codehere 0.8.0 → 1.0.1

package/dist/infrastructure/hooks/audit-tip-signature.js

@@ -0,0 +1,336 @@
+/**
+ * R2 · sign the live audit-chain TIP with the machine's persisted ed25519 key.
+ *
+ * The hash chain catches a NAIVE edit, but a determined attacker can edit a
+ * mid-chain entry and RE-WALK every later hash to produce a chain that verifies
+ * green (`computeEntryHash` is public). Signing the tip closes that for anyone
+ * who verifies with the public key: a re-walk changes the hash of the SIGNED
+ * entry, so the stored signature — made with a key the tamperer doesn't hold —
+ * no longer matches. Truncation below the signed point likewise fails.
+ *
+ * VERIFICATION IS AN ANCESTOR CHECK, not a tip-equality check (devil's-advocate
+ * audit 2026-06-09 caught the original tip-equality version false-alarming
+ * "tampered" on honest chains): the chain appends CONTINUOUSLY (every tool call,
+ * spawns, overrides) while signing happens at session completion — so the signed
+ * entry is usually an ANCESTOR of the live tip, and that is honest. Verification
+ * asserts the signed (seq, entryHash) still exists UNMODIFIED at that seq.
+ * Entries appended after the most recent signing are not yet covered — they're
+ * covered by the next completion's signature. The protected prefix only ever
+ * grows.
+ *
+ * `rm <audit>.tipsig` bypass (same audit): once a chain has EVER been signed, a
+ * missing signature file must BLOCK — otherwise the forger just deletes the
+ * sidecar. Sign-state lives in the keystore dir (`keys/audit-sign-state.json`),
+ * separate from the audit file, so an attacker who deletes the sidecar but not
+ * the keystore is caught. NOTE: sign-state is LOCAL-ONLY and path-keyed — it does
+ * NOT travel with an exported chain, so deleted-sidecar detection only works on
+ * the machine that signed; an exported/shared chain carries its `.tipsig` but a
+ * recipient can't tell it was ever signed if the sidecar is stripped. (An
+ * owner-level attacker who can also rewrite the keystore defeats this entirely —
+ * see HONEST SCOPE; the real fix is R1's daemon-held key + R3's external anchor.)
+ *
+ * R1 DOES NOT CLOSE THE OWNER GAP — evaluated 2026-08-08. A daemon-held key is
+ * still reachable by the owner, because the daemon runs as the owner. R1 raises
+ * the cost of the attack; it does not change who can defeat it. Only an EXTERNAL
+ * anchor does, and that collides head-on with local-first + zero telemetry: an
+ * anchor has to be outside the machine to be an anchor. Those two values are in
+ * direct tension and no amount of local cryptography resolves it.
+ *
+ * THE ANCHOR THAT FITS, and it needs no service of ours: the user's own git
+ * remote. `git notes --ref=codehere-audit` on HEAD carries the signed tip, and
+ * nothing leaves the machine until the USER pushes — which they were doing
+ * anyway. Proven end-to-end 2026-08-08 in a throwaway repo:
+ *   · the commit SHA is unchanged and the working tree stays clean (non-invasive)
+ *   · a history rewrite ORPHANS the note, so the rewrite is visible
+ *   · after the owner deletes the note locally, the REMOTE still holds it and a
+ *     reviewer can fetch it back and read the original tip hash
+ *   · erasing the remote copy needs an explicit destructive push, which shows up
+ *     in host audit logs / branch protection / anyone who already fetched
+ * So it converts "silently forgeable by the owner" into "forgeable only by a
+ * visible act on a third party the owner does not solely control" — the same
+ * standard a signed git commit gets, no more and no less. It is NOT
+ * cryptographic owner-proofing; nothing local-first can be. Known costs:
+ * refs/notes are not pushed by default (needs a refspec), and a user who never
+ * pushes has no witness. It also lands exactly on the PR surface.
+ * NOT BUILT — this is the evaluation, not the feature.
+ *
+ * HONEST SCOPE: this defends against a 3RD PARTY (or the owner sharing an export)
+ * editing the chain after it was signed. It does NOT defend against the agent or
+ * owner who CAN reach the signing key + keystore and re-sign / rewrite sign-state
+ * — that needs a daemon-held key the agent can't reach (R1) + an external anchor
+ * (R3). SIGNATURE-ORACLE limit (R1.3): a signature attests the daemon
+ * RECORDED the entry — never that the described tool call actually happened
+ * (any local process can POST an honest-shaped entry). Surface wording must
+ * stay "recorded-by-daemon"-shaped. The tip signature also TRANSITIVELY
+ * notarizes the whole prefix — including hook-direct entries and any
+ * well-chained same-uid direct append (even one carrying a forged
+ * writer:'daemon'; the endpoint's rejection binds only endpoint callers).
