codehere 0.8.0 → 1.0.1

package/dist/application/use-cases/verify-claim.js

@@ -12,6 +12,9 @@
  *   - Report says "all tests green" but artifacts.tests.failed > 0 → MISMATCH
  *   - Report says "no files changed" but artifacts.files has entries → MISMATCH
  *   - Report says "5 files modified" but artifacts.files.length === 3 → MISMATCH
+ *   - Report says "Added subtract() to calc.js" and calc.js IS in the recorded
+ *     changes → VERIFIED (named-file claim, the dominant real-run shape)
+ *   - Report names a changed file the recorded changes don't include → WARN
  *
  * NOT a substitute for human review · this is a tripwire for the easy lies.
  * The verifier is intentionally conservative: only flag claims it can
@@ -43,13 +46,104 @@ export function verifyClaim(input) {
     const findings = [
         ...verifyTestsClaim(input.summary, input.artifacts),
         ...verifyFilesClaim(input.summary, input.artifacts),
+        ...verifyNamedFileClaims(input.summary, input.artifacts),
     ];
+    // Tier 1.1 · codehere RE-RAN the suite (observed) and it did NOT pass. This is
+    // a WARN, NOT a hard `broken` — a re-run can fail for reasons the agent's run
+    // didn't have (a monorepo where the root `npm test` is the wrong suite, a test
+    // needing a server/DB, a flaky test). A verifier that fails honest work is worse
+    // than no verifier. We ADD the env-caveat warn but do NOT touch any `fail` the
+    // scrape-based verifyTestsClaim already produced — a prose-vs-own-stdout
+    // self-contradiction stays `broken` (a real lie), the re-run failure is a
+    // separate, softer signal (self-audit 2026-06-09, fixing the over-correction
+    // that had laundered every re-run failure — including caught lies — to warn).
+    const obs = input.artifacts?.tests;
+    if (obs?.observed &&
+        ((obs.exitCode != null && obs.exitCode !== 0) || (obs.failed ?? 0) > 0) &&
+        !findings.some((f) => f.kind === 'tests' && f.severity === 'fail')) {
+        findings.push({
+            severity: 'warn',
+            kind: 'tests',
+            claim: 'the agent reported its run as done',
+            reality: `codehere re-ran ${obs.command || 'the test suite'} · exit ${obs.exitCode ?? '?'}, ${obs.failed ?? 0} failing`,
+            message: "codehere re-ran the suite and it did NOT pass — but a re-run can differ from the agent's environment (a monorepo's root suite, a test needing a server/DB). Worth a look, not a confirmed failure.",
+        });
+    }
     const hasFail = findings.some((f) => f.severity === 'fail');
     const hasNon = findings.length > 0;
-    const status = hasFail ? 'broken' : hasNon ? 'partial' : 'verified';
-    const summary = buildVerdictSummary(status, findings);
+    // user-#1 dogfood 2026-06-07 (session 4b6bc481): an aider run that did
+    // NOTHING produced a Final Report that was just the startup banner. The
+    // banner makes no test/file claim, so the verifier found zero findings and
+    // returned 'verified' — laundering a no-op into "claims match reality". When
+    // there are no findings AND the report made no checkable claim at all, there
+    // is nothing to verify; say so honestly instead of vacuously passing.
+    const status = hasFail
+        ? 'broken'
+        : hasNon
+            ? 'partial'
+            : hasCheckableClaim(input.summary, input.artifacts)
+                ? 'verified'
+                : 'nothing-to-verify';
+    // Was the green earned purely by codehere's own re-run (no agent prose claim)?
+    // If so, say that honestly instead of "Claims match reality" (there was no claim).
+    const observedOnly = status === 'verified' && findings.length === 0 && !proseMakesCheckableClaim(input.summary, input.artifacts);
+    const summary = buildVerdictSummary(status, findings, observedOnly);
     return { status, findings, summary };
 }
+/**
+ * True when the report makes at least one assertion the verifier can check
+ * against structured reality (a test claim or a file claim). If nothing is
+ * checkable, a green "verified" verdict would be vacuous — see status
+ * 'nothing-to-verify'.
