codehere 0.7.1 → 1.0.1

package/dist/presentation/cli/commands/search-command.js

@@ -0,0 +1,51 @@
+/**
+ * `codehere search "<query>"` — REQUEST_METHOD stage 7 (Learn) / #19.
+ * Search past agent sessions with PROVENANCE: which agent ran it, whether it
+ * succeeded, in which project. Local-first (reads on-disk records, no network).
+ * Follows the CLI color economy (DESIGN.md §5.2): colour carries meaning, and
+ * the output stays legible under NO_COLOR (glyph + word carry the status).
+ */
+import { searchSessions } from '../../../application/use-cases/search-sessions.js';
+import { colors, symbols, newline } from '../../../ui.js';
+function statusGlyph(status) {
+    const s = status.toLowerCase();
+    if (/completed|done/.test(s))
+        return colors.verified(symbols.success); // ✓ verified
+    if (/error|caught|stopped|failed/.test(s))
+        return colors.caught(symbols.error); // ✕
+    return colors.dim('·'); // ·  pending / other
+}
+export function executeSearchCommand(query, options) {
+    const limit = options.limit ? Math.max(1, parseInt(options.limit, 10) || 10) : 10;
+    const hits = searchSessions(query, { limit });
+    if (options.json) {
+        process.stdout.write(JSON.stringify(hits, null, 2) + '\n');
+        return 0;
+    }
+    if (!hits.length) {
+        process.stdout.write(colors.dim(`No past sessions match "${query}".\n`));
+        return 0;
+    }
+    newline();
+    process.stdout.write(colors.heading(`${hits.length} past session${hits.length === 1 ? '' : 's'} for "${query}"`) +
+        colors.dim('  (provenance: which agent · whether it succeeded)') +
+        '\n\n');
+    for (const h of hits) {
+        // provenance line: agent · verdict · status · id · project
+        process.stdout.write('  ' +
+            colors.identity(h.agent.padEnd(12)) +
+            ' ' +
+            statusGlyph(h.status) +
+            ' ' +
+            colors.dim(h.status.padEnd(10)) +
+            ' ' +
+            colors.evidence(h.sessionId.slice(0, 8)) +
+            '  ' +
+            colors.dim(h.project) +
+            '\n');
+        process.stdout.write('    ' + colors.dim(h.snippet) + '\n\n');
+    }
+    process.stdout.write(colors.dim('Open one:  ') + colors.bold('codehere verify <id>') + '\n\n');
+    return 0;
+}
+//# sourceMappingURL=search-command.js.map

package/dist/presentation/cli/commands/setup-command.js

@@ -39,7 +39,11 @@ function printAgentLines(all) {
             console.log(warning(`${a.label}: installed, needs sign-in`) + hint);
         }
         else if (a.state === 'billed_key_required') {
-            console.log(colors.dim(`○ ${a.label}: needs a billed API key (paid)`));
+            // Surface the adapter's own authHint instead of a hardcoded "paid" label —
+            // some agents (Aider via LiteLLM) actually have a $0 path the detail names.
+            console.log(colors.dim(`○ ${a.label}: installed, needs a model + key`));
+            if (a.authHint?.detail)
+                console.log(colors.dim(`  ${a.authHint.detail}`));
         }
         else {
             const hint = a.installHint?.command ? colors.dim(`  (install: ${a.installHint.command})`) : '';
@@ -47,6 +51,27 @@ function printAgentLines(all) {
         }
     }
 }
+/**
+ * The free-tier setup recipe (Phase 1 — free-tier-first). One compact,
+ * copy-pasteable line per vendor showing the CHEAPEST way to get it running —
+ * so a user testing all 5 vendors knows exactly how to do it for ~$0. Shown
+ * when no agent is ready yet (the moment the user needs it). Mirrors the
+ * per-agent readiness authHints; kept here as one consolidated cheatsheet
+ * because the readiness hints surface one-at-a-time, not as a plan.
