned = v.unsignedShares || [];
+    const sigLine = tampered.length
+        ? `\nSIGNATURE INVALID on: ${tampered.join(', ')} — that share was altered or re-signed with a different key than first seen. Do not trust it.`
+        : count
+            ? `\nAll shares signed; keys match the ones first seen (no post-write change detected).`
+            : '';
+    const unsignedLine = unsigned.length ? `\nUnsigned, can't verify: ${unsigned.join(', ')}.` : '';
+    if (strict) {
+        const bad = [...new Set([...tampered, ...broken])];
+        if (bad.length) {
+            return `REFUSED (strict): the team record can't be trusted — ${bad.join(', ')} ${bad.length === 1 ? 'is' : 'are'} tampered or ${bad.length === 1 ? 'has' : 'have'} a broken audit chain. Not reporting a total. Investigate that machine's share before trusting the record.\n\nRaw: ${JSON.stringify({ strict: true, ok: false, untrustworthy: bad, tamperedShares: tampered, brokenChains: broken })}`;
+        }
+    }
+    const head = `codehere team today: ${fmt(v.teamTotal)}${v.dailyUsd != null ? ` of ${fmt(v.dailyUsd)} team budget` : ''} across ${count} machine${count === 1 ? '' : 's'}, ${(v.totalActions || 0).toLocaleString()} recorded actions.`;
+    const practiceLine = v.practice && v.practice.sessions > 0
+        ? `\nPractice runs: ${v.practice.sessions} session${v.practice.sessions === 1 ? '' : 's'} · ${fmt(v.practice.usd)} fabricated · not in the totals.`
+        : '';
+    return `${head}\nEstimate from real tokens at published rates, not a provider invoice.${practiceLine}${brokenLine}${sigLine}${unsignedLine}\n\nBy machine:\n${machines}${byAgent}\n\nRaw: ${JSON.stringify(v)}`;
+}
+function handleTrust(params) {
+    const { filepath, code, verbose } = params;
+    let content;
+    let label;
+    if (code) {
+        content = code;
+        label = 'provided code';
+    }
+    else if (filepath) {
+        // MED #31 (atomic audit) · scope the inspect-only trust tool to the cwd:
+        // '../../etc/passwd' walked out of the workspace. Read-only, so the
+        // blast radius was disclosure-shaped — still, the tool's contract says
+        // "scores YOUR project's file".
+        const resolved = resolvePath(process.cwd(), filepath);
+        if (resolved !== process.cwd() && !resolved.startsWith(process.cwd() + sep)) {
+            return JSON.stringify({ error: `Path escapes the workspace: ${filepath}` });
+        }
+        if (!existsSync(resolved)) {
+            return JSON.stringify({ error: `File not found: ${filepath}` });
+        }
+        content = readFileSync(resolved, 'utf-8');
+        label = filepath;
+    }
+    else {
+        return JSON.stringify({ error: 'Provide either filepath or code' });
+    }
+    const result = scoreFileForMCP(label, content);
+    if (!verbose) {
+        // Compact response
+        return JSON.stringify({
+            score: result.score,
+            grade: result.grade,
+            summary: result.summary,
+            criticalCount: result.findings.filter((f) => f.severity === 'critical').length,
+            highCount: result.findings.filter((f) => f.severity === 'high').length,
+            recommendation: result.score >= 75
+                ? 'Safe — minor issues can be addressed in follow-up'
+                : result.score >= 60
+                    ? 'Review recommended before merge'
+                    : 'Block — resolve critical/high findings first',
+        });
+    }
+    return JSON.stringify(result, null, 2);
+}
+function handleScan(params) {
+    const text = String(params.text ?? '');
+    const findings = scanPayload(text);
+    const riskScore = calculateRiskScore(findings);
+    const criticalFindings = findings.filter((f) => f.severity === 'critical');
+    const blocked = criticalFindings.length > 0 || riskScore >= 60;
+    return JSON.stringify({
+        blocked,
+        riskScore,
+        decision: blocked ? 'block' : 'allow',
+        reason: blocked
+            ? criticalFindings.length > 0
+                ? `${criticalFindings[0].category}: ${criticalFindings[0].description}`
+                : `Risk score ${riskScore}/100 exceeds threshold`
+            : 'No threats detected',
+        findings: findings.slice(0, 10), // cap at 10 to keep response small
+    });
+}
+/**
+ * Coerce a client-supplied numeric param to a bounded integer. Daemon
+ * endpoints take topN/limit straight from request bodies; a negative or NaN
+ * value silently corrupts slice() math (limit=-1 → slice keeps all-but-last,
+ * NaN → slice returns everything). Clamp to a sane range instead of trusting
+ * the wire.
