codehere 0.8.0 → 1.0.1

package/dist/infrastructure/security/fix-code.js

@@ -0,0 +1,144 @@
+/**
+ * AI fix + prove-closed for a CODE danger (not a leaked secret) — browser-auth, injection, unsafe HTML.
+ * Spawns claude-code (subscription, async so it never blocks the daemon) to fix the specific issue,
+ * then RE-SCANS to prove that exact danger no longer fires. Honest if it can't. Uses model spend.
+ * The verify-loop (validated 0% false-positive) applied to the scan. docs/EXECUTION_PLAN step 2.
+ */
+import { spawn } from 'node:child_process';
+import { shipScan } from './ship-scan.js';
+// Same pre-granted edit tools the daemon's claude-code adapter uses for headless -p mode.
+const CLAUDE_FLAGS = [
+    '--output-format',
+    'stream-json',
+    '--verbose',
+    '--allowedTools',
+    'Edit',
+    'Write',
+    'Read',
+    'Grep',
+    'Glob',
+    'MultiEdit',
+];
+const baseName = (p) => {
+    const s = String(p || '');
+    return s.split('/').pop() || s;
+};
+/** Turn one claude stream-json event into a plain-language step ('' = nothing worth showing). */
+function stepLabel(ev) {
+    if (!ev || ev.type !== 'assistant')
+        return '';
+    const content = ev.message?.content;
+    if (!Array.isArray(content))
+        return '';
+    for (const c of content) {
+        if (c?.type !== 'tool_use')
+            continue;
+        const name = String(c.name || '');
+        const input = c.input || {};
+        const f = baseName(input.file_path || input.path);
+        if (name === 'Edit' || name === 'MultiEdit' || name === 'Write')
+            return `Editing ${f}`;
+        if (name === 'Read')
+            return `Reading ${f}`;
+        if (name === 'Grep' || name === 'Glob')
+            return 'Searching the code';
+        return `Working (${name})`;
+    }
+    return '';
+}
+export async function fixCodeVuln(dir, top, onStep) {
+    const prompt = `There is a real security vulnerability in ${top.file} (around line ${top.line}): ${top.what} ` +
+        `Fix it properly so the app still works — change the code, don't just comment it. Edit only the file(s) needed in this project.`;
+    const env = { ...process.env };
+    delete env.ANTHROPIC_API_KEY; // use the Claude Code subscription, not pay-as-you-go
+    delete env.ANTHROPIC_AUTH_TOKEN;
+    // Don't repeat the same step twice in a row — keeps the live feed readable.
+    let lastLabel = '';
+    const step = (label) => {
+        if (!label || label === lastLabel)
+            return;
+        lastLabel = label;
+        try {
+            onStep?.(label);
+        }
+        catch {
+            /* a dead client must never crash the fix */
+        }
+    };
+    step('Starting the AI fix');
+    await new Promise((resolve) => {
+        let child;
+        try {
+            // Capture stdout (the stream-json feed) so we can surface live steps; stderr stays quiet.
+            child = spawn('claude', ['-p', prompt, ...CLAUDE_FLAGS], {
+                cwd: dir,
+                env: env,
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+        }
+        catch {
+            resolve();
+            return;
+        }
+        let buf = '';
+        child.stdout?.on('data', (chunk) => {
+            buf += chunk.toString();
+            let nl;
+            while ((nl = buf.indexOf('\n')) >= 0) {
+                const line = buf.slice(0, nl).trim();
+                buf = buf.slice(nl + 1);
+                if (!line)
+                    continue;
+                let ev;
+                try {
+                    ev = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                step(stepLabel(ev));
+            }
+        });
+        const timer = setTimeout(() => {
+            try {
+                child.kill('SIGKILL');
+            }
+            catch {
+                /* best effort */
+            }
+            resolve();
+        }, 180_000);
+        child.on('close', () => {
+            clearTimeout(timer);
+            resolve();
+        });
+        child.on('error', () => {
+            clearTimeout(timer);
+            resolve();
+        });
+    });
+    step('Re-scanning to prove the danger is gone');
+    // PROVE: re-scan and check the SAME danger (file + ruleId) is gone.