+ */
+function hasCheckableClaim(summary, artifacts) {
+    // Tier 1.1 · a clean OBSERVED re-run is itself a fact codehere confirmed, so it
+    // earns 'verified' even if the prose phrased no claim (the green ✓ here means
+    // "codehere ran the suite and it passed" — observed, not the agent's word).
+    const ot = artifacts?.tests;
+    if (ot?.observed && (ot.exitCode == null || ot.exitCode === 0) && (ot.failed ?? 0) === 0)
+        return true;
+    return proseMakesCheckableClaim(summary, artifacts);
+}
+/**
+ * True when the REPORT PROSE itself asserts something checkable — a count, a
+ * named file that matches reality, or an "all green"/"no files changed"
+ * qualifier — independent of any observed re-run. Lets the verdict tell apart a
+ * green the AGENT earned with a real claim from one codehere produced purely by
+ * re-running the suite itself (so the summary doesn't say "Claims match reality"
+ * when there was no claim — R5 refuter, 2026-06-09).
+ */
+function proseMakesCheckableClaim(summary, artifacts) {
+    const lower = summary.toLowerCase();
+    if (matchTestCountClaim(summary) !== null)
+        return true;
+    if (matchFilesCountClaim(summary) !== null)
+        return true;
+    // Named-file claims ("Added subtract() to calc.js") count as checkable when
+    // the named file appears in the recorded file changes — the dominant shape
+    // of a REAL run's report (2026-06-07 v1 walk, session ab9cdcc9: a perfect
+    // run earned only "nothing to verify" because it phrased no numbers).
+    // A named file that does NOT match artifacts produced a warn finding in
+    // verifyNamedFileClaims, so status is 'partial' before this is consulted.
+    if (extractNamedFileClaims(summary).some((p) => fileMatchesArtifacts(p, artifacts)))
+        return true;
+    // Universal "all tests pass / green / no failures" qualifiers.
+    if (/\b(?:all|every|each)\s+tests?\s+(?:pass(?:ed|ing)?|green|succeed(?:ed)?)\b/i.test(lower) ||
+        /\btests?\s+all\s+(?:pass(?:ed|ing)?|green)\b/i.test(lower) ||
+        /\ball\s+(?:tests?\s+)?(?:green|passing)\b/i.test(lower) ||
+        /\bno\s+(?:test\s+)?(?:failures|regressions?)\b/i.test(lower))
+        return true;
+    // "no files changed / read-only / nothing written" claims. Deliberate: a
+    // no-op run that SAYS "no files were changed" gets 'verified' (the claim is
+    // true and checked against reality), not 'nothing-to-verify'. The vacuous
+    // green this function kills is the report that claims NOTHING (e.g. a bare
+    // startup banner) — an honest no-op claim is exactly what verification is for.
+    if (/\bno\s+files?\s+(were\s+)?(changed|modified|touched|written|created)\b/i.test(summary) ||
+        /\bsession\s+was\s+read-only\b/i.test(summary) ||
+        /\bnothing\s+(was\s+)?(written|changed|modified)\b/i.test(summary))
+        return true;
+    return false;
+}
 /* ──────────────────────────────────────────────────────────────────────── */
 /* Tests claim verification                                                  */
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -61,7 +155,14 @@ export function verifyClaim(input) {
 export function verifyTestsClaim(summary, artifacts) {
     const out = [];
     const lower = summary.toLowerCase();
-    const tests = artifacts?.tests;
+    // Check the prose against the AGENT'S OWN scraped numbers. When codehere
+    // re-ran (observed), `artifacts.tests` holds the re-run result and the original
+    // scrape is preserved in `.claimed` — use the scrape here so a prose-vs-own-run
+    // self-contradiction ("all pass" while its own stdout showed failures) is still
+    // caught as a real lie, separate from a re-run that fails on an env difference
+    // (handled as a warn in verifyClaim). Self-audit 2026-06-09.
+    const scrape = artifacts?.tests?.claimed;
+    const tests = scrape ? { passed: scrape.passed, failed: scrape.failed } : artifacts?.tests;
     // Extract numeric "X tests passed" / "X passed" / "X of Y" patterns.
     // We deliberately keep the regex tight to avoid false positives on prose
     // like "this is the 5th attempt".