+ * Until R3 the honest words remain
+ * "integrity-checked" + "signed at
+ * write-time".
+ *
+ * Deliberately standalone (reads the chain from the file itself) so the audit
+ * hot-path in claude-sdk-hook.ts never has to import the signing stack — keeps
+ * the dependency graph acyclic.
+ */
+import { existsSync, readFileSync, writeFileSync, chmodSync, mkdirSync, openSync, fstatSync, readSync, closeSync, renameSync, } from 'fs';
+import { join } from 'path';
+import { sign as edSign, verify as edVerify } from 'crypto';
+import { loadOrCreateKeypair, keysDir } from '../orchestration/thread-key-store.js';
+import { exportPublicPem, importPublicPem, publicKeyToBase64, } from '../../application/use-cases/thread-export.js';
+/** Read the audit chain's current tip (last real line's seq + entryHash).
+ *  TAIL-READ (last 64KB), not a full-file read: sign-at-write (R1.3) calls
+ *  this per daemon append on a file with no rotation — a full read is O(N)
+ *  on the daemon event loop, measured 4-5ms on a 6.4MB chain vs 0.2ms for
+ *  the tail (refuter B2). The tip is by definition in the tail. */
+export function readAuditTip(auditFile) {
+    if (!existsSync(auditFile))
+        return null;
+    try {
+        const fd = openSync(auditFile, 'r');
+        let text;
+        try {
+            const size = fstatSync(fd).size;
+            const start = Math.max(0, size - 65536);
+            const buf = Buffer.alloc(size - start);
+            readSync(fd, buf, 0, buf.length, start);
+            text = buf.toString('utf-8');
+            if (start > 0)
+                text = text.slice(text.indexOf('\n') + 1); // drop partial first line
+        }
+        finally {
+            closeSync(fd);
+        }
+        const lines = text.trimEnd().split('\n');
+        for (let i = lines.length - 1; i >= 0; i--) {
+            const line = lines[i].trim();
+            if (!line)
+                continue;
+            const e = JSON.parse(line);
+            if (typeof e.seq === 'number' && typeof e.entryHash === 'string') {
+                return { seq: e.seq, entryHash: e.entryHash };
+            }
+            return null; // last real line is a pre-chain legacy entry → no tip to sign
+        }
+    }
+    catch {
+        /* unreadable / malformed → no tip */
+    }
+    return null;
+}
+/** Read the entry hash recorded at a given seq, or null if no such entry. */
+function readEntryHashAtSeq(auditFile, seq) {
+    if (!existsSync(auditFile))
+        return null;
+    try {
+        for (const line of readFileSync(auditFile, 'utf-8').split('\n')) {
+            const t = line.trim();
+            if (!t)
+                continue;
+            const e = JSON.parse(t);
+            if (e.seq === seq && typeof e.entryHash === 'string')
+                return e.entryHash;
+        }
+    }
+    catch {
+        /* malformed line mid-file → treat as not found (the chain verifier reports it) */
+    }
+    return null;
+}
+function tipSigPath(auditFile) {
+    return auditFile + '.tipsig';
+}
+function tipMessage(tip) {
+    return Buffer.from(`${tip.seq}:${tip.entryHash}`, 'utf-8');
+}
+function signStatePath() {
+    return join(keysDir(), 'audit-sign-state.json');
+}
+function loadSignState() {
+    try {
+        const raw = JSON.parse(readFileSync(signStatePath(), 'utf-8'));
+        if (raw && raw.schema === 1 && typeof raw.files === 'object')
+            return raw;
+    }
+    catch {
+        /* missing/corrupt → empty */
+    }
+    return { schema: 1, files: {} };
+}
+function recordSignState(auditFile, seq, signedAt) {
+    try {
+        mkdirSync(keysDir(), { recursive: true });
+        const state = loadSignState();
+        state.files[auditFile] = { seq, signedAt };
+        {
+            const tmpState = signStatePath() + '.tmp';
+            writeFileSync(tmpState, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+            renameSync(tmpState, signStatePath());
+        }
+    }
+    catch {
+        /* best-effort — sign-state is a detection aid, never blocks signing */
+    }
+}
+/** Was this audit file ever signed (per the keystore's sign-state)? */
+export function chainWasSigned(auditFile) {
+    return !!loadSignState().files[auditFile];
+}
+/**
+ * S9 · forget a chain's sign-state entry. ONLY for the mock practice chain:
+ * the daemon wipes the mock chain at boot, and without pruning, the stale
+ * sign-state key would flag the fresh chain as an rm-bypass (a false tamper
+ * alarm in practice mode) while dead keys accumulate in the REAL keystore.
