codehere 0.8.0 → 1.0.1

package/dist/presentation/cli/commands/memory-command.js

@@ -215,12 +215,12 @@ function executeMemoryGraduate(options) {
         }
         const r = appendLessonIfNew(lessonsPath, text, 'manual');
         if (r.result === 'added') {
-            console.log(`  ${success('added  ')} lesson ${colors.dim(r.lesson.id)} → ${lessonsPath}`);
+            console.log(`  ${success('added  ')} lesson ${colors.dim(r.lesson.id)} › ${lessonsPath}`);
             console.log(`           ${colors.dim('"' + r.lesson.text + '"')}`);
         }
         else {
             console.log(`  ${info('skipped')} duplicate of existing lesson ${colors.dim(r.lesson.id)}`);
-            console.log(`           ${colors.dim('(already in lessons.jsonl — graduate is a no-op)')}`);
+            console.log(`           ${colors.dim('(already in lessons.jsonl · graduate is a no-op)')}`);
         }
         newline();
         return;
@@ -240,7 +240,7 @@ function executeMemoryGraduate(options) {
         // Either way, the user decided — delete the candidate.
         rmSync(join(candidatesDir, candidateId + '.json'));
         if (r.result === 'added') {
-            console.log(`  ${success('graduated')} candidate ${candidateId} → lesson ${colors.dim(r.lesson.id)}`);
+            console.log(`  ${success('graduated')} candidate ${candidateId} › lesson ${colors.dim(r.lesson.id)}`);
         }
         else {
             console.log(`  ${info('skipped ')} candidate ${candidateId} text already in lessons (lesson ${colors.dim(r.lesson.id)})`);
@@ -320,19 +320,19 @@ function gatherLayerSummary(codehereDir, projectRoot) {
         out.push({ layer: 'working', line: `working    · session.md (${fmtSize(sz)})` });
     }
     else {
-        out.push({ layer: 'working', line: `working    · (empty — no session.md)` });
+        out.push({ layer: 'working', line: `working    · (empty · no session.md)` });
     }
     // episodic — symlink + repo_map
     const episodicLearnings = join(codehereDir, 'memory/episodic/AGENT_LEARNINGS.jsonl');
     const repoMapPath = join(codehereDir, 'memory/episodic/repo_map.json');
     const learningsLine = existsSync(episodicLearnings) || isSymlink(episodicLearnings)
         ? isSymlink(episodicLearnings)
-            ? `AGENT_LEARNINGS.jsonl → ${readlinkSync(episodicLearnings)}`
+            ? `AGENT_LEARNINGS.jsonl › ${readlinkSync(episodicLearnings)}`
             : 'AGENT_LEARNINGS.jsonl (real file)'
         : '(no AGENT_LEARNINGS.jsonl)';
     const repoMapLine = existsSync(repoMapPath)
         ? `repo_map.json (${fmtSize(statSync(repoMapPath).size)})`
-        : 'no repo_map.json — run `codehere memory repo-map`';
+        : 'no repo_map.json · run `codehere memory repo-map`';
     out.push({ layer: 'episodic', line: `episodic   · ${learningsLine} · ${repoMapLine}` });
     // semantic/lessons.jsonl
     const lessonsPath = join(codehereDir, 'memory/semantic/lessons.jsonl');
@@ -383,7 +383,7 @@ function gatherLayerSummary(codehereDir, projectRoot) {
         }
     }
     else {
-        out.push({ layer: 'protocols', line: `protocols  · (no hook_patterns.json — run \`codehere protocols export\`)` });
+        out.push({ layer: 'protocols', line: `protocols  · (no hook_patterns.json · run \`codehere protocols export\`)` });
     }
     // injection — codex Round 1 fix: every entry in SHOW_LAYERS must appear
     // in the overview, including the special-case `injection` layer.
@@ -393,7 +393,7 @@ function gatherLayerSummary(codehereDir, projectRoot) {
     // setup.
     const inj = buildMemoryPrefix(projectRoot);
     if (inj.prefix === '') {
-        out.push({ layer: 'injection', line: `injection  · (nothing — empty / placeholder layers)` });
+        out.push({ layer: 'injection', line: `injection  · (nothing · empty / placeholder layers)` });
     }
     else {
         const truncNote = inj.truncated ? ' TRUNCATED' : '';
@@ -488,7 +488,7 @@ function executeMemoryShow(layerArg) {
             const repoMap = join(codehereDir, 'memory/episodic/repo_map.json');