@@ -242,6 +343,69 @@ export function verifyFilesClaim(summary, artifacts) {
     }
     return out;
 }
+/* ──────────────────────────────────────────────────────────────────────── */
+/* Named-file claims · "Added subtract() to calc.js"                         */
+/* ──────────────────────────────────────────────────────────────────────── */
+// Library/runtime names that look like files but never are ("migrated to
+// Next.js", "Node.js 20"). Skipped to keep the tripwire conservative.
+const NON_FILE_NAMES = /^(node|next|vue|react|express|d3|three|angular|nuxt|deno|bun|ember|backbone)\.js$/i;
+/**
+ * Extract file paths the report claims to have CHANGED — an edit verb followed
+ * (within the same sentence) by a path-shaped token. Deliberately verb-gated:
+ * "read calc.js" or a bare mention is NOT a change claim.
+ */
+export function extractNamedFileClaims(summary) {
+    const out = new Set();
+    const re = /\b(?:added|created|wrote|modified|updated|changed|edited|fixed|patched|refactored|renamed|implemented|extended)\b[^.!?\n]{0,80}?`?([\w][\w./-]*\.[A-Za-z0-9]{1,8})(?::\d+)?`?/gi;
+    let m;
+    while ((m = re.exec(summary)) !== null) {
+        const path = m[1];
+        if (NON_FILE_NAMES.test(path))
+            continue;
+        out.add(path);
+    }
+    return [...out];
+}
+/** True when a claimed path matches a recorded file change (exact, suffix, or basename). */
+function fileMatchesArtifacts(claimPath, artifacts) {
+    if (!artifacts?.files?.length)
+        return false;
+    // LOW #26 (atomic audit) · the bare-basename fallback only applies when the
+    // CLAIM is a bare basename. A directory-qualified claim ('src/a/calc.js')
+    // must not green-match a same-named file elsewhere ('lib/b/calc.js').
+    const claimIsBare = !claimPath.includes('/');
+    return artifacts.files.some((f) => {
+        const p = f.path ?? '';
+        if (p === claimPath || p.endsWith('/' + claimPath) || claimPath.endsWith('/' + p))
+            return true;
+        return claimIsBare && (p.split('/').pop() ?? p) === claimPath;
+    });
+}
+/**
+ * Tripwire side of named-file claims: the report says it changed a specific
+ * file but the recorded changes don't include it. Warn, not fail — the token
+ * might be a tool/library mention the verb regex over-read; the count/no-files
+ * checks above own the hard contradictions.
+ */
+export function verifyNamedFileClaims(summary, artifacts) {
+    if (artifacts?.files === undefined)
+        return []; // can't check (e.g. non-git cwd) — stays unverifiable
+    const out = [];
+    for (const path of extractNamedFileClaims(summary)) {
+        if (!fileMatchesArtifacts(path, artifacts)) {
+            out.push({
+                severity: 'warn',
+                kind: 'files',
+                claim: `changed ${path}`,
+                reality: artifacts.files.length === 0
+                    ? 'no file changes recorded'
+                    : `recorded changes: ${artifacts.files.map((f) => f.path).join(', ')}`,
+                message: `Final Report says it changed ${path} but the recorded file changes don't include it.`,
+            });
+        }
+    }
+    return out;
+}
 function matchFilesCountClaim(summary) {
     // "X files changed" / "X files modified" / "X files were touched"
     const m1 = summary.match(/\b(\d+)\s+files?\s+(were\s+)?(?:changed|modified|touched|written|created|added|updated)\b/i);
@@ -253,14 +417,32 @@ function matchFilesCountClaim(summary) {
         return { quote: m2[0], value: parseInt(m2[1], 10) };
     return null;
 }
+/**
+ * The "verified requires git" SURFACE invariant, single-sourced (R11 / M2).
+ * A rendered verifier panel must never show 'verified' while its git-tracked
+ * flag is off: without git-tracked artifacts the file-claims are unverifiable
+ * (see verifyNamedFileClaims's undefined-files early-return above), so a green
+ * "verified" there would be an overclaim. The /verify dogfood page (H1 in
+ * verify-page.ts) interpolates THIS function's compiled source into its client
+ * script and executes it — it no longer re-encodes the rule, so the rule can't
+ * drift between the engine and the harness. Keep it self-contained (no captured
+ * scope, no imports) — its .toString() must run standalone in a browser.
