codehere 0.8.0 → 1.0.1

package/dist/infrastructure/orchestration/gemini-adapter.js

@@ -34,11 +34,11 @@ import { promisify } from 'util';
 const execFileAsync = promisify(execFile);
 import { EventEmitter } from 'events';
 import { randomUUID } from 'crypto';
-import { existsSync } from 'fs';
+import { existsSync, readFileSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
 import { ProgressAggregator } from './progress-aggregator.js';
-import { resolveAgentSpawn } from './mocks/resolve-agent-spawn.js';
+import { resolveAgentSpawn, isMockMode } from './mocks/resolve-agent-spawn.js';
 import { applyMemoryPrefix } from './memory-injector.js';
 import { mirrorToolCallToAudit } from '../hooks/mirror-tool-call-to-audit.js';
 import { snapshotCwd, extractArtifacts } from './artifacts-extractor.js';
@@ -78,8 +78,26 @@ const ERROR_PATTERNS = [
         message: 'Google AI Studio / Vertex quota exhausted.',
         recovery: 'Check quota at https://aistudio.google.com/ or top up your Google Cloud billing account.',
     },
+    {
+        // BUG-7 · the CLI refuses headless runs in untrusted folders. codehere sets
+        // GEMINI_CLI_TRUST_WORKSPACE=true at spawn (same rationale as yolo/sandbox:
+        // codehere's own hook is the gate), so this fires only if that stops working.
+        code: 'workspace_untrusted',
+        regex: /not running in a trusted directory|trusted.folders|GEMINI_CLI_TRUST_WORKSPACE/i,
+        message: 'Gemini refused to run in this folder (workspace not trusted).',
+        recovery: 'Run the task from a folder gemini trusts, or trust it once interactively: open `gemini` in that folder and accept the trust prompt.',
+    },
+    {
+        // Observed live 2026-07-18: Google discontinued the free "Code Assist for
+        // individuals" tier for this CLI. Without this pattern the user sees a
+        // generic "network hiccup" guess for a permanent, actionable condition.
+        code: 'tier_discontinued',
+        regex: /IneligibleTierError|no longer supported for Gemini Code Assist/i,
+        message: "Google discontinued this Gemini CLI's free tier.",
+        recovery: 'Set GEMINI_API_KEY (free key at https://aistudio.google.com/apikey) or migrate per https://antigravity.google — then rerun.',
+    },
 ];
-function scanForKnownError(text) {
+export function scanForKnownError(text) {
     for (const p of ERROR_PATTERNS) {
         if (p.regex.test(text))
             return { code: p.code, message: p.message, recovery: p.recovery };
@@ -138,6 +156,7 @@ export function spawnGemini(prompt, options = {}) {
     let artifactsSnapshot;
     let textAccum = '';
     let usageSnapshot;
+    let geminiModel; // real model from the init event → per-model cost
     let errorEmitted = false;
     const emit = (event) => {
         buffer.push(event);
@@ -202,6 +221,7 @@ export function spawnGemini(prompt, options = {}) {
                     inputTokens: Number(s.input_tokens ?? 0),
                     outputTokens: Number(s.output_tokens ?? 0),
                     ...(s.cached ? { cacheReadTokens: Number(s.cached) } : {}),
+                    ...(geminiModel ? { model: geminiModel } : {}),
                 };
             }
         }
@@ -245,6 +265,10 @@ export function spawnGemini(prompt, options = {}) {
     const spawnEnv = {
         ...process.env,
         GEMINI_SANDBOX: 'false',
+        // BUG-7 · the CLI's trusted-folder prompt blocks headless spawns (observed
+        // live: task died as "error" with a misattributed cause). Same rationale as
+        // yolo + sandbox above: codehere's safety hook is the external gate.