+    const after = shipScan(dir);
+    const stillThere = after.findings.some((f) => f.file === top.file && f.ruleId === top.ruleId);
+    // A finding can only be proven closed by the scanner that FOUND it. If that scanner failed on the
+    // re-scan, the danger "disappears" for the same reason a switched-off smoke alarm reports no fire.
+    // Absence of a finding from a scanner that never ran is not proof, and this loop's whole value is
+    // that its proof means something. (codehere's own vibeChecks run in-process, so they always ran.)
+    const proverRan = top.tool === 'codehere' || after.ran[top.tool];
+    if (!stillThere && !proverRan) {
+        return {
+            ok: true,
+            provenClosed: false,
+            message: `The AI rewrote ${top.file}, but codehere could not prove the fix: ${top.tool} failed to complete the re-scan, so the "${top.ruleId}" danger is unverified rather than gone. Re-run the scan once ${top.tool} is working.`,
+        };
+    }
+    return {
+        ok: true,
+        provenClosed: !stillThere,
+        message: !stillThere
+            ? `Proven closed: the AI rewrote ${top.file} and codehere re-scanned it — the "${top.ruleId}" danger is gone. Give the change a quick look before you ship.`
+            : `The AI tried, but codehere re-scanned and the "${top.ruleId}" danger is STILL in ${top.file}. Not fixed — this one needs your eyes (or a different fix).`,
+    };
+}
+//# sourceMappingURL=fix-code.js.map

package/dist/infrastructure/security/fix-secret.js

@@ -0,0 +1,89 @@
+/**
+ * Deterministic "fix + prove closed" for an exposed secret — the #1 vibe-coder ship-blocker.
+ * ZERO model tokens. Moves the hardcoded secret out of your shippable code (→ process.env + a
+ * gitignored .env), then PROVES it by re-reading the source. Honest: you must still ROTATE the key
+ * (moving it doesn't undo the exposure that already happened). See docs/PRODUCT_10X.md (R3).
+ */
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, writeFileSync, existsSync, appendFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, relative, isAbsolute } from 'node:path';
+function topSecret(dir) {
+    const tmp = join(mkdtempSync(join(tmpdir(), 'fixsec-')), 'gl.json');
+    spawnSync('gitleaks', ['detect', '--no-git', '--source', dir, '-f', 'json', '-r', tmp], { stdio: 'ignore' });
+    if (!existsSync(tmp))
+        return null;
+    let arr;
+    try {
+        arr = JSON.parse(readFileSync(tmp, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (!arr || !arr.length)
+        return null;
+    // Prefer a secret still living in shippable source (not one already moved into a .env).
+    const f = arr.find((x) => !String(x.File || '').endsWith('.env')) || arr[0];
+    return {
+        file: String(f.File),
+        secret: String(f.Secret),
+        line: Number(f.StartLine || 0),
+        ruleId: String(f.RuleID || 'secret'),
+    };
+}
+function deriveVarName(line, ruleId) {
+    const m = line.match(/(?:const|let|var)?\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*[:=]/);
+    let name = m ? m[1] : `SECRET_${ruleId}`;
+    name = name
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .toUpperCase()
+        .replace(/[^A-Z0-9_]/g, '_');
+    return name || 'APP_SECRET';
+}
+export function fixExposedSecret(dir) {
+    const t = topSecret(dir);
+    if (!t)
+        return {
+            ok: false,
+            reason: 'no_secret',
+            message: 'The top issue here is a code change, not a leaked key — auto-fix for code vulnerabilities is the next step (it needs an agent).',
+        };
+    if (!existsSync(t.file))
+        return { ok: false, reason: 'file_gone', message: 'The flagged file is no longer there.' };
+    let src = readFileSync(t.file, 'utf8');
+    if (!src.includes(t.secret))
+        return { ok: false, reason: 'not_found', message: 'Could not locate the secret in the file to replace.' };
+    const lineText = src.split('\n').find((l) => l.includes(t.secret)) || '';
+    const varName = deriveVarName(lineText, t.ruleId);
+    // Replace the literal with process.env.VARNAME (quoted forms first, bare as a fallback).