+ */
+function printFreeTierRecipe() {
+    console.log(colors.bold('Set up any agent for free (or near-free):'));
+    console.log(colors.cyan('  Claude') +
+        colors.dim('    run `claude` › /login · uses your Claude subscription (no API key, no per-token bill)'));
+    console.log(colors.cyan('  Gemini') +
+        colors.dim('    export GEMINI_API_KEY=…   free tier › https://aistudio.google.com/apikey'));
+    console.log(colors.cyan('  Codex') +
+        colors.dim('     run `codex login` with a ChatGPT Plus/Pro account · flat, no per-token charge'));
+    console.log(colors.cyan('  OpenCode') +
+        colors.dim('  run `opencode auth` · point at a local Ollama model or a free provider ($0)'));
+    console.log(colors.cyan('  Aider') +
+        colors.dim('     reuse the free Gemini key: `--model gemini/gemini-2.5-flash` (routes via LiteLLM, $0)'));
+}
 /**
  * Check if any API key is configured
  */
@@ -162,9 +187,9 @@ export async function executeSetupCommand(force = false) {
             console.log(colors.dim('  Next: codehere start   (open the dashboard)'));
         }
         else {
-            console.log(warning('No coding agent is set up yet. Install or sign in to one:'));
-            console.log(colors.cyan('  npm i -g @anthropic-ai/claude-code') + colors.dim('   then run: claude   (sign in)'));
-            console.log(colors.dim('  Already use one by API key? export ANTHROPIC_API_KEY=sk-ant-...'));
+            console.log(warning('No coding agent is set up yet.'));
+            console.log();
+            printFreeTierRecipe();
         }
         return;
     }
@@ -206,15 +231,13 @@ export async function executeSetupCommand(force = false) {
         else if (apiKeyCheck.configured) {
             // No agent CLI ready, but a key is present — some adapters (e.g. Aider) run off it.
             console.log(success(`${apiKeyCheck.provider} API key found.`));
-            console.log(colors.dim('  No agent CLI detected yet — install one for the full experience.'));
+            console.log(colors.dim('  No agent CLI detected yet · install one for the full experience.'));
             result.apiKeyConfigured = true;
         }
         else {
             console.log(warning('No coding agent is set up yet.'));
             newline();
-            console.log(colors.bold('Install or sign in to at least one:'));
-            console.log(colors.cyan('  npm i -g @anthropic-ai/claude-code') + colors.dim('   then run: claude   (sign in)'));
-            console.log(colors.dim('  Already use one by API key? export ANTHROPIC_API_KEY=sk-ant-...'));
+            printFreeTierRecipe();
             newline();
         }
         newline();

package/dist/presentation/cli/commands/status-command.js

@@ -17,13 +17,17 @@ import { getVersion } from '../../../utils/version.js';
 import { loadProductContext } from '../../../infrastructure/config/product-context.js';
 import { AUDIT_FILE } from '../../../infrastructure/hooks/claude-sdk-hook.js';
 import { analyzeSessions, detectAmplificationAlerts, formatDuration, } from '../../../infrastructure/hooks/session-analyzer.js';
-function readAuditLog(maxLines = 5000) {
+// Reads the FULL audit log. A prior 5000-line cap fed the "All time" column —
+// so with >5000 entries the dashboard showed e.g. "All time: 5000" when the
+// true total was ~8k (DISCOVERED-006: a precise number that's wrong is worse
+// than none). The recent-blocks list caps itself downstream via slice(-20);
+// the time-window stats filter by timestamp — neither needs a read cap.
+function readAuditLog() {
     if (!existsSync(AUDIT_FILE))
         return [];
     try {
         const lines = readFileSync(AUDIT_FILE, 'utf-8').split('\n').filter(Boolean);
-        const recent = lines.slice(-maxLines);
-        return recent
+        return lines
             .map((l) => {
             try {
                 return JSON.parse(l);
@@ -41,6 +45,24 @@ function readAuditLog(maxLines = 5000) {
 function withinHours(timestamp, hours) {
     return Date.now() - new Date(timestamp).getTime() < hours * 3600 * 1000;
 }
+// Real daemon reachability — the "Status" line was a hardcoded "Running" that
+// stayed green even with no daemon up (a green-on-failure lie at the surface).