             if (isSymlink(learnings)) {
                 const target = readlinkSync(learnings);
-                console.log(`  ${success('linked ')} AGENT_LEARNINGS.jsonl → ${target}`);
+                console.log(`  ${success('linked ')} AGENT_LEARNINGS.jsonl › ${target}`);
                 try {
                     const body = readFileSync(learnings, 'utf8');
                     const count = body.trim().length === 0 ? 0 : body.trim().split('\n').length;
@@ -514,7 +514,7 @@ function executeMemoryShow(layerArg) {
                         return acc + (Array.isArray(symbols) ? symbols.length : 0);
                     }, 0);
                     const topCount = Array.isArray(m.topSymbols) ? m.topSymbols.length : 0;
-                    console.log(`  ${success('present')} repo_map.json — ${fileCount} files, ${symbolCount} symbols, top ${topCount} ranked`);
+                    console.log(`  ${success('present')} repo_map.json · ${fileCount} files, ${symbolCount} symbols, top ${topCount} ranked`);
                     if (Array.isArray(m.topSymbols) && m.topSymbols.length > 0) {
                         console.log(`           ${colors.dim('top 5:')}`);
                         for (const s of m.topSymbols.slice(0, 5)) {
@@ -527,7 +527,7 @@ function executeMemoryShow(layerArg) {
                 }
             }
             else {
-                console.log(`  ${info('absent ')} no repo_map.json — run ${colors.cyan('codehere memory repo-map')}`);
+                console.log(`  ${info('absent ')} no repo_map.json · run ${colors.cyan('codehere memory repo-map')}`);
             }
             break;
         }
@@ -542,7 +542,7 @@ function executeMemoryShow(layerArg) {
                 .split('\n')
                 .filter((l) => l.length > 0);
             if (lines.length === 0) {
-                console.log(`  ${info('empty  ')} lessons.jsonl is empty — run ${colors.cyan('codehere memory graduate')} (coming in v0.5)`);
+                console.log(`  ${info('empty  ')} lessons.jsonl is empty · run ${colors.cyan('codehere memory graduate')} (coming in v0.5)`);
                 break;
             }
             console.log(`  ${success('present')} ${lines.length} lesson${lines.length === 1 ? '' : 's'}:`);
@@ -590,7 +590,7 @@ function executeMemoryShow(layerArg) {
         case 'protocols': {
             const path = join(codehereDir, 'protocols/hook_patterns.json');
             if (!existsSync(path)) {
-                console.log(`  ${info('empty  ')} no hook_patterns.json — run ${colors.cyan('codehere protocols export')}`);
+                console.log(`  ${info('empty  ')} no hook_patterns.json · run ${colors.cyan('codehere protocols export')}`);
                 break;
             }
             try {
@@ -874,44 +874,44 @@ function executeMemoryInit(options) {
                 console.log(`  ${success('migrated')} ${label}${extra ? '  ' + colors.dim(extra) : ''}`);
                 break;
             case 'skipped':
-                console.log(`  ${warning('skipped ')} ${label}  ${colors.dim('(target already exists — use --force)')}`);
+                console.log(`  ${warning('skipped ')} ${label}  ${colors.dim('(target already exists · use --force)')}`);
                 break;
             case 'missing':
                 console.log(`  ${info('skipped ')} ${label}  ${colors.dim('(source not found)')}`);
                 break;
             case 'already-migrated':
-                console.log(`  ${info('exists  ')} ${label}  ${colors.dim('(already migrated — symlink in place)')}`);
+                console.log(`  ${info('exists  ')} ${label}  ${colors.dim('(already migrated · symlink in place)')}`);
                 break;
         }
     };
-    report('CONTEXT.md → AGENTS.md', contextOutcome);
-    report('HANDOVER.md → memory/working/session.md', handoverOutcome);
+    report('CONTEXT.md › AGENTS.md', contextOutcome);
+    report('HANDOVER.md › memory/working/session.md', handoverOutcome);
     // PROMPTS.md gets a richer report because of the split semantics.