+ */
+export function clampInt(v, def, min, max) {
+    // null/undefined = absent → default. Number(null) is 0 (finite), so without
+    // this guard a literal null would coerce to the min instead of the default.
+    if (v === null || v === undefined)
+        return def;
+    const n = Math.floor(Number(v));
+    if (!Number.isFinite(n))
+        return def;
+    return Math.max(min, Math.min(n, max));
+}
+function handleReview(params) {
+    const targetPath = String(params.path ?? process.cwd());
+    const topN = clampInt(params.topN, 10, 1, 100);
+    try {
+        const files = collectFilesForMCP(targetPath);
+        if (files.length === 0) {
+            return JSON.stringify({ message: 'No code files found', path: targetPath });
+        }
+        const results = files.map((f) => scoreFileForMCP(relative(targetPath, f.filepath), f.code));
+        results.sort((a, b) => a.score - b.score); // worst first
+        const top = results.slice(0, topN);
+        // Use the shared honesty floor (a critical finding caps the grade at F) so the
+        // MCP grade can never disagree with the CLI's grade for the same directory.
+        const { overallScore, grade } = aggregateTrust(results);
+        return JSON.stringify({
+            overallScore,
+            grade,
+            totalFiles: results.length,
+            riskiestFiles: top.map((r) => ({
+                filepath: r.filepath,
+                score: r.score,
+                grade: r.grade,
+                summary: r.summary,
+                criticalCount: r.findings.filter((f) => f.severity === 'critical').length,
+                highCount: r.findings.filter((f) => f.severity === 'high').length,
+            })),
+        });
+    }
+    catch (e) {
+        return JSON.stringify({ error: String(e) });
+    }
+}
+function handleAudit(params) {
+    const limit = clampInt(params.limit, 20, 1, 500);
+    const blockedOnly = Boolean(params.blockedOnly);
+    const overrideOnly = Boolean(params.overrideOnly);
+    const verify = Boolean(params.verify);
+    if (verify) {
+        // Tamper-evidence verification — walks the file, recomputes every hash,
+        // checks the chain. Returns full report including ALL break points.
+        const result = verifyAuditChain(AUDIT_FILE);
+        return JSON.stringify(result, null, 2);
+    }
+    if (!existsSync(AUDIT_FILE)) {
+        return JSON.stringify({
+            message: 'No audit log yet — install hooks first with: codehere hook install',
+            entries: [],
+        });
+    }
+    const lines = readFileSync(AUDIT_FILE, 'utf-8')
+        .split('\n')
+        .filter(Boolean)
+        .slice(-Math.min(limit * 3, 500)); // read more than needed to account for filter
+    const entries = lines
+        .map((l) => {
+        try {
+            return JSON.parse(l);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter(Boolean)
+        .filter((e) => {
+        if (overrideOnly)
+            return Boolean(e.overrideReason);
+        if (blockedOnly)
+            return Boolean(e.blocked);
+        return true;
+    })
+        .slice(-limit);
+    return JSON.stringify({ entries, total: entries.length });
+}
+// ── JSON-RPC dispatcher ──────────────────────────────────────────────────────
+export function dispatch(req) {
+    const id = req.id;
+    const params = (req.params ?? {});
+    try {
+        switch (req.method) {
+            case 'initialize': {
+                // Echo the client's requested protocol version so Streamable-HTTP
+                // clients (Codex on 2025-x) negotiate; fall back to the baseline.