+// Probe /health with a short timeout so the dashboard reports the true state.
+async function probeDaemonRunning(port = parseInt(process.env.CODEHERE_PORT ?? '3773', 10) || 3773, host = '127.0.0.1') {
+    const http = await import('http');
+    return new Promise((resolve) => {
+        const req = http.get({ host, port, path: '/health', timeout: 500 }, (res) => {
+            const ok = res.statusCode === 200;
+            res.resume();
+            resolve(ok);
+        });
+        req.on('error', () => resolve(false));
+        req.on('timeout', () => {
+            req.destroy();
+            resolve(false);
+        });
+    });
+}
 function timeAgo(timestamp) {
     const ms = Date.now() - new Date(timestamp).getTime();
     const mins = Math.floor(ms / 60000);
@@ -126,7 +148,7 @@ function renderSessionDrillDown(sessionId, entries) {
             const tool = colors.cyan(entry.toolName.padEnd(12));
             const reason = extractBlockReason(entry);
             const risk = entry.riskScore > 70 ? colors.red(`risk:${entry.riskScore}`) : colors.yellow(`risk:${entry.riskScore}`);
-            console.log(`  ${colors.red('✗')}  ${time}  ${tool}  ${risk}  ${colors.dim(reason)}`);
+            console.log(`  ${colors.red('✕')}  ${time}  ${tool}  ${risk}  ${colors.dim(reason)}`);
         }
         newline();
     }
@@ -143,7 +165,7 @@ function renderSessionDrillDown(sessionId, entries) {
     for (const entry of toShow) {
         const time = colors.dim(new Date(entry.timestamp).toLocaleTimeString());
         const tool = (entry.blocked ? colors.red : colors.cyan)(entry.toolName.padEnd(12));
-        const icon = entry.blocked ? colors.red('✗') : entry.criticalFindings > 0 ? colors.yellow('!') : colors.green('✓');
+        const icon = entry.blocked ? colors.red('✕') : entry.criticalFindings > 0 ? colors.yellow('!') : colors.green('✓');
         const reason = extractBlockReason(entry);
         console.log(`  ${icon}  ${time}  ${tool}  ${colors.dim(reason)}`);
     }
@@ -152,16 +174,16 @@ function renderSessionDrillDown(sessionId, entries) {
     // (UX_OBSERVATIONS.md P1; long attended sessions shouldn't get accused).
     if (blocked.length > 2 && sorted.length > 20 && blocked.length / sorted.length > 0.05) {
         const pct = ((blocked.length / sorted.length) * 100).toFixed(0);
-        console.log(colors.red(`  ⚠ ${pct}% block rate (${blocked.length}/${sorted.length}) — review for injection patterns.`));
+        console.log(colors.red(`  ! ${pct}% block rate (${blocked.length}/${sorted.length}) · review for injection patterns.`));
     }
     else if (blocked.length > 0 && sorted.length > 20) {
-        console.log(colors.yellow(`  ${blocked.length} blocked / ${sorted.length} total — long session, review if unattended.`));
+        console.log(colors.yellow(`  ${blocked.length} blocked / ${sorted.length} total · long session, review if unattended.`));
     }
     else if (blocked.length > 0) {
-        console.log(colors.yellow(`  ${blocked.length} blocked call${blocked.length !== 1 ? 's' : ''} — review the blocked entries above.`));
+        console.log(colors.yellow(`  ${blocked.length} blocked call${blocked.length !== 1 ? 's' : ''} · review the blocked entries above.`));
     }
     else if (sorted.length > 50) {
-        console.log(colors.yellow(`  ${sorted.length} calls in one session — check for amplification.`));
+        console.log(colors.yellow(`  ${sorted.length} calls in one session · check for amplification.`));
     }
     else {
         console.log(colors.green('  Session looks clean.'));
@@ -403,7 +425,7 @@ function exportAudit(entries, format, sinceHours) {
         console.log('|---|---|---|---:|:---:|---:|');
         for (const e of filtered) {
