codehere 0.8.0 → 1.0.2

package/dist/presentation/cli/commands/thread-command.js

@@ -1,288 +0,0 @@
-/**
- * CLI: `codehere thread` · v0.8 S4 · signed-payload share + import
- *
- * Subcommands:
- *   export <session-id> [--out <file>] [--json]
- *       Sign the session bundle and write it to <file> (or stdout when no --out).
- *   import <file> [--trust] [--json]
- *       Verify the signature. If the signer's key isn't trusted, refuse unless
- *       --trust is set OR the user is on a TTY and confirms. On valid+trusted,
- *       merge the session into ~/.codehere/sessions.jsonl so it appears in the
- *       dashboard.
- *   keys                   · print the local public key
- *   trust <pubkey> [label] · add a public key to the trusted set
- *   untrust <pubkey>       · remove
- *
- * No network. Both export and import are local file operations.
- */
-import { existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync } from 'fs';
-import { homedir, hostname } from 'os';
-import { dirname, join, isAbsolute, resolve } from 'path';
-import { colors, symbols } from '../../../ui.js';
-import { signBundle, verifyBundle, shortFingerprint, } from '../../../application/use-cases/thread-export.js';
-import { loadOrCreateKeypair, localPublicKeyBase64, trustKey, untrustKey, trustedKeySet, loadTrustedKeys, isKeyTrusted, } from '../../../infrastructure/orchestration/thread-key-store.js';
-import { loadSessionById } from '../../../infrastructure/orchestration/session-persistence.js';
-import { getVersion } from '../../../utils/version.js';
-export function executeThreadCommand(sub, arg, extra, options = {}) {
-    switch (sub) {
-        case 'export':
-            return exportThread(arg, options);
-        case 'import':
-            return importThread(arg, options);
-        case 'keys':
-            return showKeys(options.json ?? false);
-        case 'trust':
-            return trustCmd(arg, options.label, options.json ?? false);
-        case 'untrust':
-            return untrustCmd(arg, options.json ?? false);
-        default:
-            process.stderr.write(colors.error(`${symbols.error} Unknown subcommand: ${sub ?? '(none)'}\n`) +
-                colors.dim('Try: codehere thread export <id> | import <file> | keys | trust <key> | untrust <key>\n'));
-            return 2;
-    }
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* export                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-function exportThread(sessionId, options) {
-    if (!sessionId) {
-        process.stderr.write(colors.error(`${symbols.error} Need a session id\n`));
-        return 2;
-    }
-    const session = loadSessionById(sessionId);
-    if (!session) {
-        process.stderr.write(colors.error(`${symbols.error} No session found matching "${sessionId}"\n`));
-        return 2;
-    }
-    const keys = loadOrCreateKeypair();
-    const body = {
-        schema: 1,
-        kind: 'thread',
-        sessionId: session.sessionId,
-        session,
-        exporter: {
-            hostname: safeHostname(),
-            codehereVersion: getVersion(),
-        },
-        exportedAt: new Date().toISOString(),
-    };
-    const bundle = signBundle(body, keys);
-    const text = JSON.stringify(bundle, null, 2);
-    if (options.out) {
-        const outPath = isAbsolute(options.out) ? options.out : resolve(process.cwd(), options.out);
-        mkdirSync(dirname(outPath), { recursive: true });
-        writeFileSync(outPath, text, 'utf-8');
-        if (options.json) {
-            process.stdout.write(JSON.stringify({ ok: true, path: outPath, fingerprint: shortFingerprint(bundle.publicKey) }) + '\n');
-        }
-        else {
-            process.stdout.write(colors.green(`${symbols.success} Exported`) +
-                colors.dim(`  ${outPath}\n`) +
-                colors.dim(`   signed by ${shortFingerprint(bundle.publicKey)}\n`) +
-                colors.dim(`   share via Slack/email/PR · recipient runs:  `) +
-                colors.bold(`codehere thread import ${outPath}\n`));
-        }
-        return 0;
-    }
