codehere 0.8.0 → 1.0.2

package/dist/infrastructure/context/oauth-flow.js

@@ -1,207 +0,0 @@
-/**
- * OAuth 2.0 + PKCE flow for context-source providers (v0.8 S2.5).
- *
- * Provider-agnostic state machine that handles the four steps of the
- * code-grant flow with PKCE (RFC 7636) so we don't need a client secret on
- * the user's machine:
- *
- *   1. begin(provider)          · build authorize URL · stash state + verifier
- *   2. (browser) user approves  · provider redirects to our callback
- *   3. complete(code, state)    · exchange code for {access_token, refresh_token, user}
- *   4. refresh(refresh_token)   · swap for a fresh access_token
- *
- * Tokens persist in ~/.codehere/context-sources.json (the same file manual
- * configs use). User can revoke from the provider's web UI any time; our
- * disconnect command just deletes the local config.
- *
- * Provider client IDs come from env vars (CODEHERE_LINEAR_CLIENT_ID,
- * CODEHERE_FIGMA_CLIENT_ID) so binaries can ship without secrets baked in.
- * The codehere app registrations are public client IDs · PKCE removes the
- * need for a client secret on the user's machine. Anyone running codehere
- * locally uses the same `codehere-local` app at each provider, no per-user
- * registration needed.
- *
- * IMPORTANT · this module is pure logic. All I/O (httpPost, filesystem,
- * clock) is injected. The daemon's HTTP route at /oauth/callback supplies
- * the production wiring (registry-bootstrap.ts) and tests use mocks.
- */
-import { createHash, randomBytes } from 'crypto';
-const DEFAULT_REDIRECT = 'http://127.0.0.1:3773/oauth/callback';
-export const PROVIDERS = {
-    linear: {
-        id: 'linear',
-        label: 'Linear',
-        authorizeUrl: 'https://linear.app/oauth/authorize',
-        tokenUrl: 'https://api.linear.app/oauth/token',
-        scopes: ['read'],
-        clientIdEnv: 'CODEHERE_LINEAR_CLIENT_ID',
-        redirectUri: DEFAULT_REDIRECT,
-        tokenPostMode: 'form',
-        userInfoUrl: 'https://api.linear.app/graphql', // POST { query: '{ viewer { name email } }' }
-    },
-    figma: {
-        id: 'figma',
-        label: 'Figma',
-        authorizeUrl: 'https://www.figma.com/oauth',
-        tokenUrl: 'https://api.figma.com/v1/oauth/token',
-        scopes: ['file_read'],
-        clientIdEnv: 'CODEHERE_FIGMA_CLIENT_ID',
-        redirectUri: DEFAULT_REDIRECT,
-        tokenPostMode: 'form',
-        userInfoUrl: 'https://api.figma.com/v1/me',
-    },
-};
-export function listProviders() {
-    return Object.values(PROVIDERS);
-}
-export function getProvider(id) {
-    return PROVIDERS[id];
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* PKCE helpers                                                              */
-/* ──────────────────────────────────────────────────────────────────────── */
-function base64UrlEncode(buf) {
-    return buf.toString('base64').replace(/=+$/, '').replace(/\+/g, '-').replace(/\//g, '_');
-}
-/** Random 43-128 char string · we pick 64 bytes (86 chars after b64url). */
-export function generateCodeVerifier() {
-    return base64UrlEncode(randomBytes(64));
-}
-export function deriveCodeChallenge(verifier) {
-    return base64UrlEncode(createHash('sha256').update(verifier).digest());
-}
-/** Opaque CSRF defense · returned by provider unchanged · we verify on callback. */
-export function generateState() {
-    return base64UrlEncode(randomBytes(24));
-}
-export function begin(provider, ctx) {
-    if (!ctx.clientId) {
-        return { kind: 'not_registered', provider: provider.id, envVar: provider.clientIdEnv };
-    }
-    const codeVerifier = ctx.rng?.verifier() ?? generateCodeVerifier();
-    const codeChallenge = deriveCodeChallenge(codeVerifier);
-    const state = ctx.rng?.state() ?? generateState();
-    const startedAt = ctx.now ? ctx.now() : Date.now();
-    const params = new URLSearchParams({
-        response_type: 'code',
-        client_id: ctx.clientId,
-        redirect_uri: provider.redirectUri,
-        scope: provider.scopes.join(' '),
-        state,
-        code_challenge: codeChallenge,
-        code_challenge_method: 'S256',
-    });
-    return {
-        authorizeUrl: `${provider.authorizeUrl}?${params.toString()}`,