             const sid = (e.sessionId || '').substring(0, 8);
-            const blocked = e.blocked ? '✗' : '✓';
+            const blocked = e.blocked ? '✕' : '✓';
             console.log(`| \`${e.timestamp}\` | \`${sid}\` | ${e.toolName} | ${e.riskScore} | ${blocked} | ${e.findings} |`);
         }
         return;
@@ -456,11 +478,13 @@ export async function executeStatusCommand(options = {}) {
     const productCtx = loadProductContext(cwd);
     const hookRunning = existsSync(join(homedir(), '.claude', 'settings.json'));
     const hasSkills = existsSync(join(homedir(), '.claude', 'commands', 'codehere'));
+    const daemonRunning = await probeDaemonRunning();
     // ── JSON mode ──────────────────────────────────────────────────────────────
     if (options.json) {
         const result = {
             version,
             status: 'ok',
+            daemon: { running: daemonRunning },
             hooks: {
                 running: hookRunning,
                 stats: { last24h: s24, last7d: s7d, allTime: sAll },
@@ -468,35 +492,6 @@ export async function executeStatusCommand(options = {}) {
             skills: { installed: hasSkills },
             product: productCtx,
         };
-        if (options.tasks) {
-            try {
-                const { getTaskRepository } = await import('../../../infrastructure/storage/task-repository.js');
-                const taskRepo = getTaskRepository();
-                const tasks = await taskRepo.getAll();
-                result.tasks = tasks.slice(0, 20).map((t) => ({
-                    id: t.id,
-                    mode: t.mode,
-                    status: t.status,
-                    riskTier: t.riskTier,
-                    environment: t.environment,
-                    goal: t.goal,
-                    createdAt: t.createdAt,
-                }));
-                result.taskCount = tasks.length;
-            }
-            catch (e) {
-                // rc.25: JSON consumers reading only stdout were still being fed a
-                // lie ([] tasks, 0 count) on real failure (Codex final review:
-                // "degraded behavior being presented as success"). Now we surface a
-                // structured taskLoadError + status:'degraded' so automation can
-                // distinguish "no tasks" from "load failed."
-                console.error('[status --tasks --json] task repository failed to load:', e);
-                result.tasks = [];
-                result.taskCount = 0;
-                result.taskLoadError = e instanceof Error ? e.message : String(e);
-                result.status = 'degraded';
-            }
-        }
         console.log(JSON.stringify(result, null, 2));
         return;
     }
@@ -504,8 +499,9 @@ export async function executeStatusCommand(options = {}) {
     sectionHeader('Codehere Status');
     newline();
     // Version + hooks
-    const hookStatus = hookRunning ? colors.green('✓') + ' Hooks running' : colors.yellow('⚠') + ' Hooks not installed';
-    console.log(`  Version: ${version}  ·  Status: Running  ·  ${hookStatus}`);
+    const hookStatus = hookRunning ? colors.green('✓') + ' Hooks running' : colors.yellow('!') + ' Hooks not installed';
+    const daemonStatus = daemonRunning ? colors.green('●') + ' Daemon running' : colors.dim('○') + ' Daemon stopped';
+    console.log(`  Version: ${version}  ·  ${daemonStatus}  ·  ${hookStatus}`);
     newline();
     // Product brain
     if (productCtx) {
@@ -557,13 +553,13 @@ export async function executeStatusCommand(options = {}) {
                 const tool = colors.cyan(entry.toolName.padEnd(10));
                 const time = colors.dim(timeAgo(entry.timestamp).padEnd(8));
                 const reason = extractBlockReason(entry);