+ * Never call this for a real chain — losing sign-state is losing detection.
+ */
+export function pruneSignState(auditFile) {
+    try {
+        const state = loadSignState();
+        if (!state.files[auditFile])
+            return;
+        delete state.files[auditFile];
+        const tmpState = signStatePath() + '.tmp';
+        writeFileSync(tmpState, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+        renameSync(tmpState, signStatePath());
+    }
+    catch {
+        /* best-effort — same contract as recordSignState */
+    }
+}
+// Cache the keypair per-process — loadOrCreateKeypair does disk I/O each call,
+// and signing happens repeatedly in a long-lived daemon.
+let cachedKeys = null;
+function keys() {
+    return (cachedKeys ??= loadOrCreateKeypair());
+}
+/**
+ * Sign the current chain tip, writing `<auditFile>.tipsig` + recording
+ * sign-state in the keystore. Best-effort: returns null (no-op) when there's
+ * no chain yet. Never throws.
+ */
+export function signAuditTip(auditFile, now = Date.now()) {
+    const tip = readAuditTip(auditFile);
+    if (!tip)
+        return null;
+    try {
+        const k = keys();
+        const sig = edSign(null, tipMessage(tip), k.privateKey).toString('base64');
+        const rec = {
+            schema: 1,
+            alg: 'ed25519',
+            seq: tip.seq,
+            entryHash: tip.entryHash,
+            sig,
+            pubPem: exportPublicPem(k.publicKey),
+            signedAt: now,
+        };
+        // Atomic (tmp+rename): per-write signing multiplies rewrite frequency
+        // ~1000x vs per-session — a crash mid-write must not leave a corrupt
+        // .tipsig that fails honest verification (refuter N1).
+        const tmpSig = tipSigPath(auditFile) + '.tmp';
+        writeFileSync(tmpSig, JSON.stringify(rec) + '\n', { mode: 0o600 });
+        renameSync(tmpSig, tipSigPath(auditFile));
+        try {
+            chmodSync(tipSigPath(auditFile), 0o600);
+        }
+        catch {
+            /* perms best-effort */
+        }
+        recordSignState(auditFile, tip.seq, now);
+        return rec;
+    }
+    catch {
+        return null; // signing must never break the path that called it
+    }
+}
+/**
+ * Verify the tip signature against the chain. The signed (seq, entryHash) must
+ * still be an UNMODIFIED ancestor of the current chain — appends since signing
+ * are honest and expected (signing happens at session completion; the chain
+ * grows continuously between completions). Pass `trustedKeys` to also check the
+ * signer is known.