+ */
+export function violatesGitInvariant(verdict, gitTracked) {
+    return verdict === 'verified' && !gitTracked;
+}
 /* ──────────────────────────────────────────────────────────────────────── */
 /* Verdict summary                                                           */
 /* ──────────────────────────────────────────────────────────────────────── */
-function buildVerdictSummary(status, findings) {
+function buildVerdictSummary(status, findings, observedOnly = false) {
     if (status === 'verified')
-        return 'Claims match the recorded reality. No gaps detected.';
+        return observedOnly
+            ? "codehere re-ran the test suite and it passed — observed by codehere, not just the agent's word."
+            : 'Claims match the recorded reality. No gaps detected.';
     if (status === 'no-report')
         return 'No Final Report to verify.';
+    if (status === 'nothing-to-verify')
+        return "The report makes no checkable claim, so there's nothing to verify against the recorded reality.";
     const failCount = findings.filter((f) => f.severity === 'fail').length;
     const warnCount = findings.filter((f) => f.severity === 'warn').length;
     if (failCount > 0 && warnCount > 0) {

package/dist/domain/audit.js

@@ -0,0 +1,11 @@
+/**
+ * Domain types for the tamper-evident-aspiring audit chain.
+ *
+ * These are pure data shapes — no I/O, no clock, no dependencies. They live in
+ * `domain/` (not `infrastructure/hooks/`) so the dependency rule points inward:
+ * the hook, the daemon, and the use-cases all import these DOWN from domain,
+ * rather than reaching up into a hook file for the core vocabulary.
+ * Moved here 2026-06-09 (spec R14 / ARCHITECTURE.md M1).
+ */
+export {};
+//# sourceMappingURL=audit.js.map

package/dist/domain/services/codebase-detector.js

@@ -82,10 +82,4 @@ function findPackageRoot(startPath) {
     }
     return null;
 }
-/**
- * Get codebase info for a given file path
- */
-export function getCodebaseForFile(filepath) {
-    return findCodebaseRoot(dirname(filepath));
-}
 //# sourceMappingURL=codebase-detector.js.map

package/dist/domain/task.js

@@ -0,0 +1,91 @@
+/**
+ * Domain types for a task's observable shape — status, progress steps, and the
+ * end-of-task artifacts. Pure data: no I/O, no behavior, no dependencies. These
+ * live in `domain/` so application + infrastructure import them DOWN, rather than
+ * reaching up into an adapter file for the core vocabulary.
+ * Moved here 2026-06-09 (spec R14 / ARCHITECTURE.md M1) from
+ * infrastructure/orchestration/agent-adapter.ts. The `TaskSession` runtime handle
+ * (which has behavior: subscribe/kill/appendMessage) and the `AgentAdapter` port
+ * stay with the adapters; only the pure data shapes move here.
+ */
+/**
+ * R13/M3 — THE one owned transition for `artifacts.tests`. Before this, the
+ * exit-path re-run mutated the artifact inline in the session manager: the
+ * exit-code-authoritative merge, the claim-preservation rule, and the
+ * silent-blank-when-unobservable gap all lived in untyped infra code. This is
+ * now the only writer of the post-exit tests artifact.
+ *
+ * Mutates `artifacts` IN PLACE by design: the live TaskSession exposes
+ * `artifacts` as a readonly getter over one shared object that the API layer
+ * re-reads each poll — replacing the reference would detach the live verdict.
+ *
+ * Rules (verbatim from the prior inline code, now pinned by unit tests):
+ *  - exit code is authoritative: a non-zero exit with no parseable count still
+ *    forces failed >= 1, so a "tests pass" claim that didn't pass gets caught;
+ *  - the agent's ORIGINAL scrape is preserved as `claimed` so the verifier can
+ *    still catch a prose-vs-own-stdout self-contradiction;
+ *  - couldn't run → the explicit reason lands in `testsUnobserved` instead of
+ *    leaving the artifact silently blank (the R5 leftover).