-        pending: { provider: provider.id, state, codeVerifier, startedAt },
-    };
-}
-export async function complete(code, state, ctx) {
-    const pending = ctx.pending.get(state);
-    if (!pending) {
-        return { kind: 'state_unknown', detail: `no pending flow for state '${state.slice(0, 8)}...'` };
-    }
-    ctx.pending.delete(state); // single-use
-    const provider = getProvider(pending.provider);
-    if (!provider) {
-        return { kind: 'state_unknown', detail: `unknown provider '${pending.provider}'` };
-    }
-    const maxAge = ctx.maxAgeMs ?? 10 * 60 * 1000;
-    const now = ctx.now ? ctx.now() : Date.now();
-    if (now - pending.startedAt > maxAge) {
-        return { kind: 'state_expired', detail: `pending flow older than ${Math.round(maxAge / 1000)}s` };
-    }
-    if (!ctx.clientId) {
-        return { kind: 'not_registered', detail: provider.clientIdEnv };
-    }
-    const params = new URLSearchParams({
-        grant_type: 'authorization_code',
-        code,
-        redirect_uri: provider.redirectUri,
-        client_id: ctx.clientId,
-        code_verifier: pending.codeVerifier,
-    });
-    const headers = {
-        'Content-Type': 'application/x-www-form-urlencoded',
-        Accept: 'application/json',
-    };
-    const res = await ctx.httpPost(provider.tokenUrl, params.toString(), headers);
-    if (res.status !== 200) {
-        return {
-            kind: 'provider_error',
-            detail: `${provider.label} token endpoint returned ${res.status}: ${res.body.slice(0, 200)}`,
-        };
-    }
-    let payload;
-    try {
-        payload = JSON.parse(res.body);
-    }
-    catch (err) {
-        return {
-            kind: 'parse_error',
-            detail: `token response not JSON: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-    if (!payload.access_token) {
-        return { kind: 'parse_error', detail: 'token response missing access_token' };
-    }
-    const token = {
-        provider: provider.id,
-        accessToken: payload.access_token,
-        refreshToken: payload.refresh_token,
-        expiresAt: typeof payload.expires_in === 'number' ? now + payload.expires_in * 1000 : null,
-        scope: payload.scope ?? provider.scopes.join(' '),
-    };
-    // Best-effort user-info fetch · failure here doesn't undo the connect
-    if (ctx.fetchUserInfo && provider.userInfoUrl) {
-        try {
-            const u = await ctx.fetchUserInfo(token.accessToken, provider.userInfoUrl);
-            if (u) {
-                const label = u.email || u.name;
-                if (label)
-                    token.userLabel = label;
-            }
-        }
-        catch {
-            // ignore · token is valid, user label is decoration
-        }
-    }
-    return token;
-}
-export async function refresh(provider, refreshToken, ctx) {
-    if (!ctx.clientId)
-        return { kind: 'not_registered', detail: provider.clientIdEnv };
-    const params = new URLSearchParams({
-        grant_type: 'refresh_token',
-        refresh_token: refreshToken,
-        client_id: ctx.clientId,
-    });
-    const res = await ctx.httpPost(provider.tokenUrl, params.toString(), {
-        'Content-Type': 'application/x-www-form-urlencoded',
-        Accept: 'application/json',
-    });
-    if (res.status !== 200) {
-        return { kind: 'provider_error', detail: `${provider.label} refresh returned ${res.status}` };
-    }
-    let payload;
-    try {
-        payload = JSON.parse(res.body);
-    }
-    catch (err) {
-        return {
-            kind: 'parse_error',
-            detail: `refresh response not JSON: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-    if (!payload.access_token)
-        return { kind: 'parse_error', detail: 'refresh missing access_token' };
-    const now = ctx.now ? ctx.now() : Date.now();
-    return {
-        provider: provider.id,
-        accessToken: payload.access_token,
-        refreshToken: payload.refresh_token ?? refreshToken,
-        expiresAt: typeof payload.expires_in === 'number' ? now + payload.expires_in * 1000 : null,
-        scope: payload.scope ?? null,
-    };
-}
-//# sourceMappingURL=oauth-flow.js.map

package/dist/infrastructure/context/oauth-store.js

@@ -1,119 +0,0 @@
-/**
- * OAuth token storage · v0.8 S2.5.