+ */
+export function verifyAuditTip(auditFile, trustedKeys) {
+    const base = {
+        present: false,
+        expectedButMissing: false,
+        signatureValid: false,
+        ancestorIntact: false,
+        matchesTip: false,
+        trusted: false,
+        signerKeyB64: null,
+        reason: '',
+    };
+    if (!existsSync(tipSigPath(auditFile))) {
+        if (chainWasSigned(auditFile)) {
+            return {
+                ...base,
+                expectedButMissing: true,
+                reason: 'this chain was previously signed but the signature file is GONE — it may have been deleted to hide an edit',
+            };
+        }
+        return { ...base, reason: 'no tip signature on this chain' };
+    }
+    let rec;
+    try {
+        rec = JSON.parse(readFileSync(tipSigPath(auditFile), 'utf-8'));
+    }
+    catch {
+        return { ...base, present: true, reason: 'tip signature file is unreadable or corrupt' };
+    }
+    if (rec.alg !== 'ed25519' || typeof rec.entryHash !== 'string' || typeof rec.seq !== 'number') {
+        return { ...base, present: true, reason: 'tip signature is malformed' };
+    }
+    base.present = true;
+    let pub;
+    try {
+        pub = importPublicPem(rec.pubPem);
+    }
+    catch {
+        return { ...base, reason: 'tip signature carries an invalid public key' };
+    }
+    base.signerKeyB64 = publicKeyToBase64(pub);
+    base.trusted = !trustedKeys || trustedKeys.has(base.signerKeyB64);
+    try {
+        base.signatureValid = edVerify(null, tipMessage({ seq: rec.seq, entryHash: rec.entryHash }), pub, Buffer.from(rec.sig, 'base64'));
+    }
+    catch {
+        base.signatureValid = false;
+    }
+    const hashAtSeq = readEntryHashAtSeq(auditFile, rec.seq);
+    base.ancestorIntact = hashAtSeq !== null && hashAtSeq === rec.entryHash;
+    const tip = readAuditTip(auditFile);
+    base.matchesTip = !!tip && tip.seq === rec.seq && tip.entryHash === rec.entryHash;
+    if (!base.signatureValid)
+        base.reason = 'tip signature is invalid — forged or corrupt';
+    else if (!base.ancestorIntact)
+        base.reason =
+            'the signed entry is no longer intact in the chain — it was edited (re-walked) or truncated after signing';
+    else if (!base.trusted)
+        base.reason = 'chain is signed and intact, but by an untrusted key';
+    else if (base.matchesTip)
+        base.reason = "chain tip is signed and matches — no edits by anyone without this machine's key";
+    else
+        base.reason = `signed at seq ${rec.seq} · the chain has grown since · the signed prefix is intact`;
+    return base;
+}
+/**
+ * Does the tip-signature state BLOCK verification? Blocks when:
+ *  - sign-state says the chain was signed but the .tipsig is GONE (the
+ *    delete-the-sidecar bypass), or
+ *  - a signature is present but invalid, its signed entry is no longer an
+ *    intact ancestor (edit/re-walk/truncation), or the signer is untrusted
+ *    (an attacker re-signing a forgery with their OWN key would otherwise pass).
+ * A never-signed chain does not block (pre-R2 chains stay valid). Kept pure —
+ * this is the verdict the `audit verify` exit code depends on.
+ */
+export function tipBlocksVerification(tip) {
+    if (tip.expectedButMissing)
+        return true;
+    return tip.present && (!tip.signatureValid || !tip.ancestorIntact || !tip.trusted);
+}
+/** Reset the per-process key cache (tests). */
+export function __resetTipKeyCache() {
+    cachedKeys = null;
+}
+//# sourceMappingURL=audit-tip-signature.js.map

package/dist/infrastructure/hooks/claude-sdk-hook.js

@@ -15,7 +15,7 @@
  */
 import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, readSync, statSync, unlinkSync, } from 'fs';
 import { join } from 'path';
-import { homedir } from 'os';
+import { homedir, tmpdir } from 'os';
 import { createHash } from 'crypto';
 // P18 slice 2 — Tier 1 hook honors per-cwd permissions.yaml.
 import { filterAllowed } from '../security/permissions-config.js';
@@ -27,6 +27,18 @@ import { filterAllowed } from '../security/permissions-config.js';
  * two banks are scanned in different passes and counted separately.
  */
 export const PATTERNS = [
+    // Sensitive-destination writes (MED #18, atomic audit) · the Write/Edit
+    // scan payload carries ONLY the destination path (content is data) — but
+    // no pattern matched a bare path, so a Write straight at ~/.ssh/id_rsa
+    // scanned clean. Match the canonical credential/key destinations in a
+    // file_path-shaped payload. Path-only by design: a Bash command touching
+    // these is caught by the command patterns below.
+    {
+        regex: /file_path[^}]{0,200}?(\.ssh\/(id_[a-z0-9]+|authorized_keys|known_hosts)|\.aws\/credentials|\.gnupg\/|\.netrc|\.npmrc|\.pypirc|\.docker\/config\.json|\.kube\/config|\.git-credentials)/i,
+        severity: 'critical',
+        category: 'Sensitive File Write',
+        description: 'Write/Edit aimed at a credential or key file (~/.ssh, ~/.aws/credentials, …)',
+    },
     // Prompt Injection
     // Allow chained modifiers: "ignore all previous instructions", "ignore all your prior rules", etc.