+        GEMINI_CLI_TRUST_WORKSPACE: 'true',
         ...(options.env ?? {}),
     };
     let child;
@@ -312,6 +336,9 @@ export function spawnGemini(prompt, options = {}) {
                 const data = JSON.parse(line);
                 if (data.type === 'init' && typeof data.session_id === 'string') {
                     geminiSessionUuid = data.session_id;
+                    const im = data.model;
+                    if (typeof im === 'string' && im)
+                        geminiModel = im; // per-model cost
                 }
                 emit({ type: data.type ?? 'gemini_event', timestamp: Date.now(), data });
             }
@@ -455,6 +482,10 @@ export function spawnGemini(prompt, options = {}) {
                     // 15s = 5s upstream LLM cap + parse/flush/spawn overhead + slack.
                     // Override via CODEHERE_GEMINI_LIST_TIMEOUT_MS for slow boxes.
                     const timeoutMs = Number(process.env.CODEHERE_GEMINI_LIST_TIMEOUT_MS) || 15000;
+                    // S9 · never execute the real binary under mock — the resume-index
+                    // refinement is meaningless against the mock REPL anyway.
+                    if (isMockMode())
+                        throw new Error('mock mode: skip real --list-sessions');
                     const { stdout: listOut } = await execFileAsync('gemini', ['--list-sessions'], {
                         cwd,
                         env: spawnEnv,
@@ -472,7 +503,11 @@ export function spawnGemini(prompt, options = {}) {
             return new Promise((resolve, reject) => {
                 let stdout = '';
                 let stderr = '';
-                const followup = spawn('gemini', ['-p', text, '--resume', resumeArg, ...HEADLESS_FLAGS], {
+                // S9 · route follow-ups through the mock seam too — under
+                // CODEHERE_MOCK=1 this hits the mock REPL, not real gemini.
+                // (Was a real-spend leak on reply; mirrors the codex fix.)
+                const sp2 = resolveAgentSpawn('gemini', 'gemini', ['-p', text, '--resume', resumeArg, ...HEADLESS_FLAGS], text);
+                const followup = spawn(sp2.command, sp2.args, {
                     cwd,
                     env: spawnEnv,
                     stdio: ['ignore', 'pipe', 'pipe'],
@@ -516,7 +551,7 @@ export function spawnGemini(prompt, options = {}) {
 export const GeminiAdapter = {
     id: 'gemini',
     label: 'Gemini',
-    description: "Google's coding agent. Has a free tier and can read very large amounts of code or docs at once. Useful when the paid agents are out of credits.",
+    description: "Google's coding agent. Free with an AI Studio API key, and can read very large amounts of code or docs at once. Useful when the paid agents are out of credits.",
     // Match `gemini`, `node /path/.../gemini`, and `./gemini` invocations.
     processPattern: /(?:^|\/)gemini(?:\s|$)|node\s+\S*gemini/,
     isInstalled() {
@@ -557,14 +592,59 @@ export const GeminiAdapter = {
         // the task errored with no clear next step. Surfaced May 1 2026 by the
         // multi-agent dogfood test (see SECURITY_AUDIT_2026-05-01.md spirit —
         // honest readiness signals are a UX security property).
-        const hasEnvAuth = !!process.env.GEMINI_API_KEY ||
-            !!process.env.GOOGLE_API_KEY ||
-            !!process.env.GOOGLE_GENAI_USE_VERTEXAI ||
-            !!process.env.GOOGLE_GENAI_USE_GCA ||
-            !!process.env.GOOGLE_APPLICATION_CREDENTIALS;
-        const hasFileAuth = existsSync(join(homedir(), '.gemini', 'settings.json')) ||
-            existsSync(join(homedir(), '.gemini', 'oauth_creds.json'));
+        // Validate the VALUE, not just presence. `!!process.env.X` is true even when
+        // a var is set to "" / "false" / "0" — which is exactly how readiness lied
+        // "ready" for a gemini that cannot auth. A key must look like a key; the
+        // USE_VERTEXAI / USE_GCA flags must be truthy strings; a credentials path
+        // must point to a file that exists.