+                const clientPv = typeof params.protocolVersion === 'string' ? params.protocolVersion : '2024-11-05';
+                return {
+                    jsonrpc: '2.0',
+                    id,
+                    result: {
+                        protocolVersion: clientPv,
+                        capabilities: { tools: {} },
+                        serverInfo: { name: 'codehere', version: getVersion() },
+                    },
+                };
+            }
+            case 'tools/list':
+                return { jsonrpc: '2.0', id, result: { tools: TOOLS } };
+            case 'tools/call': {
+                const toolName = String(params.name ?? '');
+                const toolParams = (params.arguments ?? {});
+                let content;
+                switch (toolName) {
+                    case 'codehere_trust':
+                        content = handleTrust(toolParams);
+                        break;
+                    case 'codehere_scan':
+                        content = handleScan(toolParams);
+                        break;
+                    case 'codehere_review':
+                        content = handleReview(toolParams);
+                        break;
+                    case 'codehere_audit':
+                        content = handleAudit(toolParams);
+                        break;
+                    case 'codehere_spend':
+                        content = handleSpend(toolParams);
+                        break;
+                    case 'codehere_team':
+                        content = handleTeam(toolParams);
+                        break;
+                    default:
+                        return { jsonrpc: '2.0', id, error: { code: -32601, message: `Unknown tool: ${toolName}` } };
+                }
+                return {
+                    jsonrpc: '2.0',
+                    id,
+                    result: { content: [{ type: 'text', text: content }] },
+                };
+            }
+            case 'ping':
+                return { jsonrpc: '2.0', id, result: {} };
+            default:
+                return { jsonrpc: '2.0', id, error: { code: -32601, message: `Method not found: ${req.method}` } };
+        }
+    }
+    catch (e) {
+        return { jsonrpc: '2.0', id, error: { code: -32603, message: String(e) } };
+    }
+}
+//# sourceMappingURL=mcp-tools.js.map

package/dist/infrastructure/protocols/ui/app-script-artifacts.js

@@ -0,0 +1,121 @@
+/**
+ * Structured artifacts — the comparison table, response mock and recommendation pick an agent
+ * produces, rendered from a typed data array rather than hand-authored HTML, plus the JSON
+ * tinting they use.
+ *
+ * Split out of app-script.ts (strangler fig, split 15). Verbatim slice, interpolated back where
+ * it was cut so it keeps sharing the surrounding IIFE scope. Verified by hashing the composed
+ * APP_SCRIPT before and after: same bytes.
+ *
+ * The primitive is real: these render from `t.artifacts.structured[]`, so what you see is what
+ * the adapter actually emitted. That is the difference between a demo and a record.
+ */
+export const ARTIFACTS = `// Structured artifacts · render the comparison table / response mock /
+// recommendation pick that an agent produces, from a typed data array — NOT
+// hand-authored HTML. The demo v12 weaves these into Phase 1; here they render
+// from t.artifacts.structured[] so the primitive is real (seeded today, real
+// adapter output later · demo-synth pattern).
+function renderArtifacts(arr){
+  if(!Array.isArray(arr)||!arr.length)return'';
+  function he(s){ return String(s==null?'':s).replace(/[&<>"]/g, c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])); }
+  function tintJson(raw){
+    return he(raw)
+      .replace(/&quot;([^&]*?)&quot;(\\s*:)/g, '<span class="jk">&quot;$1&quot;</span>$2')