     if (promptsResult.outcome === 'migrated') {
         if (promptsResult.legacyFallback) {
-            console.log(`  ${success('migrated')} PROMPTS.md → skills/_legacy.md  ${colors.dim('(no ^## sections found — preserved as-is for manual split)')}`);
+            console.log(`  ${success('migrated')} PROMPTS.md › skills/_legacy.md  ${colors.dim('(no ^## sections found · preserved as-is for manual split)')}`);
         }
         else {
-            console.log(`  ${success('migrated')} PROMPTS.md → ${promptsResult.skillsCreated} skill folder${promptsResult.skillsCreated === 1 ? '' : 's'}  ${colors.dim('(skills/<slug>/SKILL.md per ^## section)')}`);
+            console.log(`  ${success('migrated')} PROMPTS.md › ${promptsResult.skillsCreated} skill folder${promptsResult.skillsCreated === 1 ? '' : 's'}  ${colors.dim('(skills/<slug>/SKILL.md per ^## section)')}`);
         }
     }
     else {
-        report('PROMPTS.md → skills/', promptsResult.outcome);
+        report('PROMPTS.md › skills/', promptsResult.outcome);
     }
     // F3 Task 3 — episodic symlink result.
     if (episodicResult) {
         switch (episodicResult.result) {
             case 'created':
-                console.log(`  ${success('linked  ')} memory/episodic/AGENT_LEARNINGS.jsonl → ${episodicResult.targetPath}`);
+                console.log(`  ${success('linked  ')} memory/episodic/AGENT_LEARNINGS.jsonl › ${episodicResult.targetPath}`);
                 break;
             case 're-linked':
-                console.log(`  ${success('re-linked')} memory/episodic/AGENT_LEARNINGS.jsonl → ${episodicResult.targetPath}`);
+                console.log(`  ${success('re-linked')} memory/episodic/AGENT_LEARNINGS.jsonl › ${episodicResult.targetPath}`);
                 break;
             case 'refused':
-                console.log(`  ${error('refused ')} memory/episodic/AGENT_LEARNINGS.jsonl  ${colors.dim('(real file or symlinked ancestor — remove first)')}`);
+                console.log(`  ${error('refused ')} memory/episodic/AGENT_LEARNINGS.jsonl  ${colors.dim('(real file or symlinked ancestor · remove first)')}`);
                 break;
             case 'root-skipped':
-                console.log(`  ${warning('skipped ')} episodic symlink  ${colors.dim('(running as root — re-run as your normal user)')}`);
+                console.log(`  ${warning('skipped ')} episodic symlink  ${colors.dim('(running as root · re-run as your normal user)')}`);
                 break;
             case 'failed':
                 console.log(`  ${warning('skipped ')} episodic symlink  ${colors.dim('(HOME read-only?)')}`);
@@ -929,9 +929,9 @@ function executeMemoryInit(options) {
     }
     newline();
     console.log(colors.bold('Next:'));
-    console.log(`  1. Open ${colors.cyan('.codehere/AGENTS.md')} — your project briefing (renamed from CONTEXT.md)`);
-    console.log(`  2. Edit ${colors.cyan('.codehere/memory/working/session.md')} as you work — supersedes HANDOVER.md`);
-    console.log(`  3. Each ${colors.cyan('.codehere/skills/<name>/SKILL.md')} is a task-shape template — copy and adapt`);
+    console.log(`  1. Open ${colors.cyan('.codehere/AGENTS.md')} · your project briefing (renamed from CONTEXT.md)`);
+    console.log(`  2. Edit ${colors.cyan('.codehere/memory/working/session.md')} as you work · supersedes HANDOVER.md`);
+    console.log(`  3. Each ${colors.cyan('.codehere/skills/<name>/SKILL.md')} is a task-shape template · copy and adapt`);
     if (!noSymlinks && anyMigrated) {
         console.log(`  ${colors.dim('(Old paths kept as symlinks for back-compat; safe to delete once teammates have pulled.)')}`);
     }
@@ -1024,7 +1024,7 @@ codehere memory <action> — F3 project memory operations
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        console.error(`\n  ${error('failed')} codehere memory ${action ?? ''} — ${msg}\n`);
+        console.error(`\n  ${error('failed')} codehere memory ${action ?? ''} · ${msg}\n`);
         process.exitCode = 1;
     }
 }