-    // No --out · print to stdout (machine-pipe-friendly)
-    process.stdout.write(text + '\n');
-    return 0;
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* import                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-function importThread(filePath, options) {
-    if (!filePath) {
-        process.stderr.write(colors.error(`${symbols.error} Need a file path\n`));
-        return 2;
-    }
-    const fp = isAbsolute(filePath) ? filePath : resolve(process.cwd(), filePath);
-    if (!existsSync(fp)) {
-        process.stderr.write(colors.error(`${symbols.error} Not found: ${fp}\n`));
-        return 2;
-    }
-    let raw;
-    try {
-        raw = JSON.parse(readFileSync(fp, 'utf-8'));
-    }
-    catch (err) {
-        process.stderr.write(colors.error(`${symbols.error} Invalid JSON: ${err instanceof Error ? err.message : String(err)}\n`));
-        return 2;
-    }
-    const verdict = verifyBundle(raw, trustedKeySet());
-    if (verdict.status === 'malformed') {
-        if (options.json) {
-            process.stdout.write(JSON.stringify({ ok: false, error: 'malformed', detail: verdict.reason }) + '\n');
-        }
-        else {
-            process.stderr.write(colors.error(`${symbols.error} Malformed bundle: ${verdict.reason}\n`));
-        }
-        return 2;
-    }
-    if (verdict.status === 'tampered') {
-        if (options.json) {
-            process.stdout.write(JSON.stringify({ ok: false, error: 'tampered', detail: verdict.reason }) + '\n');
-        }
-        else {
-            process.stderr.write(colors.error(`${symbols.error} Signature INVALID · refusing to import\n`) +
-                colors.dim(`   ${verdict.reason}\n`));
-        }
-        return 1;
-    }
-    // status: 'valid' or 'unknown_key'
-    const bundle = verdict.status === 'valid' ? verdict.bundle : verdict.bundle;
-    const fp_key = shortFingerprint(bundle.publicKey);
-    if (verdict.status === 'unknown_key') {
-        if (!options.trust) {
-            if (options.json) {
-                process.stdout.write(JSON.stringify({
-                    ok: false,
-                    error: 'unknown_key',
-                    publicKey: bundle.publicKey,
-                    fingerprint: fp_key,
-                    hint: 'Re-run with --trust to add this key to your trust store and import.',
-                }) + '\n');
-            }
-            else {
-                process.stderr.write(colors.warning(`${symbols.warning} Signer's key is not in your trust store\n`) +
-                    colors.dim(`   fingerprint: ${fp_key}\n`) +
-                    colors.dim(`   The signature is cryptographically valid but you've never trusted this key.\n`) +
-                    colors.dim(`   To trust + import:  `) +
-                    colors.bold(`codehere thread import ${fp} --trust\n`) +
-                    colors.dim(`   To inspect first:   `) +
-                    colors.bold(`codehere thread trust ${bundle.publicKey} <label>`) +
-                    '\n');
-            }
-            return 2;
-        }
-        // --trust set · add key to store and continue
-        trustKey(bundle.publicKey, options.label);
-    }
-    // Persist into ~/.codehere/sessions.jsonl as 3 records (spawned, completed, finalReport)
-    const ses = bundle.body.session;
-    const home = process.env.CODEHERE_HOME || homedir();
-    const sessionsPath = join(home, '.codehere', 'sessions.jsonl');
-    mkdirSync(dirname(sessionsPath), { recursive: true });
-    const lines = [];
-    lines.push(JSON.stringify({
-        t: 'spawned',
-        id: ses.sessionId,
-        agent: ses.agent,
-        prompt: ses.prompt,
-        cwd: ses.cwd,
-        startedAt: ses.startedAt,
-    }));
-    lines.push(JSON.stringify({
-        t: 'completed',
-        id: ses.sessionId,
-        status: ses.status,
-        durationMs: ses.durationMs,
-        completedAt: ses.completedAt,
-        steps: ses.steps,
-        artifacts: ses.artifacts,
-    }));
-    if (ses.finalReport) {
-        lines.push(JSON.stringify({
-            t: 'finalReport',
-            id: ses.sessionId,