     {
@@ -402,8 +414,20 @@ export function calculateRiskScore(findings) {
  * printed "Real ~/.codehere untouched" (the footer showed 162 entries · 51
  * agents in a brand-new home — all of them pollution from past mock runs).
  */
+/**
+ * S9 · practice mode leaves no marks: a CODEHERE_MOCK=1 process never writes
+ * the REAL audit chain. Mock isolated spend but not the chain — the atomic
+ * audit proved it by landing probe entries in ~/.codehere (seq ~11862). The
+ * mock chain lives at a STABLE tmp path (one sign-state key, not one per
+ * boot) and the daemon wipes it + prunes its sign-state key at boot, so
+ * every practice session starts clean and leaves zero residue. An explicit
+ * CODEHERE_AUDIT_FILE still wins (tests point it at their own scratch).
+ */
+export const MOCK_AUDIT_FILE = join(tmpdir(), 'codehere-mock', 'audit', 'hook-events.jsonl');
 export const AUDIT_FILE = process.env.CODEHERE_AUDIT_FILE ||
-    join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'audit', 'hook-events.jsonl');
+    (process.env.CODEHERE_MOCK === '1'
+        ? MOCK_AUDIT_FILE
+        : join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'audit', 'hook-events.jsonl'));
 const GENESIS_PREV_HASH = '0'.repeat(64);
 /**
  * Canonicalize an audit entry for hashing. We sort keys alphabetically and
@@ -520,7 +544,102 @@ export function readChainTip(filepath, tailBytes = 65536) {
     // Pathological: no chain entry in the tail window. Pay the full read.
     return readChainTipFull(filepath);
 }
+/**
+ * R1.2 · hook-process audit queue. The PreToolUse hook runs as its own
+ * process (codehere scan-tool); its DECISION path is synchronous, so it can't
+ * await the daemon there. Instead: the scan-tool command enables queue mode
+ * at start, every append in the hook process queues instead of writing, and
+ * the command FLUSHES before exit — each entry is offered to the daemon
+ * (POST /api/audit/append, 250ms abort so a hung daemon can never stall the
+ * user's tool call; connection-refused costs ~25ms in a fresh hook process —
+ * undici's lazy init — and <2ms warm) and falls back to the direct append
+ * marked writer:'hook-direct' (visible provenance, never silent). The abort
+ * is CLIENT-side: the daemon may have written before a timeout fired, so the
+ * fallback DEDUPES against the audit tail on (timestamp, sessionId, toolName)
+ * — one tool call must never mint two audit rows (refuter-demonstrated).
+ * Fail-open end to end per core value #5. Known durability delta: entries
+ * sit in memory between append and flush; a kill mid-flush can lose one —
+ * the old write-at-append path had no such window (accepted, bounded ≤2
+ * entries). The daemon process never enables queue mode.
+ */
+let hookQueueMode = false;
+const hookQueue = [];
+export function enableHookAuditQueue() {
+    hookQueueMode = true;
+}
+/** @internal test seam — inspect/clear the queue without flushing. */
+export function __testOnlyHookQueue() {
+    return hookQueue;
+}
+export async function flushHookAuditQueue(daemonUrl = 'http://127.0.0.1:3773') {
+    while (hookQueue.length > 0) {
+        const entry = hookQueue.shift();
+        let viaDaemon;
+        try {
+            const res = await fetch(daemonUrl + '/api/audit/append', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                // Declare which audit file this hook process is recording into. A
+                // daemon writing a DIFFERENT file (an isolated test, a second home)
+                // is not the right recorder for this entry — it 409s and we fall back
+                // direct, so routing can never silently divert entries to the wrong
+                // chain (caught by hook-e2e while a real daemon was live).