-                console.log(`  ${colors.red('✗')}  ${time}  ${tool}  ${colors.dim(reason)}`);
+                console.log(`  ${colors.red('✕')}  ${time}  ${tool}  ${colors.dim(reason)}`);
             }
             newline();
         }
         // If nothing was ever blocked, celebrate
         if (sAll.blocked === 0) {
-            console.log(`  ${colors.green('✓')} Nothing blocked yet — all scans clean.`);
+            console.log(`  ${colors.green('✓')} Nothing blocked yet · all scans clean.`);
             newline();
         }
     }
@@ -609,49 +605,6 @@ export async function executeStatusCommand(options = {}) {
     }
     // Removed: Cost router jargon — not meaningful to users
     // Tasks table (--tasks flag)
-    if (options.tasks) {
-        newline();
-        console.log(colors.bold('Recent tasks (experimental)'));
-        console.log(colors.dim('Task storage: .codehere/tasks.jsonl'));
-        newline();
-        try {
-            const { getTaskRepository } = await import('../../../infrastructure/storage/task-repository.js');
-            const taskRepo = getTaskRepository();
-            const tasks = await taskRepo.getAll();
-            if (tasks.length === 0) {
-                console.log(colors.dim('No tasks found. Run "codehere start" to open the task intake, or "codehere task <prompt>" from the CLI.'));
-            }
-            else {
-                const pad = (s, n) => (s.length >= n ? s.substring(0, n) : s + ' '.repeat(n - s.length));
-                const trunc = (s, n) => (s.length <= n ? s : s.substring(0, n - 1) + '…');
-                console.log(colors.dim([pad('ID', 10), pad('Mode', 8), pad('Status', 12), pad('Risk', 4), pad('Env', 6), 'Goal'].join('  ')));
-                console.log(colors.dim(['-'.repeat(10), '-'.repeat(8), '-'.repeat(12), '-'.repeat(4), '-'.repeat(6), '-'.repeat(30)].join('  ')));
-                tasks.slice(0, 10).forEach((task) => {
-                    console.log([
-                        pad(task.id.substring(0, 8) + '..', 10),
-                        pad(task.mode, 8),
-                        pad(task.status, 12),
-                        pad(task.riskTier.toUpperCase(), 4),
-                        pad(task.environment.substring(0, 6), 6),
-                        trunc(task.goal, 30),
-                    ].join('  '));
-                });
-                if (tasks.length > 10) {
-                    newline();
-                    console.log(colors.dim(`... and ${tasks.length - 10} more tasks`));
-                }
-            }
-        }
-        catch (e) {
-            // rc.25: don't print "No tasks found" — that's a lie when load failed
-            // (Codex final review: "degraded behavior presented as success"). Show
-            // a clear error line; stderr already has the cause for the operator.
-            console.error('[status] task repository failed to load:', e);
-            const msg = e instanceof Error ? e.message : String(e);
-            console.log(colors.red(`  ✗ Could not load task repository: ${msg}`));
-            console.log(colors.dim('  See logs above for details. Try `codehere start` to (re)init the task intake.'));
-        }
-    }
     // Quick trust scan (opt-in)
     if (options.trust) {
         const { executeTrustCommand } = await import('./trust-command.js');

package/dist/presentation/cli/commands/team-command.js

@@ -0,0 +1,256 @@
+/**
+ * `codehere team`, the CLI face of the local-first team cost+audit ledger.
+ *
+ * The data layer (config, snapshots, merge, git sync) lives in
+ * infrastructure/cost/team-ledger.ts so the CLI and the daemon (`GET /api/team`)
+ * read the same core. This file is just the terminal rendering + subcommands.