-            summary: ses.finalReport.summary,
-            generatedAt: ses.finalReport.generatedAt,
-            durationMs: ses.finalReport.durationMs,
-        }));
-    }
-    appendFileSync(sessionsPath, lines.join('\n') + '\n', 'utf-8');
-    if (options.json) {
-        process.stdout.write(JSON.stringify({
-            ok: true,
-            sessionId: ses.sessionId,
-            trusted: verdict.status === 'valid' ? true : 'just-added',
-            fingerprint: fp_key,
-        }) + '\n');
-    }
-    else {
-        process.stdout.write(colors.green(`${symbols.success} Imported`) +
-            colors.dim(`  session ${ses.sessionId.slice(0, 8)} · signed by ${fp_key}\n`) +
-            colors.dim(`   view it:  `) +
-            colors.bold(`codehere start`) +
-            colors.dim(` then click the task in the dashboard\n`));
-    }
-    return 0;
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* keys / trust / untrust                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-function showKeys(json) {
-    loadOrCreateKeypair();
-    const localB64 = localPublicKeyBase64() ?? '';
-    const trusted = loadTrustedKeys();
-    if (json) {
-        process.stdout.write(JSON.stringify({
-            local: { publicKey: localB64, fingerprint: shortFingerprint(localB64) },
-            trusted: Object.entries(trusted.keys).map(([k, v]) => ({
-                publicKey: k,
-                fingerprint: shortFingerprint(k),
-                label: v.label,
-                addedAt: v.addedAt,
-            })),
-        }, null, 2) + '\n');
-        return 0;
-    }
-    process.stdout.write('\n' + colors.bold('This machine') + '\n');
-    process.stdout.write('  ' + colors.cyan(shortFingerprint(localB64)) + colors.dim('  signs your exports\n\n'));
-    process.stdout.write(colors.bold('Trusted keys') + colors.dim('  (imports from these accepted silently)\n'));
-    const entries = Object.entries(trusted.keys);
-    if (entries.length === 0) {
-        process.stdout.write('  ' + colors.dim('(empty)\n'));
-    }
-    else {
-        for (const [k, v] of entries) {
-            const label = v.label || '(no label)';
-            process.stdout.write('  ' + colors.cyan(shortFingerprint(k)) + '  ' + colors.dim(label) + '\n');
-        }
-    }
-    process.stdout.write('\n' + colors.dim('Add a key:    ') + colors.bold('codehere thread trust <pubkey> <label>') + '\n');
-    process.stdout.write(colors.dim('Remove a key: ') + colors.bold('codehere thread untrust <pubkey>') + '\n\n');
-    return 0;
-}
-function trustCmd(pubkey, label, json) {
-    if (!pubkey) {
-        process.stderr.write(colors.error(`${symbols.error} Need a public key (base64)\n`));
-        return 2;
-    }
-    trustKey(pubkey, label);
-    if (json) {
-        process.stdout.write(JSON.stringify({ ok: true, fingerprint: shortFingerprint(pubkey) }) + '\n');
-    }
-    else {
-        process.stdout.write(colors.green(`${symbols.success} trusted ${shortFingerprint(pubkey)}\n`));
-    }
-    return 0;
-}
-function untrustCmd(pubkey, json) {
-    if (!pubkey) {
-        process.stderr.write(colors.error(`${symbols.error} Need a public key (base64)\n`));
-        return 2;
-    }
-    const ok = untrustKey(pubkey);
-    if (json) {
-        process.stdout.write(JSON.stringify({ ok }) + '\n');
-    }
-    else if (ok) {
-        process.stdout.write(colors.green(`${symbols.success} untrusted ${shortFingerprint(pubkey)}\n`));
-    }
-    else {
-        process.stdout.write(colors.gray(`${symbols.dot} key not in trust store (or it's this machine's own key — can't remove)\n`));
-    }
-    return 0;
-}
-function safeHostname() {
-    try {
-        return hostname();
-    }
-    catch {
-        return undefined;
-    }
-}
-// Public alias for the connection-status check used in the daemon HTTP routes.
-export { isKeyTrusted };
-//# sourceMappingURL=thread-command.js.map

package/dist/presentation/cli/commands/trust-command.js

@@ -1,306 +0,0 @@
-/**
- * CLI Command: trust
- *
- * Layer 0 trust scorer — instant static analysis, zero API calls.
- * Runs on a file, directory, or piped git diff.