+        const isKey = (v) => typeof v === 'string' && v.trim().length >= 8;
+        const isTrue = (v) => v === '1' || (typeof v === 'string' && v.trim().toLowerCase() === 'true');
+        const isCredFile = (v) => typeof v === 'string' && v.trim().length > 0 && existsSync(v.trim());
+        const hasEnvAuth = isKey(process.env.GEMINI_API_KEY) ||
+            isKey(process.env.GOOGLE_API_KEY) ||
+            isTrue(process.env.GOOGLE_GENAI_USE_VERTEXAI) ||
+            isTrue(process.env.GOOGLE_GENAI_USE_GCA) ||
+            isCredFile(process.env.GOOGLE_APPLICATION_CREDENTIALS);
+        // A settings.json that EXISTS but has no configured auth method is not auth —
+        // gemini's own error ("set an Auth method in settings.json") proves it. Require
+        // a non-empty selectedAuthType (top-level or under security.auth). oauth_creds
+        // existing IS real cached auth.
+        const settingsAuthType = () => {
+            try {
+                const p = join(homedir(), '.gemini', 'settings.json');
+                if (!existsSync(p))
+                    return '';
+                const s = JSON.parse(readFileSync(p, 'utf8'));
+                const t = s.selectedAuthType ?? s.security?.auth?.selectedType;
+                return typeof t === 'string' ? t.trim() : '';
+            }
+            catch {
+                return '';
+            }
+        };
+        // 2026-07: Google retired the individual OAuth tier ("Gemini Code Assist for
+        // individuals" moved into Antigravity). A cached personal login now gets a
+        // server-side IneligibleTierError — observed live on this exact config
+        // (selectedType oauth-personal + oauth_creds.json present, latest CLI 0.49.0).
+        // So oauth-personal, with or without cached creds, is NOT auth anymore.
+        // Other selected types (Vertex, enterprise) keep working and stay accepted.
+        const authType = settingsAuthType();
+        const personalOauthDead = authType === 'oauth-personal' || (!authType && existsSync(join(homedir(), '.gemini', 'oauth_creds.json')));
+        const hasFileAuth = !!authType && authType !== 'oauth-personal';
         if (!hasEnvAuth && !hasFileAuth) {
+            if (personalOauthDead) {
+                return {
+                    id: this.id,
+                    label: this.label,
+                    state: 'needs_auth',
+                    installed: true,
+                    authHint: {
+                        command: 'export GEMINI_API_KEY=...  # free key: https://aistudio.google.com/apikey',
+                        url: 'https://aistudio.google.com/apikey',
+                        detail: 'Your Google login uses the retired individual OAuth tier (Google moved it into Antigravity, July 2026), so the server now refuses it. Set GEMINI_API_KEY with a free key from https://aistudio.google.com/apikey to restore gemini.',
+                    },
+                };
+            }
             return {
                 id: this.id,
                 label: this.label,

package/dist/infrastructure/orchestration/generic-cli-adapter.js

@@ -36,8 +36,10 @@ import { homedir } from 'os';
 import { join } from 'path';
 import { randomUUID } from 'crypto';
 import { ProgressAggregator } from './progress-aggregator.js';
+import { resolveAgentSpawn } from './mocks/resolve-agent-spawn.js';
 import { snapshotCwd, extractArtifacts } from './artifacts-extractor.js';
 import { applyMemoryPrefix } from './memory-injector.js';
+import { mirrorToolCallToAudit } from '../hooks/mirror-tool-call-to-audit.js';
 const CONFIG_PATH = join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'agents.yaml');
 const CONFIG_PATH_JSON = join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'agents.json');
 /** Minimal YAML parser for the narrow shape above. Intentionally NOT a full YAML
@@ -127,6 +129,74 @@ export function loadAgentsConfig() {
     }
     return [];
 }
+// Minimal generic failover fingerprints. Config-driven CLIs have no
+// per-provider error bank (we don't know the vendor), so detect only the two
+// signals every provider phrases recognizably: rate-limit and auth. Emits the
+// same `codehere:error` { code, message, recovery } shape the built-in adapters
+// emit — the session-manager's failover classifier consumes that shape and
+// treats 'rate_limit' as failover-eligible ('auth_invalid' is surfaced only).