+ */
+export function applyTestObservation(artifacts, observation) {
+    if (!observation.ran) {
+        artifacts.testsUnobserved = observation.skippedReason ?? 'could not re-run the tests';
+        return 'unobserved';
+    }
+    const claimed = artifacts.tests;
+    let failed = observation.failed ?? 0;
+    if (observation.exitCode !== 0 && failed === 0)
+        failed = 1;
+    // LOW #28 (atomic audit) · exit 0 with no parseable count reuses the
+    // AGENT'S claimed number. The exit code is ground truth (the suite ran and
+    // passed) but the COUNT is not — say which is which (countSource) so the
+    // surface can label "re-run ✓ · count as reported" instead of implying the
+    // number itself was observed.
+    const countParsed = observation.passed !== undefined;
+    const passed = observation.passed ?? (observation.exitCode === 0 ? (claimed?.passed ?? 0) : 0);
+    artifacts.tests = {
+        passed,
+        failed,
+        observed: true,
+        ...(countParsed ? {} : { countSource: 'claimed' }),
+        ...(claimed ? { claimed: { passed: claimed.passed, failed: claimed.failed } } : {}),
+        ...(observation.command ? { command: observation.command } : {}),
+        ...(observation.exitCode !== undefined ? { exitCode: observation.exitCode } : {}),
+        ...(observation.durationMs !== undefined ? { durationMs: observation.durationMs } : {}),
+    };
+    delete artifacts.testsUnobserved; // an observed result supersedes any earlier couldn't-observe
+    return 'observed';
+}
+/** Derive the typed completeness view from a session's recorded parts. */
+export function describeCompleted(input) {
+    const a = input.artifacts;
+    return {
+        sessionId: input.sessionId,
+        agent: input.agent,
+        status: input.status,
+        completedAt: input.completedAt,
+        durationMs: input.durationMs,
+        steps: input.steps ?? [],
+        files: a?.files
+            ? { present: a.files }
+            : {
+                absent: a?.noGitTracking
+                    ? "ran in a non-git folder — codehere can't see what changed"
+                    : 'no file changes recorded',
+            },
+        tests: a?.tests
+            ? { present: a.tests }
+            : { absent: a?.testsUnobserved ?? 'not test-relevant — no claim made, no test files touched' },
+        report: input.finalReport?.summary
+            ? { present: { summary: input.finalReport.summary } }
+            : { absent: input.failedReport ? 'report generation failed' : 'no written report' },
+        audit: input.auditRecon
+            ? { present: input.auditRecon }
+            : {
+                // Precise: reconciliation RUNS in the daemon at completion but is
+                // held in memory, not persisted — so a later reader can't see it.
+                absent: 'reconciliation not visible here — it runs in the daemon that observed the exit and is not persisted',
+            },
+    };
+}
+//# sourceMappingURL=task.js.map

package/dist/error-handler.js

@@ -1,6 +1,5 @@
 /**
- * Enterprise-Grade Error Handling & Recovery System
- * Ensures 24/7 operation with automatic recovery
+ * Error classification + circuit breaker for API calls.
