codehere 0.8.0 → 1.0.2

package/dist/presentation/cli/commands/scan-tool-command.js

@@ -1,94 +0,0 @@
-/**
- * CLI Command: scan-tool
- *
- * Reads a Claude Code PreToolUse hook event from stdin (JSON),
- * runs Layer 0 security scan, and outputs a block/allow decision.
- *
- * This is the actual binary that Claude Code's hook system invokes.
- * It must be fast (<100ms) and never crash — any failure falls through to allow.
- *
- * Trust-override audit (added 2026-05-06 per CC frontier Q1 — auditable
- * permission trails): every fail-open path now writes an `overrideReason`
- * audit entry so the audit log captures EVERY tool call, not just the ones
- * the scanner could evaluate. Reviewers can `codehere audit --override-only`
- * to see all cases where the safety policy didn't run normally.
- *
- * Usage (by hook system, not user):
- *   echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' | codehere scan-tool
- */
-import { processHookEvent, appendOverrideAudit, } from '../../../infrastructure/hooks/claude-sdk-hook.js';
-export async function executeScanToolCommand(options) {
-    // Read all stdin
-    let raw = '';
-    try {
-        for await (const chunk of process.stdin) {
-            raw += chunk;
-        }
-    }
-    catch {
-        // If stdin read fails, allow the tool call — but log the override so
-        // the audit trail records that the scanner didn't get a chance to run.
-        appendOverrideAudit('stdin_read_failure');
-        process.exit(0);
-    }
-    if (!raw.trim()) {
-        process.exit(0);
-    }
-    // Parse event JSON
-    let event;
-    try {
-        event = JSON.parse(raw);
-    }
-    catch {
-        // Malformed JSON — allow by default (fail open for dev experience).
-        // We still record the override with a truncated copy of the raw payload
-        // so reviewers can see what arrived (helps diagnose hook misconfiguration).
-        appendOverrideAudit('event_parse_failure', {
-            toolInput: raw.substring(0, 500),
-        });
-        if (options.debug) {
-            process.stderr.write('[codehere] Warning: could not parse hook event JSON\n');
-        }
-        process.exit(0);
-    }
-    try {
-        const decision = processHookEvent(event);
-        if (options.logOnly) {
-            // Log-only mode: never block, but log everything. If the scanner WOULD
-            // have blocked, record the override so the audit shows scanner intent
-            // vs actual outcome. Without this, --log-only mode produces an audit
-            // trail indistinguishable from a clean session.
-            if (decision?.decision === 'block') {
-                appendOverrideAudit('log_only_mode', {
-                    sessionId: event.session_id,
-                    toolName: event.tool_name,
-                });
-                if (options.debug) {
-                    process.stderr.write(`[codehere] Would block: ${decision.reason}\n`);
-                }
-            }
-            process.exit(0);
-        }
-        if (decision?.decision === 'block') {
-            // Output block decision as JSON (Claude Code hook contract)
-            process.stdout.write(JSON.stringify(decision) + '\n');
-            // Also write to stderr for user visibility
-            process.stderr.write(`\n${decision.reason}\n`);
-            process.exit(2); // non-zero exit = Claude Code treats as block signal
-        }
-        // Allow — exit 0 with no output
-        process.exit(0);
-    }
-    catch {
-        // Any scan failure: fail open (allow), never break developer workflow.
-        // Record the override so the audit trail shows the scanner crashed for
-        // this tool call — reviewers can correlate with the timestamp to find
-        // the underlying error.
-        appendOverrideAudit('scan_exception', {
-            sessionId: event.session_id,
-            toolName: event.tool_name,
-        });
-        process.exit(0);
-    }
-}
-//# sourceMappingURL=scan-tool-command.js.map

package/dist/presentation/cli/commands/setup-command.js

@@ -1,307 +0,0 @@
-/**
- * Setup Wizard Command
- * Interactive first-time setup for Codehere
- * Checks environment, API keys, and guides users through configuration
- */
-import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs';
-import { join } from 'path';
-import { getConfigManager } from '../../../infrastructure/config/config-manager.js';
-import { colors, separator, newline, sectionHeader, success, error, warning, info } from '../../../ui.js';
-import { executionTracer } from '../../../infrastructure/observability/execution-tracer.js';
-import { findCodebaseRoot } from '../../../domain/services/codebase-detector.js';
-import { readinessForAllAgents } from '../../../infrastructure/orchestration/session-manager.js';
-/**
- * What codehere actually needs to run a task: at least one coding-agent CLI
- * that's installed AND signed in. Most engineers have `claude` or `codex`
- * logged in by subscription with no API key set, so framing setup around
- * `ANTHROPIC_API_KEY` told them they were blocked when they weren't. This
- * reuses the same readiness check that powers the web dashboard's squad bar.