+    src = src
+        .split(`"${t.secret}"`)
+        .join(`process.env.${varName}`)
+        .split(`'${t.secret}'`)
+        .join(`process.env.${varName}`)
+        .split(t.secret)
+        .join(`process.env.${varName}`);
+    writeFileSync(t.file, src);
+    // Move the value to a gitignored .env.
+    const env = join(dir, '.env');
+    if (!existsSync(env) || !readFileSync(env, 'utf8').includes(`${varName}=`))
+        appendFileSync(env, `${varName}=${t.secret}\n`);
+    const gi = join(dir, '.gitignore');
+    const giTxt = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
+    if (!/^\.env\s*$/m.test(giTxt))
+        writeFileSync(gi, (giTxt && !giTxt.endsWith('\n') ? `${giTxt}\n` : giTxt) + '.env\n');
+    // PROVE CLOSED: the secret must be gone from shippable source.
+    const provenClosed = !readFileSync(t.file, 'utf8').includes(t.secret);
+    const file = isAbsolute(t.file) ? relative(dir, t.file) : t.file;
+    return {
+        ok: true,
+        file,
+        varName,
+        provenClosed,
+        rotate: true,
+        message: provenClosed
+            ? `Proven closed: the secret is gone from ${file} — it now reads process.env.${varName}, and the value moved to .env (now gitignored, so it won't ship or get committed). ⚠ You MUST still rotate this key now — it was already exposed, so revoke the old value.`
+            : `Moved the secret to .env, but couldn't fully verify removal from ${file} — please check it by hand.`,
+    };
+}
+//# sourceMappingURL=fix-secret.js.map

package/dist/infrastructure/security/permissions-config.js

@@ -1,3 +1,4 @@
+import { writeFileAtomic } from '../storage/atomic-write.js';
 /**
  * Per-cwd permissions config — P18 slice 1 primitive.
  *
@@ -151,7 +152,7 @@ export function filterAllowed(findings, cwd) {
 // Shared by the CLI (`codehere permission allow ...`) and the HTTP write
 // endpoint (POST /api/permissions). Single source of truth for the
 // idempotent-add semantics + the YAML serializer.
-import { mkdirSync, writeFileSync } from 'fs';
+import { mkdirSync } from 'fs';
 /**
  * Idempotent add — if the pattern already exists in the bucket, returns
  * status='already_present' with the existing entry. Otherwise appends +
@@ -200,7 +201,7 @@ function writePermissionsConfig(cwd, cfg) {
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true });
     const filePath = join(dir, 'permissions.yaml');
-    writeFileSync(filePath, serializePermissionsYaml(cfg), 'utf-8');
+    writeFileAtomic(filePath, serializePermissionsYaml(cfg));
     return filePath;
 }
 export function serializePermissionsYaml(cfg) {

package/dist/infrastructure/security/scan-types.js

@@ -0,0 +1,10 @@
+/**
+ * The shape a scan finding takes, shared by everything that produces or consumes one.
+ *
+ * These lived in ship-scan.ts, which made vibe-checks.ts import from the module that imports
+ * it — a type-only cycle, erased at compile time and harmless at runtime, but the release
+ * checklist requires zero circular dependencies and a type-only cycle is still a cycle a
+ * later value import can turn into a real one.
+ */
+export {};
+//# sourceMappingURL=scan-types.js.map

package/dist/infrastructure/security/ship-scan.js

@@ -0,0 +1,195 @@
+/**
+ * Ship-readiness scan — orchestrates the installed OSS scanners (gitleaks + semgrep) and adds
+ * codehere's value: PRIORITIZE by CONSEQUENCE and surface the ONE blocker that gets you hacked,
+ * in plain language for a non-expert.
+ *
+ * Deterministic, ZERO model tokens — the detection is OSS (battle-tested, better than hand-rolled);
+ * codehere is the non-expert layer on top. See docs/PRODUCT_10X.md (R1 detect via OSS, R2 prioritize).