- *
- * Produces a trust score 0–100 with plain-English explanation:
- *   100 = no findings
- *   80+ = minor issues, safe to merge
- *   60-79 = review recommended
- *   40-59 = high-risk, human review required
- *   < 40 = block until resolved
- *
- * Usage:
- *   codehere trust src/utils.ts          # score a file
- *   codehere trust .                     # score all files in directory
- *   git diff HEAD | codehere trust       # score a diff
- *   codehere trust --diff HEAD           # equivalent using git directly
- *   codehere trust --badge               # output badge markdown
- */
-import { existsSync } from 'fs';
-import { join, relative, isAbsolute } from 'path';
-import { execFileSync } from 'child_process';
-import { scoreFile } from '../../../infrastructure/security/trust-scorer.js';
-import { collectCodeFiles } from '../../../infrastructure/security/file-collection.js';
-import { colors, sectionHeader, error, newline, info, randomCleanScan } from '../../../ui.js';
-import { loadProductContext, adjustRecommendation } from '../../../infrastructure/config/product-context.js';
-// ── File collection ──────────────────────────────────────────────────────────
-// See src/infrastructure/security/file-collection.ts for exclusion rules.
-/**
- * Read a file safely — handles iCloud-evicted files on macOS.
- * readFileSync blocks forever on iCloud-evicted files (dehydrated placeholders in ~/Documents).
- * We use cat with a timeout as a subprocess so the main thread never blocks.
- */
-function safeReadFile(filepath) {
-    try {
-        return execFileSync('cat', [filepath], { encoding: 'utf-8', timeout: 2000, maxBuffer: 5 * 1024 * 1024 });
-    }
-    catch {
-        return null; // File unreadable (iCloud-evicted, permissions, too large) — skip silently
-    }
-}
-// ── Git diff mode ────────────────────────────────────────────────────────────
-function parseDiffFiles(diff) {
-    const files = [];
-    const fileBlocks = diff.split(/^diff --git /m).filter(Boolean);
-    for (const block of fileBlocks) {
-        const filenameMatch = block.match(/^a\/(.+?) b\/(.+?)$/m);
-        if (!filenameMatch)
-            continue;
-        const filepath = filenameMatch[2];
-        // Skip internal backup/cache directories to avoid false findings from old code
-        if (filepath.startsWith('.codehere/') || filepath.startsWith('.codehere-cache/'))
-            continue;
-        // Extract added lines only (lines starting with +, excluding +++)
-        const addedLines = block
-            .split('\n')
-            .filter((l) => l.startsWith('+') && !l.startsWith('+++'))
-            .map((l) => l.substring(1))
-            .join('\n');
-        if (addedLines.trim()) {
-            files.push({ filepath, code: addedLines });
-        }
-    }
-    return files;
-}
-// ── Report formatting ────────────────────────────────────────────────────────
-function gradeColor(grade) {
-    switch (grade) {
-        case 'A':
-            return colors.green(grade);
-        case 'B':
-            return colors.cyan(grade);
-        case 'C':
-            return colors.yellow(grade);
-        case 'D':
-            return colors.red(grade);
-        case 'F':
-            return colors.red(colors.bold(grade));
-        default:
-            return grade;
-    }
-}
-function scoreBar(score, width = 20) {
-    const filled = Math.round((score / 100) * width);
-    const bar = '█'.repeat(filled) + '░'.repeat(width - filled);
-    if (score >= 75)
-        return colors.green(bar);
-    if (score >= 60)
-        return colors.yellow(bar);
-    return colors.red(bar);
-}
-function badgeMarkdown(report) {
-    const color = report.grade === 'A'
-        ? 'brightgreen'
-        : report.grade === 'B'
-            ? 'green'
-            : report.grade === 'C'
-                ? 'yellow'
-                : report.grade === 'D'
-                    ? 'orange'
-                    : 'red';
-    return `![codehere trust](https://img.shields.io/badge/codehere%20trust-${report.overallScore}%25%20${report.grade}-${color}?logo=shield)`;
-}
-// ── Main command ─────────────────────────────────────────────────────────────
-export async function executeTrustCommand(target, options = {}) {
-    const cwd = process.cwd();
-    let filesToScan = [];
-    // ── Input source ──────────────────────────────────────────────────────────
-    if (options.diff !== undefined) {
-        // Run git diff and scan added lines
-        try {
-            // THREAT-2 fix · ref comes from a user-supplied CLI flag. Using template-
-            // string interpolation with execSync allows shell metacharacters in `ref`
-            // (e.g. `--diff "main; rm -rf /"`) to escape the git invocation. Use the
-            // execFileSync array form so the shell is never invoked.