+ *
+ * Subcommands:
+ *   (none) / sync      write this machine's snapshot, sync the team repo, show merged view
+ *   init [path]        create a team: make + git-init a shared folder and point at it
+ *   join <git-url>     join a team: clone the shared repo and point at it
+ *   set-dir <path>     point at an existing shared team directory
+ *   budget <usd>       set the team's shared daily ceiling (off = clear)
+ */
+import { existsSync, mkdirSync } from 'fs';
+import { execFileSync } from 'child_process';
+import { join as pathJoin, basename } from 'path';
+import { loadTeamConfig, saveTeamConfig, codehereHome, initTeamDir, isGitRepo, gitPull, gitShareMine, writeMyShare, buildTeamView, } from '../../../infrastructure/cost/team-ledger.js';
+import { success, error, info, heading, newline } from '../../../ui.js';
+function fmtUsd(n) {
+    return n >= 0.01 || n === 0 ? `$${n.toFixed(2)}` : `$${n.toFixed(3)}`;
+}
+export async function executeTeamCommand(subcommand, value, opts) {
+    const sub = subcommand ?? 'sync';
+    switch (sub) {
+        case 'sync':
+        case 'show':
+            return syncAndShow(Boolean(opts?.strict));
+        case 'init':
+            return initTeam(value);
+        case 'join':
+            if (!value) {
+                console.error(error('Usage:'), 'codehere team join <git-url>');
+                process.exit(1);
+            }
+            return joinTeam(value);
+        case 'set-dir':
+            if (!value) {
+                console.error(error('Usage:'), 'codehere team set-dir <path-to-shared-dir>');
+                process.exit(1);
+            }
+            return setDir(value);
+        case 'budget':
+            if (!value) {
+                console.error(error('Usage:'), 'codehere team budget <usd>   (or `off`)');
+                process.exit(1);
+            }
+            return setBudget(value);
+        default:
+            console.error(error('Unknown subcommand:'), sub);
+            console.error(info('Try:'), 'codehere team [sync | init [path] | join <git-url> | set-dir <path> | budget <usd>]');
+            process.exit(1);
+    }
+}
+function setDir(path) {
+    const cfg = loadTeamConfig();
+    cfg.dir = path;
+    saveTeamConfig(cfg);
+    console.log(success('Team directory set:'), path);
+    console.log(info('Next:'), 'run `codehere team` on each machine. Keep that folder in your own git/shared drive.');
+}
+// Create a team: make + git-init a shared folder, point at it, write the first
+// snapshot — so a lead sets up a team in one command, no hand-editing config.
+function initTeam(dir) {
+    const target = dir || pathJoin(codehereHome(), 'team-shared');
+    try {
+        initTeamDir(target); // shared core: mkdir + git-init + README (also used by POST /api/team/init)
+    }
+    catch {
+        console.error(error('Could not create team dir:'), target, '— check the path and permissions.');
+        process.exit(1);
+    }
+    const cfg = loadTeamConfig();
+    cfg.dir = target;
+    saveTeamConfig(cfg);
+    try {
+        writeMyShare(target);
+    }
+    catch {
+        /* best-effort first snapshot */
+    }
+    console.log(success('Team created:'), target);
+    console.log(info('Share it:'), 'push this folder to a git repo, then each teammate runs `codehere team join <git-url>`.');
+}
+// Join a team: clone the shared repo under ~/.codehere/teams/<name>, point at it,
+// write this machine's first snapshot.
+function joinTeam(url) {
+    // A join URL is shared/pasted, so it's a real attack surface. git's ext::/fd::
+    // (and file::) transports execute arbitrary commands, and a leading-dash URL is
+    // parsed as a git option (argument injection). Allow only real remote schemes.
+    if (/^-/.test(url) || /^(ext|fd|file)::/i.test(url) || !/^(https?:\/\/|git:\/\/|ssh:\/\/|git@[^/]+:)/.test(url)) {
+        console.error(error('Unsupported git URL:'), url);
+        console.error(info('Use:'), 'https:// , git:// , ssh:// , or git@host:owner/repo');
+        process.exit(1);
+    }
+    const name = basename(url.replace(/\.git$/, '')) || 'team-shared';
+    const target = pathJoin(codehereHome(), 'teams', name);
+    if (existsSync(target)) {
+        console.error(error('Already exists:'), target);
+        console.error(info('Point at it instead:'), `codehere team set-dir ${target}`);
+        process.exit(1);
+    }
+    try {
+        mkdirSync(pathJoin(codehereHome(), 'teams'), { recursive: true });
+        // Belt-and-suspenders: disable the command-executing transports at the git
+        // level too, and `--` so the URL can never be read as an option.