package/dist/presentation/cli/commands/permission-command.js

@@ -15,8 +15,6 @@
  * the slice-2 web-UI panel (forthcoming) wraps the same primitive for
  * non-technical users. The YAML format is the source of truth either way.
  */
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
 import { loadPermissions, addPermissionEntry, removePermissionEntry, } from '../../../infrastructure/security/permissions-config.js';
 import { colors, success, error, warning, info, newline } from '../../../ui.js';
 export async function executePermissionCommand(subcommand, pattern, options = {}) {
@@ -48,9 +46,6 @@ export async function executePermissionCommand(subcommand, pattern, options = {}
             process.exit(1);
     }
 }
-function permissionsPath() {
-    return join(process.cwd(), '.codehere', 'permissions.yaml');
-}
 function listPermissions() {
     const cfg = loadPermissions(process.cwd());
     if (cfg.allow.length === 0 && cfg.deny.length === 0) {
@@ -70,7 +65,7 @@ function listPermissions() {
         }
     }
     if (cfg.deny.length > 0) {
-        console.log(warning('deny (reserved — currently no-op):'));
+        console.log(warning('deny (reserved · currently no-op):'));
         for (const e of cfg.deny) {
             console.log(`  • ${e.pattern}`);
             if (e.reason)
@@ -107,10 +102,4 @@ function removeEntry(pattern) {
     console.log(success(`Removed ${removed} entr${removed === 1 ? 'y' : 'ies'} for:`), pattern);
     newline();
 }
-// Ensure file is read on disk after writes (smoke test in unit tests)
-export function _readRaw() {
-    if (!existsSync(permissionsPath()))
-        return '';
-    return readFileSync(permissionsPath(), 'utf-8');
-}
 //# sourceMappingURL=permission-command.js.map

package/dist/presentation/cli/commands/protocols-builder.js

@@ -121,8 +121,8 @@ export function buildHookPatternsExport() {
         generatedAt: new Date().toISOString(),
         source: 'agent/src/infrastructure/security/trust-scorer.ts',
         _note: "Exported from codehere's trust-scorer pattern bank via 'codehere protocols export'. " +
-            "DO NOT hand-edit `patterns_builtin[]` — it's regenerated on every export. " +
-            'Add project-specific patterns to `patterns_project[]` — those are preserved across re-exports. ' +
+            "DO NOT hand-edit `patterns_builtin[]` · it's regenerated on every export. " +
+            'Add project-specific patterns to `patterns_project[]` · those are preserved across re-exports. ' +
             'Pattern ids are stable slugs of category + description; reference them deterministically.',
         patterns_builtin: builtin,
         patterns_project: [],

package/dist/presentation/cli/commands/protocols-command.js

@@ -19,7 +19,7 @@ function executeProtocolsExport(options) {
     const codehereDir = join(root, '.codehere');
     newline();
     console.log(colors.bold('codehere protocols export'));
-    console.log(colors.dim(`  exporting trust-scorer pattern bank → ${codehereDir}/protocols/hook_patterns.json`));
+    console.log(colors.dim(`  exporting trust-scorer pattern bank › ${codehereDir}/protocols/hook_patterns.json`));
     newline();
     if (!existsSync(codehereDir)) {
         console.log(`  ${error('refused')} .codehere/ not found at this root.`);
@@ -48,8 +48,8 @@ function executeProtocolsExport(options) {
     newline();
     console.log(colors.bold('Next:'));
     console.log(`  - Inspect ${colors.cyan('.codehere/protocols/hook_patterns.json')} to see what the safety hook matches`);
-    console.log(`  - Add project-specific patterns under ${colors.cyan('patterns_project[]')} — they survive re-exports`);
-    console.log(`  ${colors.dim('(Edit patterns_builtin[] is a no-op — re-exports overwrite it from trust-scorer.ts.)')}`);
+    console.log(`  - Add project-specific patterns under ${colors.cyan('patterns_project[]')} · they survive re-exports`);
+    console.log(`  ${colors.dim('(Edit patterns_builtin[] is a no-op · re-exports overwrite it from trust-scorer.ts.)')}`);
     newline();
 }
 export function executeProtocolsCommand(action, options = {}) {
@@ -77,7 +77,7 @@ Coming later:
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        console.error(`\n  ${error('failed')} codehere protocols ${action ?? ''} — ${msg}\n`);
+        console.error(`\n  ${error('failed')} codehere protocols ${action ?? ''} · ${msg}\n`);
         process.exitCode = 1;
     }
 }