-            const ref = options.diff || 'HEAD';
-            const diffOutput = execFileSync('git', ['diff', ref], { cwd, encoding: 'utf-8' });
-            filesToScan = parseDiffFiles(diffOutput);
-            if (filesToScan.length === 0) {
-                console.log(info('No changed files to scan'));
-                return;
-            }
-        }
-        catch (e) {
-            console.error(error('git diff failed: ' + String(e)));
-            process.exit(1);
-        }
-    }
-    else if (!process.stdin.isTTY && !target) {
-        // Piped input (e.g., git diff HEAD | codehere trust)
-        let diffInput = '';
-        for await (const chunk of process.stdin) {
-            diffInput += chunk;
-        }
-        if (diffInput.trim().startsWith('diff --git')) {
-            filesToScan = parseDiffFiles(diffInput);
-        }
-        else {
-            // Treat as raw code
-            filesToScan = [{ filepath: 'stdin', code: diffInput }];
-        }
-        if (filesToScan.length === 0) {
-            console.log(info('No content to scan'));
-            return;
-        }
-    }
-    else {
-        // File or directory
-        const resolved = target ? (isAbsolute(target) ? target : join(cwd, target)) : cwd;
-        if (!existsSync(resolved)) {
-            console.error(error(`Not found: ${resolved}`));
-            process.exit(1);
-        }
-        const paths = collectCodeFiles(resolved);
-        let skippedCount = 0;
-        for (const p of paths) {
-            const code = safeReadFile(p);
-            if (code !== null) {
-                filesToScan.push({ filepath: relative(cwd, p), code });
-            }
-            else {
-                skippedCount++;
-            }
-        }
-        if (skippedCount > 0) {
-            console.log(colors.dim(`  Skipped ${skippedCount} unreadable file${skippedCount > 1 ? 's' : ''}`));
-        }
-        if (filesToScan.length === 0 && skippedCount > 0) {
-            console.log(info('No readable files to scan.'));
-            console.log(colors.dim('  Check file permissions or availability and retry.'));
-            return;
-        }
-    }
-    // ── Scan ──────────────────────────────────────────────────────────────────
-    const results = filesToScan.map((f) => scoreFile(f.filepath, f.code));
-    const totalFindings = results.reduce((s, r) => s + r.findings.length, 0);
-    const criticalCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'critical').length, 0);
-    const highCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'high').length, 0);
-    const mediumCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'medium').length, 0);
-    const lowCount = results.reduce((s, r) => s + r.findings.filter((f) => f.severity === 'low').length, 0);
-    const overallScore = results.length > 0 ? Math.round(results.reduce((s, r) => s + r.score, 0) / results.length) : 100;
-    const grade = overallScore >= 90 ? 'A' : overallScore >= 75 ? 'B' : overallScore >= 60 ? 'C' : overallScore >= 40 ? 'D' : 'F';
-    const baseRecommendation = criticalCount > 0
-        ? `${criticalCount} critical ${criticalCount === 1 ? 'issue' : 'issues'} — worth sorting before this merges.`
-        : highCount > 0
-            ? `Nothing critical, but ${highCount} high-severity ${highCount === 1 ? 'pattern' : 'patterns'} worth a look.`
-            : mediumCount + lowCount > 0
-                ? `${mediumCount + lowCount} low-priority ${mediumCount + lowCount === 1 ? 'finding' : 'findings'} — nothing blocking, but worth a pass.`
-                : 'Clean scan. Nothing blocking a merge.';
-    const productCtx = loadProductContext(process.cwd());
-    const recommendation = adjustRecommendation(baseRecommendation, criticalCount, highCount, overallScore, productCtx);
-    const report = {
-        files: results,
-        overallScore,
-        grade,
-        totalFindings,
-        criticalCount,
-        highCount,
-        mediumCount,
-        lowCount,
-        recommendation,
-        scannedAt: new Date().toISOString(),
-    };
-    // Track CI failure — will throw after display so the CLI action handler catches it
-    const ciFailed = options.ci && (overallScore < 60 || criticalCount > 0);
-    // ── Output ────────────────────────────────────────────────────────────────