+        execFileSync('git', ['-c', 'protocol.ext.allow=never', '-c', 'protocol.allow=user', 'clone', '-q', '--', url, target], { stdio: 'inherit' });
+    }
+    catch {
+        console.error(error('Clone failed:'), url, '— check the URL and your access.');
+        process.exit(1);
+    }
+    if (!existsSync(pathJoin(target, 'spend')))
+        mkdirSync(pathJoin(target, 'spend'), { recursive: true });
+    const cfg = loadTeamConfig();
+    cfg.dir = target;
+    saveTeamConfig(cfg);
+    try {
+        writeMyShare(target);
+    }
+    catch {
+        /* best-effort */
+    }
+    console.log(success('Joined team:'), target);
+    console.log(info('Next:'), 'run `codehere team` to sync and see the merged view.');
+}
+function setBudget(value) {
+    const cfg = loadTeamConfig();
+    if (value.toLowerCase() === 'off') {
+        cfg.dailyUsd = null;
+        saveTeamConfig(cfg);
+        console.log(success('Team daily budget cleared.'));
+        return;
+    }
+    const num = Number(value.replace(/^\$/, ''));
+    if (!Number.isFinite(num) || num <= 0) {
+        console.error(error('Invalid amount:'), value, '(use a positive number, e.g. `codehere team budget 50`)');
+        process.exit(1);
+    }
+    cfg.dailyUsd = num;
+    saveTeamConfig(cfg);
+    console.log(success('Team daily budget set:'), fmtUsd(num));
+}
+function syncAndShow(strict = false) {
+    const cfg = loadTeamConfig();
+    if (!cfg.dir) {
+        console.error(error('No team directory set.'));
+        console.error(info('Set one (a folder your team controls, e.g. a shared git repo):'));
+        console.error('   codehere team set-dir /path/to/team-shared-dir');
+        process.exit(1);
+    }
+    if (!existsSync(cfg.dir)) {
+        console.error(error('Team directory does not exist:'), cfg.dir);
+        console.error(info('Create it (or clone the team repo) first, then re-run.'));
+        process.exit(1);
+    }
+    const gitMode = isGitRepo(cfg.dir);
+    const pulled = gitMode ? gitPull(cfg.dir) : false;
+    const mine = writeMyShare(cfg.dir);
+    const pushed = gitMode ? gitShareMine(cfg.dir, `spend/${mine.machineId}.json`) : null;
+    const view = buildTeamView(cfg.dir, cfg.dailyUsd);
+    newline();
+    console.log(heading(`Team spend today (${view.date}), estimate, not a provider invoice`));
+    console.log('  ' + '─'.repeat(48));
+    for (const m of view.machines) {
+        const me = m.machineId === view.myMachineId ? '  (this machine)' : '';
+        console.log(`  ${m.machineId.padEnd(28)} ${fmtUsd(m.totalUsd).padStart(9)}${me}`);
+    }
+    const agents = Object.entries(view.perAgent).sort((a, b) => b[1] - a[1]);
+    if (agents.length) {
+        console.log('  ' + '─'.repeat(48));
+        console.log(info('  by agent (cost · what each did)'));
+        for (const [agent, usd] of agents) {
+            const sess = view.perAgentSessions[agent] ?? 0;
+            console.log(`  ${agent.padEnd(20)} ${fmtUsd(usd).padStart(9)}   ${String(sess).padStart(3)} session${sess === 1 ? '' : 's'}`);
+        }
+    }
+    const projects = Object.entries(view.perProject).sort((a, b) => b[1] - a[1]);
+    if (projects.length) {
+        console.log('  ' + '─'.repeat(48));
+        console.log(info('  by project'));
+        for (const [proj, usd] of projects)
+            console.log(`  ${proj.padEnd(28)} ${fmtUsd(usd).padStart(9)}`);
+    }
+    // Practice runs sit OUTSIDE the totals (their cost is the mock's own
+    // fabrication, never billed) — one quiet line, only when any exist.