package/dist/presentation/cli/commands/repo-map-builder.js

@@ -205,7 +205,7 @@ export function buildRepoMap(repoRoot) {
         version: 'v0.5',
         generatedAt: new Date().toISOString(),
         rootPath: repoRoot,
-        _note: 'TS-native regex MVP — KNOWN MISSES (v0.5, addressed in v0.6 tree-sitter port): ' +
+        _note: 'TS-native regex MVP · KNOWN MISSES (v0.5, addressed in v0.6 tree-sitter port): ' +
             '`export default function/class` (no name on the export line), ' +
             '`export { foo, bar }` blocks, `export { foo } from "..."` re-exports, ' +
             '`export * from "..."` star re-exports, multi-line `export { ... }` blocks, ' +

package/dist/presentation/cli/commands/report-command.js

@@ -20,21 +20,22 @@
 import { writeFileSync, readFileSync, existsSync } from 'fs';
 import { basename, relative, join, isAbsolute } from 'path';
 import { colors, success, error, newline, info } from '../../../ui.js';
-import { scoreFile } from '../../../infrastructure/security/trust-scorer.js';
+import { scoreFile, aggregateTrust } from '../../../infrastructure/security/trust-scorer.js';
 import { collectCodeFiles } from '../../../infrastructure/security/file-collection.js';
 import { loadProductContext, adjustRecommendation } from '../../../infrastructure/config/product-context.js';
 // ── Markdown generation ───────────────────────────────────────────────────────
-function gradeEmoji(grade) {
-    return grade === 'A' ? '🟢' : grade === 'B' ? '🟡' : grade === 'C' ? '🟠' : grade === 'D' ? '🔴' : '🚨';
+// S19 glyph language: grades carry the sanctioned geometric set, never emoji.
+function gradeGlyph(grade) {
+    return grade === 'A' ? '✓' : grade === 'B' ? '·' : grade === 'C' ? '!' : grade === 'D' ? '✕' : '✕✕';
 }
 function severityLabel(severity) {
     return severity === 'critical'
-        ? '🚨 Critical'
+        ? '✕ Critical'
         : severity === 'high'
-            ? '⚠️  High'
+            ? '! High'
             : severity === 'medium'
-                ? '🔵 Medium'
-                : '⬇️  Low';
+                ? '· Medium'
+                : '· Low';
 }
 function badgeUrl(score, grade) {
     const color = grade === 'A'
@@ -57,7 +58,7 @@ function narrativeSummary(report) {
                     ? `${mediumCount} medium-severity pattern${mediumCount !== 1 ? 's' : ''} worth reviewing in a future sprint.`
                     : 'No significant findings.'));
         }
-        return `Solid codebase with some medium/low findings. ${overallScore}/100 — worth a review pass but not blocking.`;
+        return `Solid codebase with some medium/low findings. ${overallScore}/100 · worth a review pass but not blocking.`;
     }
     if (criticalCount > 0) {
         return (`${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} found that should be resolved before this merges. ` +
@@ -75,13 +76,13 @@ function recommendationsMarkdown(report) {
         lines.push(`${lines.length + 1}. **Address the ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} in this sprint.** Not blocking, but worth fixing while the code is fresh.`);
     }
     if (mediumCount > 0) {
-        lines.push(`${lines.length + 1}. **${mediumCount} medium-severity item${mediumCount !== 1 ? 's' : ''} can be queued for a future cleanup pass.** Mostly defensive hygiene — redirect hardening, input validation gaps.`);
+        lines.push(`${lines.length + 1}. **${mediumCount} medium-severity item${mediumCount !== 1 ? 's' : ''} can be queued for a future cleanup pass.** Mostly defensive hygiene · redirect hardening, input validation gaps.`);
     }
     if (lowCount > 0) {
         lines.push(`${lines.length + 1}. **${lowCount} low-severity note${lowCount !== 1 ? 's' : ''} for informational purposes.** These rarely cause issues but keep the score from being perfect.`);
     }
     if (lines.length === 0) {
-        lines.push('1. **Nothing blocking.** Keep it up — this is what a healthy codebase looks like.');
+        lines.push('1. **Nothing blocking.** Keep it up · this is what a healthy codebase looks like.');
     }
     return lines.join('\n\n');
 }
@@ -116,7 +117,7 @@ function generateMarkdown(report, target, cwd) {
     const dateStr = new Date(scannedAt).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' });
     const badge = badgeUrl(overallScore, grade);
     const summary = narrativeSummary(report);
-    const gradeIcon = gradeEmoji(grade);
+    const gradeIcon = gradeGlyph(grade);
     const productCtx = loadProductContext(cwd);
     const contextLine = productCtx
         ? `\nProject: **${productCtx.name}** · Risk level: **${productCtx.riskLevel}**${productCtx.productionApp ? ' · Production' : ''}\n`
@@ -138,8 +139,8 @@ ${summary}
 | | |
 |---|---|
 | Files scanned | ${files.length} |
-| Critical | ${criticalCount > 0 ? `**${criticalCount}** 🚨` : criticalCount} |
-| High | ${highCount > 0 ? `**${highCount}** ⚠️` : highCount} |
+| Critical | ${criticalCount > 0 ? `**${criticalCount}** ✕` : criticalCount} |
+| High | ${highCount > 0 ? `**${highCount}** !` : highCount} |
 | Medium | ${mediumCount} |
 | Low | ${lowCount} |
 