  */
 export var ErrorType;
 (function (ErrorType) {
@@ -73,104 +72,17 @@ export function classifyError(error) {
     // Default to retryable
     return ErrorType.RETRYABLE;
 }
-/**
- * Check if error is retryable
- * Rate limit errors (429) should NOT be retried - they indicate quota exceeded
- */
-export function isRetryable(error) {
-    // Check for 429 status code directly - don't retry monthly quota limits
-    if (error && typeof error === 'object') {
-        const err = error;
-        // Cohere SDK error structure
-        if (err.statusCode === 429 || err.status === 429) {
-            return false; // Monthly quota exceeded - retrying won't help
-        }
-        // Check error name/class (Cohere SDK uses TooManyRequestsError)
-        const errorName = err.constructor?.name || err.name || '';
-        if (errorName.includes('TooManyRequests') || errorName === 'TooManyRequestsError') {
-            return false;
-        }
-        // Check error message for trial key limit message
-        const errorMsg = err.message || String(err);
-        if (errorMsg.includes('Trial key') && errorMsg.includes('1000 API calls')) {
-            return false; // Monthly quota exceeded
-        }
-    }
-    const errorType = classifyError(error);
-    // Don't retry rate limit errors - they indicate quota/limit exceeded
-    if (errorType === ErrorType.RATE_LIMIT) {
-        return false;
-    }
-    return [ErrorType.RETRYABLE, ErrorType.NETWORK, ErrorType.API_ERROR].includes(errorType);
-}
-/**
- * Calculate exponential backoff delay
- */
-export function calculateBackoff(attempt, baseDelay = 1000, maxDelay = 60000) {
-    const delay = Math.min(baseDelay * Math.pow(2, attempt), maxDelay);
-    // Add jitter to prevent thundering herd
-    const jitter = Math.random() * 0.3 * delay;
-    return Math.floor(delay + jitter);
-}
-/**
- * Retry with exponential backoff
- */
-export async function retryWithBackoff(operation, options = {}) {
-    const { maxRetries = 5, baseDelay = 1000, maxDelay = 60000, operationName = 'operation', onRetry } = options;
-    let lastError;
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-        try {
-            return await operation();
-        }
-        catch (error) {
-            lastError = error;
-            // Don't retry on fatal errors
-            if (!isRetryable(error)) {
-                throw new EnterpriseError(`Fatal error in ${operationName}: ${error instanceof Error ? error.message : String(error)}`, classifyError(error), {
-                    operation: operationName,
-                    attempt,
-                    maxRetries,
-                    timestamp: new Date().toISOString(),
-                    errorType: classifyError(error),
-                    originalError: error instanceof Error ? error : new Error(String(error)),
-                }, false);
-            }
-            // Last attempt, throw error
-            if (attempt === maxRetries) {
-                break;
-            }
-            // Calculate delay and wait
-            const delay = calculateBackoff(attempt, baseDelay, maxDelay);
-            if (onRetry) {
-                onRetry(attempt + 1, error);
-            }
-            await new Promise((resolve) => setTimeout(resolve, delay));
-        }
-    }
-    // All retries exhausted
-    throw new EnterpriseError(`Operation ${operationName} failed after ${maxRetries} retries: ${lastError instanceof Error ? lastError.message : String(lastError)}`, classifyError(lastError), {
-        operation: operationName,
-        attempt: maxRetries,
-        maxRetries,
-        timestamp: new Date().toISOString(),
-        errorType: classifyError(lastError),
-        originalError: lastError instanceof Error ? lastError : new Error(String(lastError)),
-    }, false);
-}
 /**
  * Circuit breaker pattern for API calls
  */
 export class CircuitBreaker {
     threshold;
-    timeout;
     resetTimeout;
     failures = 0;
     lastFailureTime = 0;
     state = 'CLOSED';
-    constructor(threshold = 5, timeout = 60000, // 1 minute
-    resetTimeout = 30000) {
+    constructor(threshold = 5, resetTimeout = 30000) {
         this.threshold = threshold;
-        this.timeout = timeout;
         this.resetTimeout = resetTimeout;
     }
     async execute(operation) {
@@ -223,29 +135,5 @@ export class CircuitBreaker {
 /**
  * Global circuit breaker for Cohere API
  */
-export const cohereCircuitBreaker = new CircuitBreaker(5, 60000, 30000);
-/**
- * Graceful error handler with recovery strategies
- */
-export function handleError(error, context) {
-    const errorType = classifyError(error);
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    const fullContext = {
-        operation: context.operation || 'unknown',
-        filepath: context.filepath,
-        attempt: context.attempt,
-        maxRetries: context.maxRetries,
-        timestamp: new Date().toISOString(),
-        errorType,
-        originalError: error instanceof Error ? error : new Error(errorMessage),
-        metadata: context.metadata,
-    };
-    // Log error with full context
-    console.error('Enterprise Error:', {
-        message: errorMessage,
-        type: errorType,
-        context: fullContext,
-    });
-    throw new EnterpriseError(errorMessage, errorType, fullContext, isRetryable(error));
-}
+export const cohereCircuitBreaker = new CircuitBreaker(5, 30000);
 //# sourceMappingURL=error-handler.js.map