+    if (view.practice && view.practice.sessions > 0) {
+        console.log('  ' + '─'.repeat(48));
+        console.log(info(`  practice runs · ${view.practice.sessions} session${view.practice.sessions === 1 ? '' : 's'} · ${fmtUsd(view.practice.usd)} fabricated · not in the totals`));
+    }
+    console.log('  ' + '─'.repeat(48));
+    const totalLine = `  ${'TEAM TOTAL'.padEnd(28)} ${fmtUsd(view.teamTotal).padStart(9)}`;
+    if (view.dailyUsd !== null) {
+        const pct = Math.min(100, Math.round((view.teamTotal / view.dailyUsd) * 100));
+        console.log(totalLine + `   of ${fmtUsd(view.dailyUsd)} (${pct}%)`);
+        if (view.teamTotal >= view.dailyUsd)
+            console.log(error('  Over the team daily budget.'));
+        else if (pct >= 80)
+            console.log(info('  Approaching the team daily budget.'));
+    }
+    else {
+        console.log(totalLine);
+        console.log(info('  No team budget set, `codehere team budget <usd>` to add one.'));
+    }
+    if (view.totalActions > 0) {
+        newline();
+        console.log(heading('What the agents did (recorded, integrity-checked)'));
+        console.log('  ' + '─'.repeat(48));
+        for (const m of view.machines.filter((x) => x.audit).sort((a, b) => b.audit.actions - a.audit.actions)) {
+            const status = m.audit.chainOk ? success('chain ok') : error('chain BROKEN');
+            console.log(`  ${m.machineId.padEnd(28)} ${String(m.audit.actions).padStart(6)} actions  ${status}`);
+        }
+        console.log('  ' + '─'.repeat(48));
+        console.log(`  ${'TEAM ACTIONS'.padEnd(28)} ${String(view.totalActions).padStart(6)}`);
+        if (view.brokenChains.length)
+            console.log(error(`  Integrity broken on: ${view.brokenChains.join(', ')}. Investigate before trusting that record.`));
+    }
+    if (view.tamperedShares.length || view.unsignedShares.length) {
+        newline();
+        if (view.tamperedShares.length)
+            console.log(error(`  ✗ Signature/key mismatch on: ${view.tamperedShares.join(', ')} — altered, or re-signed with a different key than first seen. Don't trust that share.`));
+        if (view.unsignedShares.length)
+            console.log(info(`  Unsigned, can't verify: ${view.unsignedShares.join(', ')}.`));
+    }
+    else if (view.machines.length) {
+        newline();
+        console.log(success('  ✓ All shares signed; keys match the ones first seen (TOFU) — no post-write change detected.'));
+    }
+    newline();
+    if (gitMode) {
+        const pushMsg = pushed === 'pushed'
+            ? 'pushed yours'
+            : pushed === 'committed-local'
+                ? 'committed yours locally (no remote or offline)'
+                : pushed === 'nochange'
+                    ? 'yours unchanged'
+                    : 'could not push yours';
+        console.log(info('Synced:'), `git ${pulled ? 'pulled teammates' : 'pull skipped'}, ${pushMsg}. ${view.machines.length} machine(s) merged, all in your team's own repo, nothing sent to codehere.`);
+    }
+    else {
+        console.log(info('Local-first:'), `${view.machines.length} machine(s) merged from ${cfg.dir}, codehere sent nothing to a server.`);
+        console.log(info('Tip:'), 'make the team dir a git repo with a remote and codehere will pull/push it for you.');
+    }
+    // --strict: refuse to exit clean if the record can't be trusted. A tampered
+    // signature or a broken audit chain means the team total above is not a
+    // trustworthy record — fail closed so CI / a lead's gate catches it.
+    if (strict) {
+        const bad = [...view.tamperedShares, ...view.brokenChains];
+        if (bad.length) {
+            newline();
+            console.error(error('--strict: record integrity failed.'), `Untrustworthy: ${[...new Set(bad)].join(', ')}.`);
+            process.exit(1);
+        }
+    }
+}
+//# sourceMappingURL=team-command.js.map