- *
- * Persists OAuth tokens to ~/.codehere/context-sources.json next to manual
- * configs. File shape evolved · backward-compatible:
- *
- *   {
- *     "linear": {
- *       "apiKey": "...",                  // manual mode · still supported
- *       "oauth": {                        // OAuth mode · NEW
- *         "accessToken": "...",
- *         "refreshToken": "...",
- *         "expiresAt": 1700000000000,
- *         "scope": "read",
- *         "userLabel": "ega@example.com",
- *         "connectedAt": 1700000000000
- *       }
- *     },
- *     "figma": { ... }
- *   }
- *
- * The linear-source / figma-source adapters read EITHER apiKey OR
- * oauth.accessToken (in S3 we'll merge them under one access path; for now
- * S2.5 just lands the storage shape so the OAuth flow has somewhere to put
- * the token).
- *
- * File permissions · 0600 on write so a multi-user machine can't read each
- * other's tokens.
- */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { homedir } from 'os';
-import { dirname, join } from 'path';
-function configPath() {
-    const home = process.env.CODEHERE_HOME || homedir();
-    return join(home, '.codehere', 'context-sources.json');
-}
-export function readAllConfig(path) {
-    const target = path ?? configPath();
-    if (!existsSync(target))
-        return {};
-    try {
-        const raw = readFileSync(target, 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (typeof parsed !== 'object' || parsed === null)
-            return {};
-        return parsed;
-    }
-    catch {
-        return {};
-    }
-}
-function writeAllConfig(cfg, path) {
-    const target = path ?? configPath();
-    mkdirSync(dirname(target), { recursive: true });
-    writeFileSync(target, JSON.stringify(cfg, null, 2) + '\n', 'utf-8');
-    try {
-        chmodSync(target, 0o600);
-    }
-    catch {
-        // chmod can fail on FATs · the local-first promise still holds; we just
-        // can't enforce 0600. Real-world users on macOS/Linux always succeed.
-    }
-}
-/** Persist a freshly-minted OAuth token for the given provider. */
-export function saveToken(token, path) {
-    const cfg = readAllConfig(path);
-    const existing = cfg[token.provider] ?? {};
-    cfg[token.provider] = {
-        ...existing,
-        oauth: {
-            accessToken: token.accessToken,
-            refreshToken: token.refreshToken,
-            expiresAt: token.expiresAt,
-            scope: token.scope,
-            userLabel: token.userLabel,
-            connectedAt: Date.now(),
-        },
-    };
-    writeAllConfig(cfg, path);
-}
-/** Disconnect · drops only the oauth subtree, preserves any manual apiKey. */
-export function clearToken(providerId, path) {
-    const cfg = readAllConfig(path);
-    const entry = cfg[providerId];
-    if (!entry || !entry.oauth)
-        return false;
-    delete entry.oauth;
-    // If the entry is now empty (no manual apiKey either), drop the whole row.
-    const isEmpty = Object.keys(entry).filter((k) => k !== 'oauth').length === 0;
-    if (isEmpty)
-        delete cfg[providerId];
-    writeAllConfig(cfg, path);
-    return true;
-}
-/** Read the persisted OAuth token for a provider (undefined if not connected). */
-export function loadToken(providerId, path) {
-    const cfg = readAllConfig(path);
-    return cfg[providerId]?.oauth;
-}
-export function connectionStatus(providerId, path) {
-    const cfg = readAllConfig(path);
-    const entry = cfg[providerId];
-    if (!entry)
-        return { status: 'disconnected' };
-    if (entry.oauth?.accessToken) {
-        const exp = entry.oauth.expiresAt;
-        const expired = typeof exp === 'number' && exp < Date.now();
-        return {
-            status: expired ? 'expired' : 'connected',
-            userLabel: entry.oauth.userLabel,
-            connectedAt: entry.oauth.connectedAt,
-            expiresAt: exp,
-        };
-    }
-    if (entry.apiKey || entry.token)
-        return { status: 'manual' };
-    return { status: 'disconnected' };
-}
-//# sourceMappingURL=oauth-store.js.map

package/dist/infrastructure/context/registry-bootstrap.js

@@ -1,99 +0,0 @@
-/**
- * Registry bootstrap · v0.8 S2.