@@ -196,7 +197,7 @@ function generateSimpleReport(report, target) {
         : grade === 'B'
             ? 'Good'
             : grade === 'C'
-                ? 'Fair — some issues to address'
+                ? 'Fair · some issues to address'
                 : grade === 'D'
                     ? 'Needs work'
                     : 'Urgent attention needed';
@@ -207,13 +208,13 @@ function generateSimpleReport(report, target) {
     if (criticalCount > 0 || highCount > 0 || mediumCount > 0) {
         lines.push('What was found:');
         if (criticalCount > 0) {
-            lines.push(`  • ${criticalCount} serious issue${criticalCount !== 1 ? 's' : ''} — things like exposed passwords, unsafe commands, or code that could be exploited`);
+            lines.push(`  • ${criticalCount} serious issue${criticalCount !== 1 ? 's' : ''} · things like exposed passwords, unsafe commands, or code that could be exploited`);
         }
         if (highCount > 0) {
-            lines.push(`  • ${highCount} notable issue${highCount !== 1 ? 's' : ''} — worth fixing, but not an emergency`);
+            lines.push(`  • ${highCount} notable issue${highCount !== 1 ? 's' : ''} · worth fixing, but not an emergency`);
         }
         if (mediumCount > 0) {
-            lines.push(`  • ${mediumCount} minor thing${mediumCount !== 1 ? 's' : ''} — good to know about, low urgency`);
+            lines.push(`  • ${mediumCount} minor thing${mediumCount !== 1 ? 's' : ''} · good to know about, low urgency`);
         }
         lines.push('');
     }
@@ -231,12 +232,12 @@ function generateSimpleReport(report, target) {
         lines.push('  2. This code is safe to continue working on in the meantime.');
     }
     else {
-        lines.push('  1. Keep going — this code is in good shape.');
+        lines.push('  1. Keep going · this code is in good shape.');
         lines.push('  2. Run this scan again before your next release.');
     }
     lines.push('');
     lines.push('---');
-    lines.push('Generated by codehere — know what your AI agent did before your tech lead asks.');
+    lines.push('Generated by codehere · know what your AI agent did before your tech lead asks.');
     return lines.join('\n');
 }
 /**
@@ -259,7 +260,7 @@ function writeReportWithFallback(targetPath, content, label) {
     catch (e) {
         const code = e.code ?? '';
         if (['EROFS', 'EACCES', 'EPERM', 'ENOENT'].includes(code)) {
-            console.error(error(`Could not write to ${targetPath} (${code}). Printing to stdout instead — pass --out <path> to a writable location.`));
+            console.error(error(`Could not write to ${targetPath} (${code}). Printing to stdout instead · pass --out <path> to a writable location.`));
             process.stdout.write(content + '\n');
             return false;
         }
@@ -308,27 +309,42 @@ export async function executeReportCommand(target, options = {}) {
     if (!effectiveOut && paths.length > 20 && process.stderr.isTTY) {
         process.stderr.write(colors.dim(`  Scanning ${paths.length} files...`));
     }
-    const results = paths.map((p) => scoreFile(relative(cwd, p), readFileSync(p, 'utf-8')));
+    // S8 · same read semantics as `trust`: unreadable files are skipped, not
+    // crashed on — a different read-set was the other way the report could see
+    // a different score than the badge for the same target.
+    const results = [];
+    for (const p of paths) {
+        let code;
+        try {
+            code = readFileSync(p, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        results.push(scoreFile(relative(cwd, p), code));
+    }
     // Clear progress line
     if (!effectiveOut && paths.length > 20 && process.stderr.isTTY) {
         process.stderr.write('\r\x1b[K');
     }
-    const totalFindings = results.reduce((s, r) => s + r.findings.length, 0);
-    const criticalCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'critical').length, 0);
-    const highCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'high').length, 0);
-    const mediumCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'medium').length, 0);
-    const lowCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'low').length, 0);
-    const overallScore = results.length > 0 ? Math.round(results.reduce((s, r) => s + r.score, 0) / results.length) : 100;
-    const grade = overallScore >= 90 ? 'A' : overallScore >= 75 ? 'B' : overallScore >= 60 ? 'C' : overallScore >= 40 ? 'D' : 'F';
+    // S8 · score + grade come from the ONE shared aggregation (trust-scorer's
+    // aggregateTrust) — this block used to duplicate trust-command's reduce-and-
+    // cap and the badge could disagree with the report for the same target.
+    const { overallScore, grade, criticalCount, highCount, mediumCount, lowCount, totalFindings } = aggregateTrust(results);
+    // Same rule as trust-command: a score aggregated over zero files is not a clean scan.
+    const scanned = results.length > 0;
     const recommendation = criticalCount > 0
         ? `${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} need${criticalCount === 1 ? 's' : ''} attention before this merges.`
         : highCount > 0
             ? `Nothing critical, but ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} worth addressing.`
-            : overallScore >= 75
-                ? 'Clean scan. Nothing blocking a merge.'
-                : 'A few things to look at — nothing critical.';
+            : !scanned
+                ? 'No files scanned — nothing was graded.'
+                : overallScore >= 75
+                    ? 'Clean scan. Nothing blocking a merge.'
+                    : 'A few things to look at · nothing critical.';
     const report = {
         files: results,
+        scanned,
         overallScore,
         grade,
         totalFindings,
@@ -372,7 +388,7 @@ export async function executeReportCommand(target, options = {}) {
         newline();
         console.log(colors.dim(`  ${paths.length} files · score ${overallScore}/100 · grade ${grade}`));
         if (criticalCount > 0) {
-            console.log(colors.red(`  ${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} — check the report`));
+            console.log(colors.red(`  ${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} · check the report`));
         }
         newline();
         console.log(colors.dim('  Share it: paste it in your PR, add the badge to your README.'));