- */
-function summarizeAgents() {
-    let all;
-    try {
-        all = readinessForAllAgents();
-    }
-    catch {
-        all = [];
-    }
-    return { ready: all.filter((a) => a.state === 'ready'), all };
-}
-/** One status line per agent, plain English. Used by both the TTY wizard and
- *  the non-TTY summary so they say the same thing. */
-function printAgentLines(all) {
-    for (const a of all) {
-        if (a.state === 'ready') {
-            console.log(success(`${a.label}: ready`));
-        }
-        else if (a.state === 'needs_auth') {
-            const hint = a.authHint?.command ? colors.dim(`  (sign in: ${a.authHint.command})`) : '';
-            console.log(warning(`${a.label}: installed, needs sign-in`) + hint);
-        }
-        else if (a.state === 'billed_key_required') {
-            console.log(colors.dim(`○ ${a.label}: needs a billed API key (paid)`));
-        }
-        else {
-            const hint = a.installHint?.command ? colors.dim(`  (install: ${a.installHint.command})`) : '';
-            console.log(colors.dim(`○ ${a.label}: not installed`) + hint);
-        }
-    }
-}
-/**
- * Check if any API key is configured
- */
-function checkAPIKey() {
-    const providers = [
-        { env: 'ANTHROPIC_API_KEY', name: 'Anthropic' },
-        { env: 'OPENAI_API_KEY', name: 'OpenAI' },
-        { env: 'COHERE_API_KEY', name: 'Cohere' },
-        { env: 'OPENROUTER_API_KEY', name: 'OpenRouter' },
-    ];
-    for (const { env, name } of providers) {
-        const key = process.env[env];
-        if (key && key.trim() && !key.includes('your_key_here') && key.length > 10) {
-            return { configured: true, provider: name, key };
-        }
-    }
-    return { configured: false };
-}
-/**
- * Detect codebase type and root
- */
-function detectCodebase() {
-    const cwd = process.cwd();
-    // Check for common project indicators
-    const indicators = {
-        node: ['package.json'],
-        python: ['requirements.txt', 'setup.py', 'pyproject.toml'],
-        rust: ['Cargo.toml'],
-        go: ['go.mod'],
-        java: ['pom.xml', 'build.gradle'],
-    };
-    for (const [type, files] of Object.entries(indicators)) {
-        for (const file of files) {
-            if (existsSync(join(cwd, file))) {
-                return { detected: true, type, root: cwd };
-            }
-        }
-    }
-    return { detected: false, root: cwd };
-}
-/**
- * Detect preferred model from config
- */
-function detectModel() {
-    try {
-        const configPath = join(process.cwd(), 'data', 'model-config.json');
-        if (existsSync(configPath)) {
-            const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-            return config.preferredModel || config.modelFamily || null;
-        }
-    }
-    catch {
-        // Ignore errors
-    }
-    return null;
-}
-/**
- * Create config directory if needed
- */
-function ensureConfigDir() {
-    const configDir = join(process.cwd(), 'data');
-    if (!existsSync(configDir)) {
-        mkdirSync(configDir, { recursive: true });
-    }
-    return configDir;
-}
-/**
- * Save setup configuration
- */
-function saveSetupConfig(result) {
-    const configDir = ensureConfigDir();
-    const configPath = join(configDir, 'setup-config.json');
-    const config = {
-        setupComplete: true,
-        setupDate: new Date().toISOString(),
-        apiKeyConfigured: result.apiKeyConfigured,
-        modelDetected: result.modelDetected,
-        codebaseDetected: result.codebaseDetected,
-    };
-    writeFileSync(configPath, JSON.stringify(config, null, 2));
-}
-/**
- * Check if setup has been completed before
- */
-function isSetupComplete() {
-    try {
-        const configPath = join(process.cwd(), 'data', 'setup-config.json');
-        if (existsSync(configPath)) {
-            const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-            return config.setupComplete === true;
-        }
-    }
-    catch {
-        // Ignore errors
-    }
-    return false;
-}
-/**
- * Execute setup wizard
- */
-export async function executeSetupCommand(force = false) {
-    // Check for interactive terminal
-    const isTTY = process.stdin.isTTY && process.stdout.isTTY;
-    if (!isTTY) {
-        const { ready, all } = summarizeAgents();
-        console.log(colors.bold('Setup'));
-        console.log();
-        if (all.length)
-            printAgentLines(all);
-        console.log();
-        if (ready.length) {
-            console.log(success(`You're ready. ${ready[0].label} is set up.`));
-            console.log(colors.dim('  Next: codehere start   (open the dashboard)'));
-        }
-        else {
-            console.log(warning('No coding agent is set up yet. Install or sign in to one:'));
-            console.log(colors.cyan('  npm i -g @anthropic-ai/claude-code') + colors.dim('   then run: claude   (sign in)'));
-            console.log(colors.dim('  Already use one by API key? export ANTHROPIC_API_KEY=sk-ant-...'));
-        }
-        return;
-    }
-    // Start execution tracing
-    const codebaseInfo = findCodebaseRoot(process.cwd());
-    executionTracer.startRun('setup', {
-        codebaseId: codebaseInfo?.rootPath || process.cwd(),
-    });
-    try {
-        const isFirstTime = !isSetupComplete() || force;
-        newline();
-        console.log(colors.bold('Setup'));
-        newline();
-        // Check if already set up
-        if (!force && isSetupComplete()) {
-            console.log(info('Setup has already been completed.'));
-            newline();
-            console.log(colors.dim('Run with --force to reconfigure.'));
-            newline();
-            return;
-        }
-        const result = {
-            apiKeyConfigured: false,
-            modelDetected: null,
-            codebaseDetected: false,
-            configPath: join(process.cwd(), 'data'),
-        };
-        // Step 1: Coding agents — codehere drives agent CLIs, not raw API keys.