+const ERROR_PATTERNS = [
+    {
+        code: 'rate_limit',
+        regex: /rate.?limit|429|quota/i,
+        message: 'The agent was rate-limited by its provider.',
+        recovery: 'Wait a minute and retry, or switch the task to a different agent.',
+    },
+    {
+        code: 'auth_invalid',
+        regex: /auth|401|403|api.?key|login/i,
+        message: "The agent's auth was rejected or missing.",
+        recovery: 'Check the API key / login for this CLI, re-authenticate, and retry.',
+    },
+];
+/** @internal — exported for tests; not part of the public API. */
+export function scanForKnownError(text) {
+    for (const p of ERROR_PATTERNS) {
+        if (p.regex.test(text))
+            return { code: p.code, message: p.message, recovery: p.recovery };
+    }
+    return null;
+}
+/**
+ * Normalize a Claude-Code-style stream-json event (cursor-agent et al.) into the
+ * flat event shapes the spawn handler already understands. Returns null for
+ * events that need no translation (the caller emits them verbatim).
+ *
+ * - `{ type:'tool_call', subtype:'started', tool_call:{ <kind>ToolCall:{ args } } }`
+ *   → `{ type:'tool_use', data:{ name:<kind>, input:args } }` so the existing
+ *   mirror lands the call in the audit chain (only 'started', so a call is
+ *   counted once, not twice with 'completed').
+ * - `{ type:'assistant', message:{ content:[{type:'text',text}] } }`
+ *   → `{ type:'stdout', data:{ line:<text> } }` so the agent's findings feed
+ *   textAccum + the Final Report (else a read-only review records no findings).
+ *
+ * @internal — exported for tests; not part of the public API.
+ */
+export function normalizeStreamJson(data) {
+    if (data.type === 'tool_call' && data.subtype === 'started' && data.tool_call) {
+        const tc = data.tool_call;
+        const kind = Object.keys(tc).find((k) => k.endsWith('ToolCall'));
+        if (kind) {
+            const call = tc[kind];
+            return {
+                type: 'tool_use',
+                timestamp: Date.now(),
+                data: { name: kind.replace(/ToolCall$/, ''), input: call?.args ?? {} },
+            };
+        }
+    }
+    if (data.type === 'assistant') {
+        const content = data.message?.content ?? [];
+        const text = content
+            .filter((c) => c.type === 'text' && typeof c.text === 'string')
+            .map((c) => c.text)
+            .join('\n')
+            .trim();
+        if (text)
+            return { type: 'stdout', timestamp: Date.now(), data: { line: text } };
+    }
+    return null;
+}
 function spawnGeneric(cfg, prompt, options = {}) {
     const sessionId = randomUUID();
     const startedAt = Date.now();
@@ -146,6 +216,12 @@ function spawnGeneric(cfg, prompt, options = {}) {
     let stepsSnapshot = [];
     let artifactsSnapshot;
     let textAccum = '';
+    // Bounded recent-stdout tail for error scanning (same posture as aider):
+    // scanning the whole accumulated buffer lets distant benign prose combine
+    // into false matches; a single line misses wrapped error bodies.
+    let scanTail = '';
+    const SCAN_TAIL_CHARS = 600;
+    let errorEmitted = false;
     const emit = (event) => {
         buffer.push(event);
         emitter.emit('event', event);
@@ -158,6 +234,45 @@ function spawnGeneric(cfg, prompt, options = {}) {
         if (event.type === 'stdout' && event.data?.line) {
             textAccum += String(event.data.line) + '\n';
         }
+        // Audit-trail parity: generic CLIs that stream jsonl tool_use events
+        // (gemini-style { tool_name, parameters } or claude-style { name, input })
+        // get the same post-hoc mirror the built-in adapters fire — their tool
+        // calls land in the hash-chained audit instead of vanishing.