package/dist/presentation/cli/commands/scan-command.js

@@ -0,0 +1,52 @@
+/**
+ * CLI: scan — point codehere at an app, get the ONE thing that will get you hacked, in plain words.
+ * Deterministic (orchestrates gitleaks + semgrep), zero model tokens. The 60-second ship-readiness hook
+ * for non-experts (docs/PRODUCT_10X.md). Exit 1 when a critical blocker is found (CI-usable).
+ */
+import { resolve } from 'node:path';
+import { colors, symbols } from '../../../ui.js';
+import { shipScan } from '../../../infrastructure/security/ship-scan.js';
+export async function executeScanCommand(target, options = {}) {
+    const dir = resolve(target || '.');
+    const r = shipScan(dir);
+    if (options.json) {
+        process.stdout.write(JSON.stringify(r, null, 2) + '\n');
+        return r.top && r.top.tier === 'critical' ? 1 : 0;
+    }
+    if (r.missing.length) {
+        process.stdout.write(colors.dim(`(${r.missing.join(' + ')} not installed — coverage reduced. brew install ${r.missing.join(' ')})\n`));
+    }
+    if (r.failed.length) {
+        process.stdout.write(colors.dim(`(${r.failed.join(' + ')} did not finish — that part of the app went unscanned.)\n`));
+    }
+    if (!r.top) {
+        // Name the scanners that ACTUALLY ran. The old copy hardcoded "gitleaks + semgrep" and printed
+        // "Observed, not assumed" even when semgrep was absent or had timed out — the product asserting
+        // a scan it never performed, which is the exact failure it exists to catch elsewhere.
+        const ran = [r.ran.gitleaks && 'gitleaks', r.ran.semgrep && 'semgrep', 'codehere’s own checks'].filter(Boolean);
+        const partial = r.missing.length > 0 || r.failed.length > 0;
+        process.stdout.write('\n' +
+            // Green is for a clean pass at full coverage. A hole in coverage is not a pass, so it does not
+            // get the green — it gets a plain line that says what was and wasn't looked at.
+            (partial
+                ? `${symbols.info} No ship-blockers found in what was scanned`
+                : colors.success(`${symbols.success} No ship-blockers found`)) +
+            colors.dim(`  — ${ran.join(' + ')} ran on this app and nothing critical surfaced.\n` +
+                (partial ? `Coverage was incomplete, so this is not an all-clear.\n` : '') +
+                `Observed, not assumed. (Fast pass on what actually gets apps hacked — not a full audit.)\n\n`));
+        return 0;
+    }
+    const t = r.top;
+    const crit = r.findings.filter((f) => f.tier === 'critical').length;
+    const rest = r.findings.length - 1;
+    // THE ONE — consequence first, plain language (the EPAM lesson: surface + don't bury it).
+    process.stdout.write('\n' + colors.error(`${symbols.error} 1 thing will get you hacked:`) + '\n\n');
+    process.stdout.write(`  ${t.what}\n`);
+    process.stdout.write(colors.dim(`  → ${t.file}:${t.line}  (found by ${t.tool}: ${t.ruleId})\n\n`));
+    if (rest > 0) {
+        const alsoCrit = crit > 1 ? ` (${crit - 1} also critical)` : '';
+        process.stdout.write(colors.dim(`Plus ${rest} more issue${rest > 1 ? 's' : ''}${alsoCrit} — fix the one above first.\n\n`));
+    }
+    return 1; // not safe to ship
+}
+//# sourceMappingURL=scan-command.js.map