+ */
+import { spawnSync, execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, relative, isAbsolute } from 'node:path';
+import { vibeChecks } from './vibe-checks.js';
+const TIER_RANK = { critical: 0, high: 1, medium: 2 };
+function installed(tool) {
+    try {
+        execFileSync('which', [tool], { stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function rel(dir, file) {
+    if (!file)
+        return '';
+    return isAbsolute(file) ? relative(dir, file) : file;
+}
+/**
+ * A secret parked in a gitignored file (the .env our own fix moves it to) is AT REST — it won't be
+ * committed or shipped, so it's not a ship-blocker. Filter those out, otherwise the scan re-flags the
+ * very file the fix created and "prove it's closed" contradicts itself. Honors full .gitignore
+ * semantics via git; falls back to a literal .gitignore read for the common .env case in a non-git dir.
+ */
+function filterAtRest(dir, findings) {
+    if (findings.length === 0)
+        return findings;
+    const files = [...new Set(findings.map((f) => f.file))];
+    const ignored = new Set();
+    const res = spawnSync('git', ['-C', dir, 'check-ignore', '--stdin'], { input: files.join('\n'), encoding: 'utf8' });
+    if (res.status === 0 && res.stdout) {
+        for (const p of res.stdout
+            .split('\n')
+            .map((s) => s.trim())
+            .filter(Boolean))
+            ignored.add(p);
+    }
+    else if (res.status === 128) {
+        // Not a git repo yet — minimal fallback so the fix→prove loop is honest even pre-`git init`.
+        const giPath = join(dir, '.gitignore');
+        const gi = existsSync(giPath) ? readFileSync(giPath, 'utf8') : '';
+        const patterns = gi
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l && !l.startsWith('#'));
+        for (const f of files) {
+            const base = f.split('/').pop() || f;
+            if (patterns.some((p) => p === f || p === base || (p.startsWith('*') && base.endsWith(p.slice(1)))))
+                ignored.add(f);
+        }
+    }
+    return findings.filter((f) => !ignored.has(f.file));
+}
+/** gitleaks = exposed secrets/keys — the #1 way vibe-coded apps get owned. Always critical. */
+function runGitleaks(dir) {
+    const tmp = join(mkdtempSync(join(tmpdir(), 'sscan-')), 'gl.json');
+    // gitleaks exits non-zero when leaks are found — spawnSync (no throw), read the report regardless.
+    spawnSync('gitleaks', ['detect', '--no-git', '--source', dir, '-f', 'json', '-r', tmp], { stdio: 'ignore' });
+    // No report file = the run died before writing one. Zero findings here means "we don't know",
+    // not "nothing found", so ok:false — the surface must not spend it as coverage.
+    if (!existsSync(tmp))
+        return { ok: false, findings: [] };
+    let arr;
+    try {
+        arr = JSON.parse(readFileSync(tmp, 'utf8'));
+    }
+    catch {
+        return { ok: false, findings: [] };
+    }
+    const findings = (arr || []).map((f) => {
+        const ruleId = String(f.RuleID || 'secret');
+        const file = rel(dir, String(f.File || ''));
+        return {
+            tool: 'gitleaks',
+            ruleId,
+            file,
+            line: Number(f.StartLine || 0),
+            tier: 'critical',
+            what: `A live secret (${ruleId}) is hardcoded in ${file}. Anyone who can read your code — in your repo, or shipped to your users — has it, and can use it to reach whatever it unlocks: your database, your users' data, your paid APIs.`,
+        };
+    });
+    return { ok: true, findings };
+}
+/** Map a semgrep check to a consequence tier + plain-language "what happens". */
+function classifySemgrep(checkId, severity) {
+    const id = checkId.toLowerCase();
+    const danger = (kind) => (file) => `Untrusted input reaches ${kind} in ${file}. An attacker can ${{
+        command: 'run any command on your server',
+        sql: 'read or wipe your entire database',
+        code: 'run their own code in your app',