+      .replace(/:\\s*&quot;([^&]*?)&quot;/g, ': <span class="js">&quot;$1&quot;</span>')
+      .replace(/:\\s*(-?\\d+(?:\\.\\d+)?)/g, ': <span class="jn">$1</span>');
+  }
+  let out='<div class="panel"><div class="panel-title">Artifacts produced</div>';
+  for(const a of arr){
+    if(a.type==='comparison'){
+      const cols=a.columns||[];
+      let g='<div class="art-cmp" style="grid-template-columns:130px repeat('+cols.length+',1fr)">';
+      g+='<div class="hd"></div>'+cols.map(c=>'<div class="hd">'+he(c)+'</div>').join('');
+      for(const r of (a.rows||[])){
+        g+='<div class="rl">'+he(r.label)+'</div>';
+        for(const cell of (r.cells||[])){
+          const mk = cell.mark==='pick'?'pick':cell.mark==='meh'?'meh':'';
+          g+='<div class="cell">'+(mk?'<span class="'+mk+'">'+he(cell.text)+'</span>':he(cell.text))+'</div>';
+        }
+      }
+      g+='</div>';
+      out+='<div class="artifact-card" data-user-content>'+(a.title?'<div class="artifact-h">'+he(a.title)+'</div>':'')+g+'</div>';
+    } else if(a.type==='mock'){
+      out+='<div class="art-mock">'
+        +'<div class="art-mock-head"><span class="status">'+he(a.status||'')+'</span>'+(a.contentType?'<span class="ct">'+he(a.contentType)+'</span>':'')+'</div>'
+        +'<div class="art-mock-body">'+tintJson(a.body||'')+'</div>'
+        +'</div>';
+    } else if(a.type==='pick'){
+      out+='<div class="art-pick">'
+        +'<div class="k">'+he(a.title||'')+'</div>'
+        +(a.what?'<div class="what">'+he(a.what)+'</div>':'')
+        +(a.why?'<div class="why">'+he(a.why)+'</div>':'')
+        +'</div>';
+    } else if(a.type==='bench'){
+      // Benchmark chart · horizontal bars · demo v12 .bench (phase audit 2.10)
+      let rows=(a.rows||[]).map(function(r){
+        const mk=r.mark==='allow'?' allow':r.mark==='warn'?' warn':'';
+        const pct=Math.max(0,Math.min(100,Number(r.pct)||0));
+        return '<div class="art-bench"><span class="bl">'+he(r.label)+'</span>'
+          +'<span class="bb"><span class="bf'+mk+'" style="width:'+pct+'%"></span></span>'
+          +'<span class="bv">'+he(r.value)+'</span></div>';
+      }).join('');
+      out+='<div class="artifact-card" data-user-content>'+(a.title?'<div class="artifact-h">'+he(a.title)+'</div>':'')+rows+'</div>';
+    } else if(a.type==='checklist'){
+      // Verifier severity grid · ✓/⚠ per check · demo v12 (phase audit 4.4/3.3)
+      let items=(a.items||[]).map(function(it){
+        const ok=it.ok!==false;
+        return '<div class="art-check'+(ok?'':' warn')+'">'
+          +'<span class="ci">'+(ok?'\\u2713':'\\u26A0')+'</span>'
+          +'<span class="cl">'+he(it.label)+'</span>'
+          +(it.note?'<span class="cn">'+he(it.note)+'</span>':'')
+          +'</div>';
+      }).join('');
+      out+='<div class="artifact-card" data-user-content>'+(a.title?'<div class="artifact-h">'+he(a.title)+'</div>':'')+'<div class="art-checklist">'+items+'</div></div>';
+    } else if(a.type==='sequence'){
+      // Sequence diagram · inline SVG · auto-layout actors + messages from a typed
+      // directive — NOT hand-authored SVG (demo v12 Artifact 2 · phase audit 1.13 · C-13).
+      const parts=(a.participants||[]).map(String);
+      const msgs=a.messages||[];
+      const n=parts.length;
+      if(n>=2){
+        const colW=148, padX=14, padTop=12, boxH=26, headGap=20, rowH=34, padBot=16, loopW=42;
+        const cx=i=>padX+74+colW*i;                 // center x of lifeline i
+        const w=padX*2+148+colW*(n-1)+loopW;        // right margin covers a trailing self-loop
+        const topY=padTop+boxH;
+        const h=topY+headGap+rowH*msgs.length+padBot;
+        const cls=m=>m.mark==='allow'?'allow':m.mark==='warn'?'warn':m.ret?'ret':'';
+        const head=m=>m.mark==='allow'?'ah-allow':m.mark==='warn'?'ah-warn':m.ret?'ah-ret':'ah';