- *
- * Builds the default ContextSourceRegistry at daemon startup with our 1st-
- * party adapters (Linear, Figma), loads adapter config from
- * `~/.codehere/context-sources.json`, and provides a default
- * ContextSourceFetchContext that wraps node's fetch() for the network path
- * and the audit chain for telemetry.
- *
- * This file is the ONLY place where context-sources touch process.env, the
- * filesystem, and global fetch · everything else is pure code + injected
- * primitives. Makes tests trivial and the security boundary explicit.
- */
-import { existsSync, readFileSync } from 'fs';
-import { homedir } from 'os';
-import { join } from 'path';
-import { createRegistry, register, } from './context-source.js';
-import { linearSource } from './adapters/linear-source.js';
-import { figmaSource } from './adapters/figma-source.js';
-import { drawioSource } from './adapters/drawio-source.js';
-import { githubIssueSource } from './adapters/github-issue-source.js';
-/** Built once per daemon · in-memory · re-read from disk on demand via `reload`. */
-let cached = null;
-export function getDefaultRegistry() {
-    if (cached)
-        return cached;
-    const reg = createRegistry();
-    register(reg, linearSource);
-    register(reg, figmaSource);
-    register(reg, drawioSource);
-    register(reg, githubIssueSource);
-    cached = reg;
-    return reg;
-}
-/** Forget the cached registry · used by tests + future `codehere context-source reload`. */
-export function resetDefaultRegistry() {
-    cached = null;
-}
-/**
- * Resolve config path · respects CODEHERE_HOME env so tests can isolate.
- * File format: a JSON object keyed by adapter id, e.g.
- *   { "linear": { "apiKey": "..." }, "figma": { "token": "..." } }
- */
-function configPath() {
-    const home = process.env.CODEHERE_HOME || homedir();
-    return join(home, '.codehere', 'context-sources.json');
-}
-function loadConfig() {
-    const path = configPath();
-    if (!existsSync(path))
-        return {};
-    try {
-        const raw = readFileSync(path, 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (typeof parsed !== 'object' || parsed === null)
-            return {};
-        return parsed;
-    }
-    catch {
-        return {};
-    }
-}
-/**
- * Real-network FetchContext · used by the daemon at runtime. Tests inject
- * a fake context so this code path never runs in CI.
- */
-export function createDefaultFetchContext(opts) {
-    const config = opts.configOverride ?? loadConfig();
-    return {
-        config,
-        async httpGet(target, headers) {
-            const r = await fetch(target, { method: 'GET', headers: headers ?? {} });
-            const body = await r.text();
-            const hOut = {};
-            r.headers.forEach((v, k) => {
-                hOut[k.toLowerCase()] = v;
-            });
-            return { status: r.status, body, headers: hOut };
-        },
-        emitAuditLine: opts.emitAuditLine,
-        now: () => Date.now(),
-    };
-}
-export function createDefaultFetchContextWithPost(opts) {
-    const base = createDefaultFetchContext(opts);
-    return {
-        ...base,
-        async httpPost(target, body, headers) {
-            const r = await fetch(target, { method: 'POST', headers: headers ?? {}, body });
-            const text = await r.text();
-            const hOut = {};
-            r.headers.forEach((v, k) => {
-                hOut[k.toLowerCase()] = v;
-            });
-            return { status: r.status, body: text, headers: hOut };
-        },
-    };
-}
-//# sourceMappingURL=registry-bootstrap.js.map

package/dist/infrastructure/context/write-pass-resolver.js

@@ -1,106 +0,0 @@
-/**
- * Write-pass target resolver · v0.9 S6 part B.
- *
- * Turns a W-PASS target like `linear://INFRA-247` into a concrete
- * HTTPS request the daemon can fire on the user's behalf, AFTER the
- * user has approved the payload. The resolver layer mirrors the
- * context-source registry · same scheme namespace, opposite direction
- * (read vs write).
- *
- * Resolved request shape:
- *   - url      · absolute HTTPS
- *   - method   · same as the intent (POST/PUT/PATCH/DELETE)
- *   - headers  · auth + content-type · loaded from ctx.config[scheme]
- *   - body     · JSON-stringified payload
- *
- * Tests pass a fake httpRequest · production uses node's fetch. Same
- * seam as context-source so adapters look symmetric.