-        sectionHeader('Step 1: Your coding agents');
-        const { ready, all } = summarizeAgents();
-        if (all.length)
-            printAgentLines(all);
-        newline();
-        const apiKeyCheck = checkAPIKey();
-        if (ready.length) {
-            console.log(success(`You're ready. ${ready[0].label} is set up.`));
-            result.apiKeyConfigured = true; // at least one agent can spawn right now
-        }
-        else if (apiKeyCheck.configured) {
-            // No agent CLI ready, but a key is present — some adapters (e.g. Aider) run off it.
-            console.log(success(`${apiKeyCheck.provider} API key found.`));
-            console.log(colors.dim('  No agent CLI detected yet — install one for the full experience.'));
-            result.apiKeyConfigured = true;
-        }
-        else {
-            console.log(warning('No coding agent is set up yet.'));
-            newline();
-            console.log(colors.bold('Install or sign in to at least one:'));
-            console.log(colors.cyan('  npm i -g @anthropic-ai/claude-code') + colors.dim('   then run: claude   (sign in)'));
-            console.log(colors.dim('  Already use one by API key? export ANTHROPIC_API_KEY=sk-ant-...'));
-            newline();
-        }
-        newline();
-        // Step 2: Model Detection
-        sectionHeader('Step 2: Model Configuration');
-        const model = detectModel();
-        if (model) {
-            console.log(success(`Preferred Model: ${model}`));
-            result.modelDetected = model;
-        }
-        else {
-            console.log(info('Model: Using default (Claude Sonnet)'));
-            console.log(colors.dim('  Configurable via .codehere/providers.json'));
-            result.modelDetected = 'Claude Sonnet (default)';
-        }
-        newline();
-        // Step 3: Codebase Detection
-        sectionHeader('Step 3: Codebase Detection');
-        const codebase = detectCodebase();
-        if (codebase.detected) {
-            console.log(success(`Codebase: Detected (${codebase.type})`));
-            console.log(colors.dim(`  Root: ${codebase.root}`));
-            result.codebaseDetected = true;
-        }
-        else {
-            console.log(warning('Codebase: Not detected'));
-            console.log(colors.dim("  Make sure you're in your project directory."));
-            result.codebaseDetected = false;
-        }
-        newline();
-        // Step 4: Summary
-        sectionHeader('Setup Summary');
-        const summaryItems = [
-            ['API Key', result.apiKeyConfigured ? success('Configured') : error('Not Configured')],
-            ['Model', result.modelDetected || info('Default')],
-            ['Codebase', result.codebaseDetected ? success('Detected') : warning('Not Detected')],
-        ];
-        summaryItems.forEach(([label, status]) => {
-            console.log(`  ${label.padEnd(15)} ${status}`);
-        });
-        newline();
-        // Step 5: Save Configuration
-        if (result.apiKeyConfigured) {
-            const configManager = getConfigManager();
-            // Update codebase info if detected
-            if (codebase.detected) {
-                configManager.updateCodebase(codebase.root);
-            }
-            // Update model preference if detected
-            if (model) {
-                configManager.setPreference('defaultModel', model.replace(' (default)', ''));
-            }
-            // Save configuration
-            configManager.saveConfig();
-            result.configPath = configManager.getConfigPath();
-            newline();
-            console.log(success('Done.'));
-            newline();
-            console.log(colors.bold('Next steps:'));
-            console.log(colors.dim(`  1. ${colors.cyan('codehere start')}        Open the task intake at :3773`));
-            console.log(colors.dim(`  2. ${colors.cyan('codehere hook install')} Audit every Claude Code action`));
-            console.log(colors.dim(`  3. ${colors.cyan('codehere trust .')}      Scan your project (no API key)`));
-            newline();
-            saveSetupConfig(result);
-            // Track onboarding completion for first-time users
-            if (isFirstTime) {
-                const onboardingConfig = {
-                    onboardingComplete: true,
-                    onboardingDate: new Date().toISOString(),
-                    commandCount: 0, // Will be tracked by feature discovery
-                };
-                const onboardingPath = join(ensureConfigDir(), 'onboarding.json');
-                writeFileSync(onboardingPath, JSON.stringify(onboardingConfig, null, 2));
-            }
-        }
-        else {
-            console.log(separator('═', 80));
-            console.log(warning('Setup Incomplete'));
-            console.log(separator('═', 80));
-            newline();
-            console.log(colors.bold('Please configure your API key to continue.'));
-            console.log(colors.dim('Run this command again after setting up your API key.'));
-            newline();
-        }
-    }
-    finally {
-        executionTracer.endRun();
-    }
-}
-//# sourceMappingURL=setup-command.js.map