+        path: "read files outside your app (like other users' data or secrets)",
+        ssrf: 'make your server hit internal/private systems',
+        xss: "run scripts in your users' browsers (steal sessions, deface the page)",
+    }[kind] || 'do something you did not intend'}.`;
+    if (/(command|child.?process|os.?command|exec)/.test(id))
+        return { tier: 'critical', what: danger('command') };
+    if (/(sql|nosql|query.?injection)/.test(id))
+        return { tier: 'critical', what: danger('sql') };
+    if (/(eval|code.?injection|deserial)/.test(id))
+        return { tier: 'critical', what: danger('code') };
+    if (/(path.?traversal|directory.?traversal|zip.?slip)/.test(id))
+        return { tier: 'critical', what: danger('path') };
+    if (/ssrf/.test(id))
+        return { tier: 'critical', what: danger('ssrf') };
+    if (/(jwt|secret|hardcoded|api.?key|password)/.test(id))
+        return {
+            tier: 'critical',
+            what: (file) => `A secret or weak credential handling was found in ${file} — it can let an attacker into your data.`,
+        };
+    if (/xss/.test(id))
+        return { tier: 'high', what: danger('xss') };
+    const sev = String(severity || '').toUpperCase();
+    const tier = sev === 'ERROR' ? 'high' : 'medium';
+    return {
+        tier,
+        what: (file) => `A security issue (${checkId.split('.').pop()}) was found in ${file} that could be exploited before you ship.`,
+    };
+}
+function runSemgrep(dir) {
+    const tmp = join(mkdtempSync(join(tmpdir(), 'sscan-')), 'sg.json');
+    // p/default is the curated default registry ruleset; --quiet keeps output clean. It is NOT
+    // offline and NOT fast — measured 2026-08-08, `semgrep scan --config p/default` on a cold
+    // registry cache blew past 200s on a developer laptop and hit the timeout below. The earlier
+    // comment here claimed "offline-capable, fast", which is why the zero findings it returns on
+    // timeout were being read as a clean scan.
+    spawnSync('semgrep', ['scan', '--config', 'p/default', '--json', '--quiet', '--no-git-ignore', dir, '-o', tmp], {
+        stdio: 'ignore',
+        timeout: 180_000,
+    });
+    // Timeout, network failure, or crash: no report file. Zero findings is absence of evidence.
+    if (!existsSync(tmp))
+        return { ok: false, findings: [] };
+    let json;
+    try {
+        json = JSON.parse(readFileSync(tmp, 'utf8'));
+    }
+    catch {
+        return { ok: false, findings: [] };
+    }
+    const findings = (json.results || []).map((r) => {
+        const checkId = String(r.check_id || 'rule');
+        const file = rel(dir, String(r.path || ''));
+        const severity = String(r.extra?.severity || '');
+        const c = classifySemgrep(checkId, severity);
+        return {
+            tool: 'semgrep',
+            ruleId: checkId.split('.').pop() || checkId,
+            file,
+            line: Number(r.start?.line || 0),
+            tier: c.tier,
+            what: c.what(file),
+        };
+    });
+    return { ok: true, findings };
+}
+/** Run the OSS scanners on `dir`, normalize + prioritize by consequence, surface the ONE top blocker. */
+export function shipScan(dir) {
+    const hasGl = installed('gitleaks');
+    const hasSg = installed('semgrep');
+    const missing = [];
+    if (!hasGl)
+        missing.push('gitleaks');
+    if (!hasSg)
+        missing.push('semgrep');
+    const all = [];
+    const gl = hasGl ? runGitleaks(dir) : { ok: false, findings: [] };
+    const sg = hasSg ? runSemgrep(dir) : { ok: false, findings: [] };
+    all.push(...gl.findings, ...sg.findings);
+    // Installed but produced nothing readable — a coverage hole the surface has to name out loud.
+    const failed = [];
+    if (hasGl && !gl.ok)
+        failed.push('gitleaks');
+    if (hasSg && !sg.ok)
+        failed.push('semgrep');
+    // codehere's own vibe-coder-specific checks — the dangers gitleaks/semgrep miss (always runs, free).
