codehere 1.0.1 → 1.0.2

package/dist/infrastructure/cost/team-ledger.js

@@ -1,355 +0,0 @@
-import { writeFileAtomic } from '../storage/atomic-write.js';
-/**
- * The local-first team cost+audit ledger: the shared data layer.
- *
- * codehere is per-machine by design (code never leaves the box). A small team
- * is several boxes, so each machine drops its daily spend + audit roll-up into a
- * directory the team controls (their OWN git repo / shared drive, NOT a
- * codehere relay), and any machine can merge them into one team view. This
- * module is the single owner of that logic so BOTH surfaces read the same core:
- * the CLI (`codehere team`) and the daemon (`GET /api/team`). Spend is the same
- * ESTIMATE the rest of codehere uses (tokens x published rate), never a real
- * invoice.
- */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'fs';
-import { execFileSync } from 'child_process';
-import { sign as cryptoSign, verify as cryptoVerify, createPublicKey } from 'crypto';
-import { join, isAbsolute, resolve } from 'path';
-import { homedir, hostname } from 'os';
-import { computeSpendToday } from './spend-aggregator.js';
-import { verifyAuditChain } from '../hooks/claude-sdk-hook.js';
-import { loadOrCreateKeypair } from '../orchestration/thread-key-store.js';
-import { getOrCreateToken } from '../protocols/cloud-sync.js';
-export function codehereHome() {
-    return join(process.env.CODEHERE_HOME || homedir(), '.codehere');
-}
-export function machineId() {
-    return `${hostname()}-${getOrCreateToken().slice(0, 8)}`;
-}
-export function todayStr() {
-    const d = new Date();
-    const p = (n) => String(n).padStart(2, '0');
-    return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
-}
-export function loadTeamConfig() {
-    const cfg = { dir: null, dailyUsd: null };
-    const path = join(codehereHome(), 'team.yaml');
-    if (!existsSync(path))
-        return cfg;
-    try {
-        for (const rawLine of readFileSync(path, 'utf-8').split('\n')) {
-            const line = rawLine.replace(/#.*$/, '').trim();
-            const idx = line.indexOf(':');
-            if (idx === -1)
-                continue;
-            const key = line.slice(0, idx).trim();
-            const val = line.slice(idx + 1).trim();
-            // A team dir must be ABSOLUTE: a relative value silently resolves against
-            // whatever cwd the daemon/CLI happens to run from — the record then lives
-            // wherever you stood. Found live 2026-07-07: a client bug wrote the literal
-            // string "undefined" on Jul 1 and six days of shares landed in agent/undefined/.
-            if (key === 'dir' && val && val !== 'undefined' && val !== 'null' && isAbsolute(val))
-                cfg.dir = val;
-            if (key === 'daily_usd') {
-                const num = Number(val);
-                cfg.dailyUsd = Number.isFinite(num) && num > 0 ? num : null;
-            }
-        }
-    }
-    catch {
-        /* corrupt file -> defaults; never break the caller */
-    }
-    return cfg;
-}
-export function saveTeamConfig(cfg) {
-    const dir = codehereHome();
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-    // Normalize on write: a dir persists only as an absolute path (see the
-    // loadTeamConfig guard for the live incident this closes).