package/dist/presentation/cli/commands/scan-tool-command.js

@@ -16,8 +16,24 @@
  * Usage (by hook system, not user):
  *   echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' | codehere scan-tool
  */
-import { processHookEvent, appendOverrideAudit, } from '../../../infrastructure/hooks/claude-sdk-hook.js';
+import { processHookEvent, appendOverrideAudit, enableHookAuditQueue, flushHookAuditQueue, } from '../../../infrastructure/hooks/claude-sdk-hook.js';
+/** R1.2 · every exit path flushes the queued audit entries first: each is
+ *  offered to the daemon (250ms cap) and falls back to a direct append marked
+ *  writer:'hook-direct'. The flush itself never throws — the user's tool call
+ *  must never break or hang on audit plumbing (core value #5). */
+async function flushAndExit(code) {
+    try {
+        await flushHookAuditQueue();
+    }
+    catch {
+        /* fail-open */
+    }
+    process.exit(code);
+}
 export async function executeScanToolCommand(options) {
+    // R1.2 · queue mode: appends in this hook process buffer instead of writing,
+    // so the flush can offer them to the daemon (the sole-writer path).
+    enableHookAuditQueue();
     // Read all stdin
     let raw = '';
     try {
@@ -29,10 +45,10 @@ export async function executeScanToolCommand(options) {
         // If stdin read fails, allow the tool call — but log the override so
         // the audit trail records that the scanner didn't get a chance to run.
         appendOverrideAudit('stdin_read_failure');
-        process.exit(0);
+        return flushAndExit(0);
     }
     if (!raw.trim()) {
-        process.exit(0);
+        return flushAndExit(0);
     }
     // Parse event JSON
     let event;
@@ -49,7 +65,7 @@ export async function executeScanToolCommand(options) {
         if (options.debug) {
             process.stderr.write('[codehere] Warning: could not parse hook event JSON\n');
         }
-        process.exit(0);
+        return flushAndExit(0);
     }
     try {
         const decision = processHookEvent(event);
@@ -67,17 +83,17 @@ export async function executeScanToolCommand(options) {
                     process.stderr.write(`[codehere] Would block: ${decision.reason}\n`);
                 }
             }
-            process.exit(0);
+            return flushAndExit(0);
         }
         if (decision?.decision === 'block') {
             // Output block decision as JSON (Claude Code hook contract)
             process.stdout.write(JSON.stringify(decision) + '\n');
             // Also write to stderr for user visibility
             process.stderr.write(`\n${decision.reason}\n`);
-            process.exit(2); // non-zero exit = Claude Code treats as block signal
+            return flushAndExit(2); // non-zero exit = Claude Code treats as block signal
         }
         // Allow — exit 0 with no output
-        process.exit(0);
+        return flushAndExit(0);
     }
     catch {
         // Any scan failure: fail open (allow), never break developer workflow.
@@ -88,7 +104,7 @@ export async function executeScanToolCommand(options) {
             sessionId: event.session_id,
             toolName: event.tool_name,
         });
-        process.exit(0);
+        return flushAndExit(0);
     }
 }
 //# sourceMappingURL=scan-tool-command.js.map