+        if (event.type === 'tool_use') {
+            const data = event.data;
+            const toolName = String(data?.tool_name ?? data?.name ?? 'tool');
+            const params = data?.parameters ?? data?.input ?? {};
+            const input = (typeof params.command === 'string' && params.command) ||
+                (typeof params.file_path === 'string' && params.file_path) ||
+                (typeof params.path === 'string' && params.path) ||
+                (typeof params.query === 'string' && params.query) ||
+                JSON.stringify(params).slice(0, 500);
+            mirrorToolCallToAudit({ sessionId, agent: cfg.id, toolName, toolInput: String(input), cwd });
+        }
+        if (!errorEmitted) {
+            const data = event.data;
+            let text = '';
+            if (event.type === 'stderr' && typeof data?.line === 'string') {
+                text = data.line;
+            }
+            else if (event.type === 'stdout' && typeof data?.line === 'string') {
+                scanTail = (scanTail + '\n' + data.line).slice(-SCAN_TAIL_CHARS);
+                text = scanTail;
+            }
+            if (text) {
+                const hit = scanForKnownError(text);
+                if (hit) {
+                    errorEmitted = true;
+                    const errEvent = {
+                        type: 'codehere:error',
+                        timestamp: Date.now(),
+                        data: { code: hit.code, message: hit.message, recovery: hit.recovery },
+                    };
+                    buffer.push(errEvent);
+                    emitter.emit('event', errEvent);
+                }
+            }
+        }
     };
     const spawnEnv = { ...process.env, ...(cfg.env ?? {}), ...(options.env ?? {}) };
     const usesStdin = cfg.prompt_via === 'stdin';
@@ -172,8 +287,13 @@ function spawnGeneric(cfg, prompt, options = {}) {
         // The `cfg.command` path is from a user-edited YAML and is therefore
         // user-controlled; the user choosing what binary to launch on their own
         // machine is documented + accepted in CODEHERE.md threat-model section.
+        //
+        // Routed through the mock seam like every built-in adapter — under
+        // CODEHERE_MOCK=1 spawning the configured binary directly would execute
+        // the real CLI (the real-spend leak class).
+        const sp = resolveAgentSpawn(cfg.id, cfg.command, [...argv, ...(options.extraArgs ?? [])], finalPrompt);
         // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        child = spawn(cfg.command, [...argv, ...(options.extraArgs ?? [])], {
+        child = spawn(sp.command, sp.args, {
             cwd,
             env: spawnEnv,
             stdio: [usesStdin ? 'pipe' : 'ignore', 'pipe', 'pipe'],
@@ -224,6 +344,17 @@ function spawnGeneric(cfg, prompt, options = {}) {
             if (cfg.format === 'jsonl') {
                 try {
                     const data = JSON.parse(line);
+                    // Claude-Code-style stream-json (cursor-agent, etc.) nests tool calls
+                    // and findings differently from the flat { tool_use } shape. Normalize
+                    // them into the events the handlers already understand, so a CLI agent's
+                    // reads land in the audit chain (attribution) and its findings feed the
+                    // Final Report — without that, a cross-vendor review reads "couldn't
+                    // attribute" and never earns the seal.
+                    const norm = normalizeStreamJson(data);
+                    if (norm) {
+                        emit(norm);
+                        continue;
+                    }
                     emit({ type: data.type ?? `${cfg.id}_event`, timestamp: Date.now(), data });
                     continue;
                 }

package/dist/infrastructure/orchestration/graphify-context.js

@@ -57,7 +57,19 @@ export function buildGraphSync(cwd, { incremental = true } = {}) {
         args.push('--update');
     }
     try {
-        execFileSync('npx', ['graphify-ts', ...args], {
+        // SECURITY (2026-08-08) · `--no-install` is load-bearing, do not drop it.