+                body: JSON.stringify({ ...entry, auditFile: AUDIT_FILE }),
+                signal: AbortSignal.timeout(250),
+            });
+            viaDaemon = res.ok;
+        }
+        catch {
+            viaDaemon = false; // daemon down / slow / refused — fall back, never throw
+        }
+        if (!viaDaemon) {
+            try {
+                if (!auditTailHas(entry)) {
+                    appendAuditLogDirect({ ...entry, writer: 'hook-direct' });
+                }
+            }
+            catch {
+                /* audit failure must never break the hook */
+            }
+        }
+    }
+}
+/** True if an entry with the same (timestamp, sessionId, toolName) is already
+ *  in the audit tail — the daemon may have written it before a client-side
+ *  abort/500. Scans the last 10 lines (same window as the daemon's confirm). */
+function auditTailHas(entry) {
+    try {
+        if (!existsSync(AUDIT_FILE))
+            return false;
+        const lines = readFileSync(AUDIT_FILE, 'utf-8').trim().split('\n');
+        for (let i = lines.length - 1; i >= 0 && i >= lines.length - 10; i--) {
+            try {
+                const e = JSON.parse(lines[i]);
+                if (e.timestamp === entry.timestamp && e.sessionId === entry.sessionId && e.toolName === entry.toolName) {
+                    return true;
+                }
+            }
+            catch {
+                /* skip malformed */
+            }
+        }
+    }
+    catch {
+        /* unreadable → treat as absent (the append itself is fail-open) */
+    }
+    return false;
+}
 export function appendAuditLog(entry) {
+    if (hookQueueMode) {
+        hookQueue.push(entry);
+        return;
+    }
+    appendAuditLogDirect(entry);
+}
+/** The direct writer — the DAEMON path uses this explicitly (it IS the sole
+ *  writer; queue mode must never be able to defer it, even if both layers
+ *  ever share a process — the embedded-server tests do exactly that). */
+export function appendAuditLogDirect(entry) {
     // Cross-process file locking. Multiple Claude Code sessions (e.g., two
     // terminals, or IDE + terminal) can trigger PreToolUse concurrently.
     // Without a lock, two hook processes read the same chain tip and both
@@ -612,6 +731,7 @@ export function verifyAuditChain(filepath = AUDIT_FILE) {
         totalEntries: 0,
         chainedEntries: 0,
         legacyEntries: 0,
+        writerMix: { daemon: 0, hookDirect: 0, unattributed: 0 },
         errors: [],
     };
     if (!existsSync(filepath))
@@ -621,6 +741,9 @@ export function verifyAuditChain(filepath = AUDIT_FILE) {
         content = readFileSync(filepath, 'utf-8');
     }
     catch {
+        // The log exists but can't be read — that is an unknown state, not "intact".
+        result.valid = false;
+        result.errors.push({ lineNumber: 0, reason: 'unreadable', detail: 'audit log exists but could not be read' });
         return result;
     }
     const lines = content.split('\n');
@@ -651,6 +774,13 @@ export function verifyAuditChain(filepath = AUDIT_FILE) {
             continue;
         }
         result.chainedEntries++;
+        const w = entry.writer;
+        if (w === 'daemon')
+            result.writerMix.daemon++;
+        else if (w === 'hook-direct')
+            result.writerMix.hookDirect++;
+        else
+            result.writerMix.unattributed++;
         // Recompute entryHash and check it matches what was stored
         const recomputed = computeEntryHash(entry);
         if (recomputed !== entry.entryHash) {
@@ -825,7 +955,7 @@ export function processHookEvent(event) {
         criticalFindings: criticalFindings.length,
     };
     if (allowed.length > 0) {
-        // Add to the audit row's toolInput JSON so /history can render
+        // Add to the audit row's toolInput JSON so the audit feed can render
         // "X findings allow-listed by permissions.yaml" badges later.
         try {
             const parsed = JSON.parse(auditEntry.toolInput);

package/dist/infrastructure/hooks/hook-mode.js

@@ -6,7 +6,11 @@
  *
  *   off       — no codehere scan-tool entry in PreToolUse
  *   log-only  — `codehere scan-tool --log-only`
- *   advisory  — reserved for future; not currently shipped
+ *   advisory  — DETECTION ONLY (LOW #20, atomic audit): getHookMode
+ *               recognizes a `--advisory` flag for forward-compat, but
+ *               scan-tool implements no advisory posture — a user writing
+ *               --advisory gets the DEFAULT block behavior while the nav
+ *               indicator would read 'advisory'. Don't advertise the flag.
  *   block     — `codehere scan-tool` (default critical/high block)
  *               OR `codehere scan-tool --block-all` (all severity levels)
  *
@@ -17,18 +21,30 @@
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
-const SETTINGS_PATH = join(homedir(), '.claude', 'settings.json');
+/**
+ * Resolve at call time, not at import.
+ *
+ * This was a module-level const, which froze the path to whatever HOME happened to be when the
+ * module first loaded. For a one-shot CLI that is harmless — HOME does not move mid-process —
+ * but it made the safety-mode read untestable against an isolated home, and the test that
+ * covered it compensated by writing to the developer's REAL ~/.claude/settings.json instead.