+        let svg='<svg class="seq-svg" viewBox="0 0 '+w+' '+h+'" width="'+w+'" height="'+h+'" preserveAspectRatio="xMidYMin meet">';
+        svg+='<defs>';
+        ['ah','ah-allow','ah-warn','ah-ret'].forEach(function(id){
+          svg+='<marker id="seq-'+id+'" markerWidth="9" markerHeight="9" refX="6.5" refY="3.5" orient="auto"><path class="'+id+'" d="M0,0 L7,3.5 L0,7 Z"/></marker>';
+        });
+        svg+='</defs>';
+        for(let i=0;i<n;i++){
+          const x=cx(i), bw=Math.max(76,parts[i].length*7+18);
+          svg+='<line class="ll" x1="'+x+'" y1="'+topY+'" x2="'+x+'" y2="'+(h-padBot)+'"/>';
+          svg+='<rect class="box" x="'+(x-bw/2)+'" y="'+padTop+'" width="'+bw+'" height="'+boxH+'" rx="5"/>';
+          svg+='<text class="at" x="'+x+'" y="'+(padTop+boxH/2+4)+'" text-anchor="middle" font-size="11" font-family="ui-monospace,monospace">'+he(parts[i])+'</text>';
+        }
+        msgs.forEach(function(m,mi){
+          const fi=typeof m.from==='number'?m.from:parts.indexOf(m.from);
+          const ti=typeof m.to==='number'?m.to:parts.indexOf(m.to);
+          if(fi<0||ti<0)return;
+          const y=topY+headGap+rowH*mi+rowH/2, x1=cx(fi), x2=cx(ti), c=cls(m), tc=(c==='allow'||c==='warn')?' '+c:'';
+          if(fi===ti){                              // self-message · small loop to the right
+            svg+='<path class="msg '+c+'" d="M'+x1+','+(y-5)+' h'+loopW+' v10 h-'+loopW+'" marker-end="url(#seq-'+head(m)+')"/>';
+            svg+='<text class="mt'+tc+'" x="'+(x1+loopW+5)+'" y="'+(y-8)+'" font-size="10" font-family="ui-monospace,monospace">'+he(m.label||'')+'</text>';
+          } else {
+            svg+='<line class="msg '+c+'" x1="'+x1+'" y1="'+y+'" x2="'+x2+'" y2="'+y+'" marker-end="url(#seq-'+head(m)+')"/>';
+            svg+='<text class="mt'+tc+'" x="'+((x1+x2)/2)+'" y="'+(y-6)+'" text-anchor="middle" font-size="10" font-family="ui-monospace,monospace">'+he(m.label||'')+'</text>';
+          }
+        });
+        svg+='</svg>';
+        out+='<div class="artifact-card" data-user-content>'+(a.title?'<div class="artifact-h">'+he(a.title)+'</div>':'')+'<div class="art-seq">'+svg+'</div></div>';
+      }
+    }
+  }
+  out+='</div>';
+  return out;
+}`;
+//# sourceMappingURL=app-script-artifacts.js.map

package/dist/infrastructure/protocols/ui/app-script-audit-footer.js

@@ -0,0 +1,44 @@
+/**
+ * Audit-chain footer stats and activity dots — the always-visible summary of how much the
+ * chain has recorded and whether it is still intact.
+ *
+ * Split out of app-script.ts (strangler fig). Verbatim slice, interpolated back at the
+ * position it was cut from so it keeps sharing the surrounding IIFE scope — its functions
+ * are still called from the code left behind. Verified by hashing the composed APP_SCRIPT
+ * before and after: same bytes.
+ */
+export const AUDIT_FOOTER = `  /* Audit-chain footer stats + activity dots · enriches the footer
+     from a one-liner to a real status panel. Polls /api/audit/summary
+     every 8s. */
+  async function pollAuditStats(){
+    try{
+      const r = await fetch('/api/audit/summary');
+      if(!r.ok) return;
+      const d = await r.json();
+      const statsEl = document.getElementById('audit-chain-stats');
+      const dotsEl = document.getElementById('audit-chain-dots');
+      if(statsEl){
+        const actions = d.actions || 0;
+        const blocked = d.blocked || 0;
+        const agents = d.agents || 0;
+        statsEl.textContent = actions+' entries last 24h · '+agents+' agent'+(agents===1?'':'s')+' · '+blocked+' blocked';
+      }
+      if(dotsEl){
+        // Without per-entry recent[], approximate by drawing N=min(actions,12)
+        // green dots and B=min(blocked, 12) red dots. Honest enough · still
+        // gives the user visual "audit chain is alive" signal.