+        // This shelled out to bare `npx graphify-ts`. The dependency is the SCOPED
+        // @mohammednagy/graphify-ts, but npx resolves the BIN NAME and falls back to the
+        // public registry when it is not installed locally — and an unrelated
+        // `graphify-ts` (v0.2.0, publisher "howell5") exists on npm. Reproduced: with the
+        // scoped package absent, npx downloaded that stranger's package into
+        // ~/.npm/_npx and tried to run it, in the user's repo cwd, with stdio ignored so
+        // nothing surfaced, and the catch below swallowed the failure as "degrade
+        // gracefully". It only failed to EXECUTE because that package's bin is named
+        // `graphify`, which is luck rather than safety. `--no-install` makes npx use a
+        // locally-installed bin or fail — never fetch. Dependency confusion is not a
+        // thing a product that sells provenance gets to ship.
+        execFileSync('npx', ['--no-install', 'graphify-ts', ...args], {
             cwd,
             stdio: 'ignore',
             timeout: 120_000,
@@ -86,7 +98,7 @@ export function compileContextPackSync(prompt, cwd, { task = 'explain', budget =
         return null;
     }
     try {
-        const output = execFileSync('npx', ['graphify-ts', 'pack', prompt, '--graph', graphPath, '--task', task, '--budget', String(budget)], {
+        const output = execFileSync('npx', ['--no-install', 'graphify-ts', 'pack', prompt, '--graph', graphPath, '--task', task, '--budget', String(budget)], {
             cwd,
             encoding: 'utf-8',
             maxBuffer: 512 * 1024,
@@ -149,34 +161,6 @@ export function persistContextPack(pack, cwd) {
     writeFileSync(packsFile, JSON.stringify(entry) + '\n', { flag: 'a' });
     return packsFile;
 }
-/**
- * Load the most recent context pack from disk (for P2 handoff).
- */
-export function loadRecentContextPack(cwd) {
-    const packsFile = join(cwd, CONTEXT_PACKS_DIR, CONTEXT_PACKS_FILE);
-    if (!existsSync(packsFile)) {
-        return null;
-    }
-    try {
-        const lines = readFileSync(packsFile, 'utf-8').split('\n').filter(Boolean);
-        if (lines.length === 0)
-            return null;
-        const lastEntry = JSON.parse(lines[lines.length - 1]);
-        return {
-            packId: lastEntry.packId,
-            graphPath: lastEntry.graphPath,
-            payload: '', // payload is truncated in disk storage
-            budget: 3000,
-            task: lastEntry.task,
-            nodeCount: lastEntry.nodeCount,
-            edgeCount: lastEntry.edgeCount,
-            elapsedMs: 0,
-        };
-    }
-    catch {
-        return null;
-    }
-}
 // ── Prompt enrichment (sync) ───────────────────────────────────────────────────
 /**
  * Prepend a context pack to a prompt if graphify-ts is available.
@@ -222,33 +206,4 @@ export function enrichPromptWithPackSync(prompt, cwd, { force = false } = {}) {
         prompt,
     ].join('\n\n');
 }
-// ── Graph querying (sync) ──────────────────────────────────────────────────────
-/**
- * Query the knowledge graph for a question.
- * Useful for PM-brain routing and structured context handoff (P2).
- */
-export function queryGraphSync(question, cwd, { maxTokens = 2000 } = {}) {
-    const startTime = Date.now();
-    const graphPath = getGraphPath(cwd);
-    if (!existsSync(graphPath)) {
-        return null;
-    }
-    try {
-        const output = execFileSync('npx', ['graphify-ts', 'query', question, '--graph', graphPath, '--budget', String(maxTokens)], {
-            cwd,
-            encoding: 'utf-8',
-            maxBuffer: 256 * 1024,
-            timeout: 15_000,
-        });
-        return {
-            question,
-            answer: output.trim(),
-            elapsedMs: Date.now() - startTime,
-            graphPath,
-        };
-    }
-    catch {
-        return null;
-    }
-}
 //# sourceMappingURL=graphify-context.js.map