+    all.push(...vibeChecks(dir));
+    // Drop anything that lives in a gitignored file — it's at rest, won't ship or get committed, so it's
+    // not a ship-blocker. This is what makes the fix→prove loop honest: the fix parks a secret in a
+    // gitignored .env, and the re-scan must come back clean instead of re-flagging the file it just created.
+    const findings = filterAtRest(dir, all);
+    // Prioritize: consequence tier first, then secrets (gitleaks) ahead of code patterns at the same tier.
+    findings.sort((a, b) => TIER_RANK[a.tier] - TIER_RANK[b.tier] || (a.tool === 'gitleaks' ? -1 : 1));
+    return { ran: { gitleaks: gl.ok, semgrep: sg.ok }, missing, failed, findings, top: findings[0] || null };
+}
+//# sourceMappingURL=ship-scan.js.map

package/dist/infrastructure/security/trust-scorer.js

@@ -52,10 +52,31 @@ export const CODE_PATTERNS = [
         scanRaw: true,
     },
     {
-        regex: /sk-[a-zA-Z0-9]{32,}|xoxb-[a-zA-Z0-9-]+|ghp_[a-zA-Z0-9]{36,}/i,
+        // Provider key formats a dev actually hardcodes. Anthropic (sk-ant-) FIRST:
+        // it carries hyphens, so the generic sk-[alnum]{32,} branch never matched —
+        // and codehere is an Anthropic-SDK product, so it's the most likely leak.
+        // A dogfood sweep (cycle 9) then caught more misses: Stripe (sk_live_ has an
+        // underscore, not a hyphen), AWS access keys (only the .aws/credentials FILE
+        // read was flagged, never a hardcoded AKIA…), and GitHub fine-grained PATs
+        // (github_pat_, distinct from the classic ghp_).
+        // /g so a file with multiple DISTINCT hardcoded keys reports each one — a
+        // trust scan should surface every secret in one pass, not just the first
+        // (the engine's exec-loop breaks after match #1 unless the regex is global).
+        regex: /sk-ant-[a-zA-Z0-9_-]{20,}|sk-[a-zA-Z0-9]{32,}|(?:sk|rk)_(?:live|test)_[a-zA-Z0-9]{20,}|AKIA[0-9A-Z]{16}|github_pat_[A-Za-z0-9_]{22,}|xoxb-[a-zA-Z0-9-]+|ghp_[a-zA-Z0-9]{36,}/gi,
         severity: 'critical',
         category: 'Secrets',
-        description: 'API key pattern (OpenAI/Slack/GitHub)',
+        description: 'Hardcoded API key / secret (Anthropic, OpenAI, Stripe, AWS, GitHub, Slack)',
+        cwe: 'CWE-798',
+        scanRaw: true,
+    },
+    {
+        // A hardcoded PRIVATE KEY block in source is among the worst possible leaks,
+        // and trust was blind to it (cycle 10 dogfood) — the existing key rule only
+        // flags READING a .pem/.ssh file, not an inline -----BEGIN … PRIVATE KEY-----.
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/gi,
+        severity: 'critical',
+        category: 'Secrets',
+        description: 'Hardcoded private key (PEM block)',
         cwe: 'CWE-798',
         scanRaw: true,
     },
@@ -94,6 +115,17 @@ export const CODE_PATTERNS = [
         description: 'String concatenation in SQL query call',
         cwe: 'CWE-89',
     },
+    // SQL built in a template literal — catches the case the `query(...)` pattern above misses:
+    // the query is assigned to a variable first (`const q = `SELECT...${x}``) then passed to query(q).
+    // Anchored on real SQL shape (SELECT…FROM / INSERT…INTO / UPDATE…SET / DELETE…FROM) to stay low-noise.