- *
- * S6 ships ONE resolver (Linear) to prove the shape. github + figma +
- * drawio + notion follow in subsequent slices · each is a self-contained
- * function in this file, so adding one is a copy-paste-modify, not an
- * architectural change.
- */
-import { gradeDomain, hostOf } from '../../application/use-cases/domain-trust.js';
-export class WritePassResolveError extends Error {
-    code;
-    constructor(code, message) {
-        super(`[w-pass resolve] ${code}: ${message}`);
-        this.code = code;
-    }
-}
-/**
- * Resolve an intent + effective payload into a concrete HTTP request.
- * Throws WritePassResolveError if the scheme isn't supported OR auth
- * is missing · the daemon turns those into a 4xx response BEFORE
- * touching the network.
- */
-export function resolveWriteRequest(intent, effectivePayload, config) {
-    const m = intent.target.match(/^([a-z][a-z0-9+.-]*):\/\/(.+)$/);
-    if (!m) {
-        throw new WritePassResolveError('invalid_target', `bad URL: ${intent.target}`);
-    }
-    const scheme = m[1];
-    const rest = m[2];
-    const built = scheme === 'linear'
-        ? resolveLinear(rest, intent.method, effectivePayload, config.linear)
-        : scheme === 'github'
-            ? resolveGitHub(rest, intent.method, effectivePayload, config.github)
-            : null;
-    if (built) {
-        return { ...built, trust: gradeDomain(hostOf(built.url)) };
-    }
-    throw new WritePassResolveError('unsupported_scheme', `no W-PASS resolver for "${scheme}" yet · supported in S6: linear, github`);
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* Linear                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-function resolveLinear(rest, method, payload, cfg) {
-    const auth = cfg?.oauth?.accessToken ? `Bearer ${cfg.oauth.accessToken}` : cfg?.apiKey;
-    if (!auth) {
-        throw new WritePassResolveError('auth_missing', 'no Linear apiKey or OAuth token in config["linear"] · agent cannot write without explicit credentials');
-    }
-    // Linear's API is GraphQL · we send mutations via POST. The agent's
-    // intent.payload is expected to be { query, variables } or { mutation, variables }.
-    // We pass it through verbatim · the human saw + approved it.
-    const endpoint = cfg?.endpoint ?? 'https://api.linear.app/graphql';
-    return {
-        url: endpoint,
-        // Linear writes always POST (it's GraphQL) · intent.method is recorded
-        // for audit but doesn't change the transport. We log a one-line audit
-        // hint when method != POST so the user sees the mediation.
-        method: 'POST',
-        headers: {
-            Authorization: auth,
-            'Content-Type': 'application/json',
-            'X-Codehere-Mediated': 'w-pass',
-            'X-Codehere-Original-Method': method,
-            'X-Codehere-Identifier': rest,
-        },
-        body: JSON.stringify(payload),
-    };
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* GitHub                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-function resolveGitHub(rest, method, payload, cfg) {
-    if (!cfg?.token) {
-        throw new WritePassResolveError('auth_missing', 'no GitHub token in config["github"] · public-by-URL is READ only · writes need an explicit PAT');
-    }
-    // rest is e.g. owner/repo/issues/42/comments or owner/repo/issues/42
-    const endpoint = cfg.endpoint ?? 'https://api.github.com';
-    return {
-        url: `${endpoint}/repos/${rest}`,
-        method,
-        headers: {
-            Authorization: `Bearer ${cfg.token}`,
-            Accept: 'application/vnd.github+json',
-            'X-GitHub-Api-Version': '2022-11-28',
-            'Content-Type': 'application/json',
-            'User-Agent': 'codehere/0.9 w-pass',
-            'X-Codehere-Mediated': 'w-pass',
-        },
-        body: JSON.stringify(payload),
-    };
-}
-//# sourceMappingURL=write-pass-resolver.js.map

package/dist/infrastructure/cost/budget-config.js

@@ -1,113 +0,0 @@
-/**
- * v0.6 S3 slice 2 — daily spend budget config.
- *
- * Reads ~/.codehere/budget.yaml. The pre-spawn check in /api/task compares
- * computeSpendToday().totalUsd against `daily_usd`; over-budget refuses with
- * a friendly message instead of silently spawning another paid call.
- *
- * Why this is the v1 promise · claim_market_position v3 lists "cost-bounded
- * execution" as one of the few capture-strategy edges still possibly open.