-    if (options.json) {
-        console.log(JSON.stringify(report, null, 2));
-        if (options.ci && (overallScore < 60 || criticalCount > 0))
-            process.exit(1);
-        return;
-    }
-    if (options.badge) {
-        console.log(badgeMarkdown(report));
-        return;
-    }
-    // Human-readable report
-    newline();
-    sectionHeader('codehere Trust Report');
-    newline();
-    // Score
-    console.log(`  Score    ${scoreBar(overallScore)}  ${colors.bold(String(overallScore))}/100  ${gradeColor(grade)}`);
-    newline();
-    // Findings summary (inline, compact)
-    const parts = [
-        criticalCount > 0 ? colors.red(`${criticalCount} critical`) : null,
-        highCount > 0 ? colors.yellow(`${highCount} high`) : null,
-        mediumCount > 0 ? colors.dim(`${mediumCount} medium`) : null,
-        lowCount > 0 ? colors.dim(`${lowCount} low`) : null,
-    ].filter(Boolean);
-    if (parts.length === 0) {
-        console.log(`  ${colors.green('✓')} ${randomCleanScan()}`);
-    }
-    else {
-        console.log(`  ${parts.join(colors.dim('  ·  '))}`);
-    }
-    newline();
-    // Per-file results (show worst first)
-    if (results.length > 1) {
-        const sorted = [...results].sort((a, b) => a.score - b.score);
-        console.log(colors.dim('  FILES'));
-        for (const r of sorted.slice(0, 10)) {
-            const icon = r.score >= 75 ? colors.green('✓') : r.score >= 60 ? colors.yellow('!') : colors.red('✗');
-            console.log(`  ${icon} ${gradeColor(r.grade)}  ${String(r.score).padStart(3)}/100  ${r.filepath}`);
-        }
-        if (sorted.length > 10) {
-            console.log(colors.dim(`  + ${sorted.length - 10} more files`));
-        }
-        newline();
-    }
-    // Findings detail
-    if (options.verbose) {
-        console.log(colors.dim('  FINDINGS'));
-        for (const r of results) {
-            if (r.findings.length === 0)
-                continue;
-            console.log(`  ${colors.bold(r.filepath)}`);
-            for (const f of r.findings) {
-                const sev = f.severity === 'critical'
-                    ? colors.red('crit')
-                    : f.severity === 'high'
-                        ? colors.yellow('high')
-                        : colors.dim(f.severity.slice(0, 4));
-                const ln = f.line ? colors.dim(`L${f.line}`) : '';
-                console.log(`    ${sev}  ${ln.padEnd(6)} ${f.description}`);
-            }
-        }
-        newline();
-    }
-    else if (totalFindings > 0) {
-        console.log(colors.dim('  FINDINGS'));
-        const severityRank = { critical: 0, high: 1, medium: 2, low: 3 };
-        const allFindings = results.flatMap((r) => r.findings.map((f) => ({ ...f, filepath: r.filepath })));
-        const sorted = allFindings.sort((a, b) => severityRank[a.severity] - severityRank[b.severity]);
-        for (const f of sorted.slice(0, 5)) {
-            const sev = f.severity === 'critical'
-                ? colors.red('crit')
-                : f.severity === 'high'
-                    ? colors.yellow('high')
-                    : colors.dim(f.severity.slice(0, 4));
-            const ln = f.line ? `:${f.line}` : '';
-            console.log(`  ${sev}  ${f.filepath}${ln}`);
-            console.log(`        ${colors.dim(f.description)}`);
-        }
-        if (sorted.length > 5) {
-            console.log(colors.dim(`  + ${sorted.length - 5} more findings (use --verbose to see all)`));
-        }
-        newline();
-    }
-    // Recommendation
-    const recColor = criticalCount > 0 ? colors.red : highCount > 0 ? colors.yellow : colors.green;
-    console.log(recColor(recommendation));
-    newline();
-    // Tips footer (quiet, separated)
-    if (results.length > 0 && !options.ci) {
-        console.log(colors.dim('  ─────'));
-        console.log(colors.dim('  trust --badge  Add a badge to your README'));
-        console.log(colors.dim('  trust --ci     Exit 1 on critical findings'));
-        newline();
-    }
-    if (ciFailed) {
-        throw new Error(`CI_FAIL:${criticalCount > 0 ? criticalCount + ' critical finding(s)' : 'score ' + overallScore + ' below threshold 60'}`);
-    }
-}
-//# sourceMappingURL=trust-command.js.map