+        const a = Math.min(d.actions||0, 12);
+        const b = Math.min(d.blocked||0, 12);
+        const greens = Math.max(0, a - b);
+        let h = '';
+        for(let i=0;i<b;i++) h += '<span class="dot block" title="blocked entry"></span>';
+        for(let i=0;i<greens;i++) h += '<span class="dot allow" title="allowed entry"></span>';
+        if(!a) for(let i=0;i<3;i++) h += '<span class="dot muted" title="no entries yet"></span>';
+        dotsEl.innerHTML = h;
+      }
+    }catch{ /* ignore */ }
+  }
+  setInterval(pollAuditStats, 8000);
+  pollAuditStats();
+`;
+//# sourceMappingURL=app-script-audit-footer.js.map

package/dist/infrastructure/protocols/ui/app-script-audit-verify.js

@@ -0,0 +1,56 @@
+/**
+ * Audit-chain verification — the dashboard button that asks the daemon to re-walk the hash
+ * chain and renders the verdict it gets back.
+ *
+ * Split out of app-script.ts (strangler fig). Verbatim slice, interpolated back at the
+ * position it was cut from so it keeps sharing the surrounding IIFE scope. Verified by
+ * hashing the composed APP_SCRIPT before and after: same bytes.
+ */
+export const AUDIT_CHAIN_VERIFY = `// F-06 · audit chain verification · click handler for the dashboard panel.
+async function verifyAuditChain(){
+  const btn=document.getElementById('audit-verify-btn');
+  const res=document.getElementById('audit-result');
+  if(!btn||!res)return;
+  btn.textContent='Verifying...';
+  btn.className='audit-chain-btn';
+  try{
+    const r=await fetch('/api/audit/verify').then(x=>x.json());
+    if(r.error){
+      res.innerHTML='<span class="fail">Failed: '+String(r.error).replace(/</g,'&lt;')+'</span>';
+      btn.textContent='Verify chain'; return;
+    }
+    const counts='<div class="audit-chain-counts">'+r.totalEntries+' entries &middot; '+r.chainedEntries+' hash-chained &middot; '+r.legacyEntries+' legacy</div>';
+    // Ask "is there anything here?" BEFORE "did it pass?", and never make the empty branch
+    // depend on r.valid.
+    //
+    // This read \`r.valid && totalEntries===0\`, which was correct against the OLD API — back
+    // when an empty chain returned valid:true, the lie that f030769 fixed. Making the API
+    // honest (valid:false when there is nothing to verify) turned this branch unreachable, so
+    // a fresh install clicking "verify log" got "× Chain BROKEN · 0 break point(s) detected"
+    // in red. Self-contradictory on its face, and alarming for someone whose only mistake was
+    // not having run an agent yet.
+    //
+    // Fixing valid without walking every consumer of valid is how a two-state control over a
+    // three-state fact keeps producing a new lie in a new place. Empty is its own answer.
+    if((r.totalEntries||0)===0 || r.verifiable===false){
+      res.innerHTML='<div class="audit-chain-counts">Nothing recorded yet &middot; run an agent through codehere to start the chain.</div>';
+      btn.textContent='Verify chain';
+      btn.className='audit-chain-btn';
+    } else if(r.valid){
+      res.innerHTML='<span class="ok">&check; Chain intact &middot; every entry verified against its predecessor hash.</span>'+counts;
+      btn.textContent='Chain intact';
+      btn.className='audit-chain-btn verified';
+    } else {
+      const errs=(r.errors||[]).slice(0,5).map(function(e){
+        return '<div class="audit-chain-error">line '+e.lineNumber+' &middot; '+e.reason+' &middot; '+String(e.detail||'').replace(/</g,'&lt;')+'</div>';
+      }).join('');
+      res.innerHTML='<span class="fail">&times; Chain BROKEN &middot; '+(r.errors||[]).length+' break point(s) detected.</span>'+counts+errs;
+      btn.textContent='Re-verify';
+      btn.className='audit-chain-btn broken';
+    }
+  }catch(e){
+    res.innerHTML='<span class="fail">Failed to reach /api/audit/verify: '+(e&&e.message?e.message:String(e))+'</span>';
+    btn.textContent='Verify chain';
+  }
+}`;
+//# sourceMappingURL=app-script-audit-verify.js.map