+ * A safety feature whose only test edits the user's live safety config is not covered, it is
+ * gambled with, and on CI (no ~/.claude at all) it failed outright.
+ *
+ * A function costs one stat call per invocation and makes the module honest under any HOME.
+ */
+const settingsPath = () => join(homedir(), '.claude', 'settings.json');
 /**
  * Detect the current safety-hook mode from ~/.claude/settings.json.
  * Defensive against missing / malformed settings — anything we can't
  * parse cleanly returns 'off' (the most-conservative read).
  */
 export function getHookMode() {
-    if (!existsSync(SETTINGS_PATH))
+    if (!existsSync(settingsPath()))
         return 'off';
     let parsed;
     try {
-        parsed = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8'));
+        parsed = JSON.parse(readFileSync(settingsPath(), 'utf-8'));
     }
     catch {
         return 'off';

package/dist/infrastructure/hooks/mirror-tool-call-to-audit.js

@@ -10,10 +10,11 @@
  * Future slices (per-adapter blocking) replace the post-hoc mirror
  * with pre-call intercepts. For now: visibility today, blocking next.
  */
-import { scanPayload, calculateRiskScore, appendAuditLog } from './claude-sdk-hook.js';
+import { scanPayload, calculateRiskScore, appendAuditLog, AUDIT_FILE } from './claude-sdk-hook.js';
+import { signAuditTip } from './audit-tip-signature.js';
 export function mirrorToolCallToAudit(rec) {
     // Run the same pattern bank the per-tool hook uses, so post-hoc
-    // findings show up in /history with the same severity calibration.
+    // findings show up in the audit feed with the same severity calibration.
     const findings = scanPayload(rec.toolInput);
     const riskScore = calculateRiskScore(findings);
     const truncated = rec.toolInput.length > 500 ? rec.toolInput.slice(0, 500) + '…' : rec.toolInput;
@@ -32,9 +33,14 @@ export function mirrorToolCallToAudit(rec) {
         blocked: false, // post-hoc — can't block, only log
         findings: findings.length,
         criticalFindings: findings.filter((f) => f.severity === 'critical').length,
+        // R1.5 · the mirror runs IN the daemon — stamp the provenance it promises.
+        writer: 'daemon',
     };
     try {
         appendAuditLog(entry);
+        // R1.3 · sign-at-write — the daemon's mirror is a daemon append; advance
+        // the signed tip per write (sub-ms, fail-open).
+        signAuditTip(AUDIT_FILE);
     }
     catch {
         // Audit-write failures don't propagate — the agent's already running.

package/dist/infrastructure/hooks/pre-prompt-scan.js

@@ -20,10 +20,10 @@
  *   off      → no scan, spawn proceeds
  *
  * Every scan writes one audit-log entry with synthetic toolName
- * 'pre_prompt' so the existing /history feed + hash chain pick it up
+ * 'pre_prompt' so the audit feed + hash chain pick it up
  * without surface changes.
  */
-import { scanPayload, calculateRiskScore, appendAuditLog, } from './claude-sdk-hook.js';
+import { scanPayload, calculateRiskScore, appendAuditLog } from './claude-sdk-hook.js';
 import { getHookMode } from './hook-mode.js';
 import { filterAllowed } from '../security/permissions-config.js';
 /**
@@ -58,7 +58,7 @@ export function scanPromptBeforeSpawn(input) {
     const wouldBlock = hardFindings.length > 0;
     const blocked = mode === 'block' && wouldBlock;
     // Audit entry — written for every scan, regardless of mode. Synthetic
-    // toolName 'pre_prompt' lets /history filter chips group these
+    // toolName 'pre_prompt' lets audit-feed filters group these
     // separately from per-tool entries (existing chip filters on tool).
     const entry = {
         timestamp: new Date().toISOString(),

package/dist/infrastructure/observability/execution-tracer.js

@@ -133,7 +133,7 @@ export class ExecutionTracer {
             const trace = run.traces[index];
             console.log(`\n[${index + 1}/${run.traces.length}] ${trace.operationType}: ${trace.operationName}`);
             if (trace.error) {
-                console.log(`  ⚠️  Original error: ${trace.error.message}`);
+                console.log(`  !  Original error: ${trace.error.message}`);
                 // Replay error trace
                 this.trace({
                     operationType: trace.operationType,