- * Slice 1 surfaced spend; slice 2 enforces it. Together they make the edge
- * demonstrable in 60 seconds: set a $1 budget, spawn until you hit it,
- * watch codehere refuse the next spawn.
- *
- * Schema (~/.codehere/budget.yaml):
- *
- *   daily_usd: 5.00      # null / omitted = no budget enforcement
- *   warn_at_pct: 70      # default 70 — chip turns yellow at 70%
- *
- * Single-file, hand-editable, plain YAML. Per claim_user_persona HIGH:
- * non-technical users can edit it directly. Per overconfidence-guard:
- * the budget is a USER ceiling, not a codehere guarantee — we can't
- * see the actual provider invoice in real time.
- */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { dirname, join } from 'path';
-import { homedir } from 'os';
-const DEFAULT_CONFIG = {
-    dailyUsd: null,
-    warnAtPct: 70,
-};
-function configFile() {
-    return join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'budget.yaml');
-}
-/** Parse a tiny subset of YAML — `key: value` pairs, # comments, blank lines.
- *  No nesting, no lists, no multi-line. Same approach as permissions-config:
- *  keep the dependency surface zero, schema simple. */
-function parseYaml(content) {
-    const out = {};
-    for (const rawLine of content.split('\n')) {
-        const line = rawLine.replace(/#.*$/, '').trim();
-        if (!line)
-            continue;
-        const colonIdx = line.indexOf(':');
-        if (colonIdx === -1)
-            continue;
-        const key = line.slice(0, colonIdx).trim();
-        const val = line.slice(colonIdx + 1).trim();
-        if (key)
-            out[key] = val;
-    }
-    return out;
-}
-/** Read the budget config from disk. Missing file or parse failure → defaults
- *  (no enforcement). Best-effort: never throws — a corrupt file should not
- *  break the spawn path. */
-export function loadBudget() {
-    const path = configFile();
-    if (!existsSync(path))
-        return { ...DEFAULT_CONFIG };
-    try {
-        const raw = readFileSync(path, 'utf-8');
-        const parsed = parseYaml(raw);
-        const cfg = { ...DEFAULT_CONFIG };
-        if ('daily_usd' in parsed) {
-            const n = Number(parsed.daily_usd);
-            cfg.dailyUsd = Number.isFinite(n) && n > 0 ? n : null;
-        }
-        if ('warn_at_pct' in parsed) {
-            const n = Number(parsed.warn_at_pct);
-            cfg.warnAtPct = Number.isFinite(n) && n > 0 && n <= 100 ? n : DEFAULT_CONFIG.warnAtPct;
-        }
-        return cfg;
-    }
-    catch {
-        return { ...DEFAULT_CONFIG };
-    }
-}
-/** Persist the budget config. Creates ~/.codehere/ if missing. Comments
- *  in the emitted YAML help a non-technical user edit it later. */
-export function saveBudget(cfg) {
-    const path = configFile();
-    const dir = dirname(path);
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-    const lines = [
-        '# codehere daily-spend budget. Edit by hand or via `codehere budget set <amount>`.',
-        "# daily_usd: hard ceiling for today's estimated spend. Set to a number to enable.",
-        '# Leave commented out / omit to disable budget enforcement entirely.',
-    ];
-    if (cfg.dailyUsd !== null) {
-        lines.push(`daily_usd: ${cfg.dailyUsd}`);
-    }
-    else {
-        lines.push('# daily_usd: 5.00');
-    }
-    lines.push(`warn_at_pct: ${cfg.warnAtPct}`);
-    lines.push('');
-    writeFileSync(path, lines.join('\n'), 'utf-8');
-}
-/** True when today's estimated spend has hit or exceeded the daily ceiling.
- *  Returns false when no budget is set (no enforcement). */
-export function isOverBudget(spentTodayUsd, cfg = loadBudget()) {
-    if (cfg.dailyUsd === null)
-        return false;
-    return spentTodayUsd >= cfg.dailyUsd;
-}
-/** Percentage of today's budget consumed (0-100, or null when no budget set). */
-export function budgetUsedPct(spentTodayUsd, cfg = loadBudget()) {
-    if (cfg.dailyUsd === null || cfg.dailyUsd === 0)
-        return null;
-    return Math.min(100, Math.round((spentTodayUsd / cfg.dailyUsd) * 100));
-}
-//# sourceMappingURL=budget-config.js.map