+    {
+        regex: /`[^`]*\b(?:SELECT\b[^`]*\bFROM|INSERT\b[^`]*\bINTO|UPDATE\b[^`]*\bSET|DELETE\b[^`]*\bFROM)\b[^`]*\$\{/gi,
+        severity: 'critical',
+        category: 'SQL Injection',
+        description: 'SQL query built in a template literal with interpolation',
+        cwe: 'CWE-89',
+        scanRaw: true,
+    },
     // Command injection with user input (scan with strings visible)
     // Catches require('child_process').execSync(req.body.cmd) — child_process is in a string
     // but the method call and req. reference are in plain code
@@ -639,9 +671,17 @@ export function scoreFile(filepath, code) {
     if (complexity.todos > 5)
         penalty += 3;
     const score = Math.max(0, Math.min(100, 100 - penalty));
-    const grade = score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F';
     const critical = allFindings.filter((f) => f.severity === 'critical').length;
     const high = allFindings.filter((f) => f.severity === 'high').length;
+    // Honesty floor (It-0 finding): a file with a CRITICAL finding cannot read as
+    // a passing grade — eval(userInput) + a hardcoded key scoring "B 75/100" is
+    // the optimistic-average lie. A critical caps the grade at F; a high (no
+    // critical) caps it at C. The numeric score still shows the gradient below.
+    let grade = score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F';
+    if (critical > 0)
+        grade = 'F';
+    else if (high > 0 && (grade === 'A' || grade === 'B'))
+        grade = 'C';
     const summary = critical > 0
         ? `${critical} critical issue${critical > 1 ? 's' : ''} require immediate attention`
         : high > 0
@@ -654,4 +694,31 @@ export function scoreFile(filepath, code) {
 export function gradeFromScore(score) {
     return score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 40 ? 'D' : 'F';
 }
+/**
+ * S8 · the ONE project-level aggregation. `trust`, `trust --badge`, and
+ * `report` all derive the headline score + grade from here — each command
+ * used to re-implement this reduce-and-cap block (the same drift that
+ * historically hit the file-collection rules), and the badge could disagree
+ * with the report for the same target. Same inputs → same number,
+ * structurally.
+ */
+export function aggregateTrust(results) {
+    const count = (sev) => results.reduce((s, r) => s + r.findings.filter((f) => f.severity === sev).length, 0);
+    const criticalCount = count('critical');
+    const highCount = count('high');
+    const mediumCount = count('medium');
+    const lowCount = count('low');
+    const totalFindings = results.reduce((s, r) => s + r.findings.length, 0);
+    const overallScore = results.length > 0 ? Math.round(results.reduce((s, r) => s + r.score, 0) / results.length) : 100;
+    // Honesty floor (It-0): a scan with any CRITICAL finding can't read as a
+    // passing grade — eval()/hardcoded-key scoring "B" is the optimistic-average
+    // lie. Critical → F; high (no critical) → no better than C. Score still
+    // shows the gradient.
+    let grade = overallScore >= 90 ? 'A' : overallScore >= 75 ? 'B' : overallScore >= 60 ? 'C' : overallScore >= 40 ? 'D' : 'F';
+    if (criticalCount > 0)
+        grade = 'F';
+    else if (highCount > 0 && (grade === 'A' || grade === 'B'))
+        grade = 'C';
+    return { overallScore, grade, criticalCount, highCount, mediumCount, lowCount, totalFindings };
+}
 //# sourceMappingURL=trust-scorer.js.map

package/dist/infrastructure/security/vibe-checks.js

@@ -0,0 +1,99 @@
+/**
+ * Vibe-coder-specific danger checks — the high-consequence things gitleaks + semgrep DON'T catch by
+ * default but that the research named as the #1 ways AI-built apps get owned. Deterministic, zero
+ * model tokens. Pattern-based on the source files. See docs/PRODUCT_10X.md (step 1 of the plan).
+ */
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, extname, relative } from 'node:path';
+const SRC_EXT = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.vue', '.svelte', '.html', '.astro']);
+const SKIP_DIR = new Set(['node_modules', '.git', 'dist', 'build', '.next', 'out', 'vendor', 'coverage', '.turbo']);
+function walk(dir, files, depth = 0) {
+    if (depth > 8)
+        return;
+    let ents;
+    try {
+        ents = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const e of ents) {
+        if (SKIP_DIR.has(e.name))
+            continue;
+        const p = join(dir, e.name);
+        if (e.isDirectory())
+            walk(p, files, depth + 1);
+        else if (SRC_EXT.has(extname(e.name)))
+            files.push(p);
+    }
+}
+const CHECKS = [
+    {
+        // The real escalation danger: a PRIVILEGE flag in browser storage (not a token, which is standard).
+        id: 'privilege-flag-in-browser-storage',
+        re: /(localStorage|sessionStorage)\s*\.\s*setItem\s*\(\s*['"`](role|is_?admin|admin|is_?staff|is_?paid|paid|premium|pro|plan|tier|permission|access_?level|can_|entitlement)/i,
+        tier: 'critical',
+        what: (f) => `A permission flag (admin/role/plan) is stored in the browser in ${f}. A user can open dev-tools, change it, and give themselves admin or paid access — your app trusts a value the user controls. Decide permissions on the server, never from localStorage.`,
+    },
+    {
+        id: 'supabase-service-role-key',
+        re: /service_role|SUPABASE_SERVICE_ROLE/i,
+        tier: 'critical',
+        what: (f) => `A Supabase service_role key is referenced in ${f}. That key bypasses ALL your database rules — if it reaches the browser, anyone can read and write your entire database. It must live only on your server, never in client code.`,
+    },
+    {
+        // User input string-built into a SQL query — concat ("...WHERE id="+x) or interpolation (`...${x}`).
+        // Parameterized queries ($1 / ? placeholders) don't match, so this stays low-noise.
+        id: 'sql-injection-string-building',
+        re: /\b(SELECT\b[^;\n'"`]*\bFROM\b|INSERT\b[^;\n'"`]*\bINTO\b|UPDATE\b[^;\n'"`]*\bSET\b|DELETE\b[^;\n'"`]*\bFROM\b)[^;\n]*?(\$\{|['"`]\s*\+\s*\w)/i,
+        tier: 'critical',
+        what: (f) => `User input is being string-built into a SQL query in ${f}. An attacker can put SQL inside that input and read, change, or wipe your entire database. Use parameterized queries (placeholders like $1 or ?), never glue the query together with + or \${}.`,
+    },
+    {
+        id: 'unsafe-html-injection',
+        re: /dangerouslySetInnerHTML|v-html\s*=|\.innerHTML\s*=\s*[^'"`;\s]/,
+        tier: 'high',
+        what: (f) => `Raw HTML is written into the page in ${f}. If any of it comes from a user, an attacker can run scripts in your visitors' browsers — steal their logins, deface the page, or act as them.`,
+    },
+    {
+        id: 'auth-disabled-or-todo',
+        re: /\/\/\s*(TODO|FIXME).*(auth|login|permission|secur)|auth\s*[:=]\s*false|requireAuth\s*[:=]\s*false|skipAuth\s*[:=]\s*true/i,
+        tier: 'high',
+        what: (f) => `Authentication looks turned off or left as a TODO in ${f}. AI agents often stub auth out to "make it work" and never finish it — anyone could reach pages or data meant to be protected.`,
+    },
+];
+/** Scan the source files in `dir` for vibe-coder-specific dangers. One hit per check per file. */
+export function vibeChecks(dir) {
+    const files = [];
+    walk(dir, files);
+    const out = [];
+    for (const f of files) {
+        let txt;
+        try {
+            txt = readFileSync(f, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        if (txt.length > 500_000)
+            continue; // skip huge/minified files
+        const lines = txt.split('\n');
+        for (const c of CHECKS) {
+            for (let i = 0; i < lines.length; i++) {
+                if (c.re.test(lines[i])) {
+                    out.push({
+                        tool: 'codehere',
+                        ruleId: c.id,
+                        file: relative(dir, f),
+                        line: i + 1,
+                        tier: c.tier,
+                        what: c.what(relative(dir, f)),
+                    });
+                    break;
+                }
+            }
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=vibe-checks.js.map