-    const dirLine = cfg.dir && cfg.dir !== 'undefined' && cfg.dir !== 'null'
-        ? `dir: ${resolve(cfg.dir)}`
-        : '# dir: /path/to/team-shared-dir';
-    const lines = [
-        '# codehere team spend ledger. The shared dir is yours (keep it in your own git repo).',
-        '# codehere never sends this anywhere, it only reads/writes the folder below.',
-        dirLine,
-        cfg.dailyUsd !== null ? `daily_usd: ${cfg.dailyUsd}` : '# daily_usd: 50',
-        '',
-    ];
-    writeFileAtomic(join(codehereHome(), 'team.yaml'), lines.join('\n'));
-}
-/** Pure merge of every machine's daily spend into one team view. */
-export function mergeTeamSpend(shares) {
-    const perAgent = {};
-    const perAgentSessions = {};
-    const perProject = {};
-    const practice = { usd: 0, sessions: 0 };
-    let teamTotal = 0;
-    for (const m of shares) {
-        teamTotal += m.totalUsd;
-        for (const [agent, usd] of Object.entries(m.byAgent))
-            perAgent[agent] = (perAgent[agent] ?? 0) + usd;
-        for (const [agent, n] of Object.entries(m.byAgentSessions ?? {}))
-            perAgentSessions[agent] = (perAgentSessions[agent] ?? 0) + n;
-        for (const [proj, usd] of Object.entries(m.byProject ?? {}))
-            perProject[proj] = (perProject[proj] ?? 0) + usd;
-        practice.usd += m.practiceUsd ?? 0;
-        practice.sessions += m.practiceSessions ?? 0;
-    }
-    return { teamTotal, perAgent, perAgentSessions, perProject, practice };
-}
-/** Pure merge of the audit roll-up: total recorded actions + any machine whose
- *  chain failed integrity (a broken chain is the one thing a team must see). */
-export function mergeTeamActivity(shares) {
-    let totalActions = 0;
-    const broken = [];
-    for (const m of shares) {
-        if (!m.audit)
-            continue;
-        totalActions += m.audit.actions;
-        if (!m.audit.chainOk)
-            broken.push(m.machineId);
-    }
-    return { totalActions, broken };
-}
-/** This machine's current spend + audit snapshot (computed live, not read). */
-export function myShare() {
-    const spend = computeSpendToday();
-    const byAgent = {};
-    const byAgentSessions = {};
-    for (const [agent, v] of Object.entries(spend.byAgent)) {
-        byAgent[agent] = v.usd;
-        byAgentSessions[agent] = v.sessions;
-    }
-    const byProject = {};
-    for (const [proj, v] of Object.entries(spend.byProject))
-        byProject[proj] = v.usd;
-    const chain = verifyAuditChain();
-    return {
-        machineId: machineId(),
-        date: todayStr(),
-        totalUsd: spend.totalUsd,
-        byAgent,
-        byAgentSessions,
-        byProject,
-        practiceUsd: spend.practice.usd,
-        practiceSessions: spend.practice.sessions,
-        updatedAt: new Date().toISOString(),
-        audit: { actions: chain.totalEntries, chainOk: chain.valid },
-    };
-}
-/** Deterministic bytes of a share for signing/verifying: everything EXCEPT the
- *  signature field, with object keys sorted at every level so sign-time and
- *  read-time produce identical input regardless of property order. */
-function canonicalShareBytes(m) {
-    const { signature: _omit, ...rest } = m;
-    return JSON.stringify(rest, (_k, v) => v && typeof v === 'object' && !Array.isArray(v)
-        ? Object.fromEntries(Object.keys(v)
-            .sort()
-            .map((k) => [k, v[k]]))
-        : v);
-}
-/** Verdict for one share's signature. 'unsigned' (no sig) ≠ 'tampered' (sig
- *  present but doesn't match) — BLOCKED-vs-FAIL discipline. */
-export function verifyShareSignature(m) {
-    if (!m.signature || m.signature.alg !== 'ed25519')
-        return 'unsigned';
-    try {
-        const pubKey = createPublicKey({ key: Buffer.from(m.signature.pubkey, 'base64'), format: 'der', type: 'spki' });
-        const ok = cryptoVerify(null, Buffer.from(canonicalShareBytes(m), 'utf-8'), pubKey, Buffer.from(m.signature.sig, 'base64'));
-        return ok ? 'signed' : 'tampered';
-    }
-    catch {
-        return 'tampered'; // malformed sig/key reads as not-verifiable, fail-closed
-    }
-}
-/** Trust anchor (known_hosts / TOFU model): machineId → the pubkey first seen for
- *  it. A self-signature alone is defeatable (an attacker edits a share, makes a
- *  fresh key, re-signs, swaps the embedded pubkey → self-verifies). Pinning the
- *  first-seen key per machine turns a later KEY CHANGE into the tamper signal.
- *  Stored on the VIEWER's machine, so each teammate pins what they've seen. */
-function knownKeysPath() {
-    return join(codehereHome(), 'team-known-keys.json');
-}
-export function loadKnownKeys() {
-    try {
-        return JSON.parse(readFileSync(knownKeysPath(), 'utf-8'));
-    }
-    catch {
-        return {};
-    }
-}
-function saveKnownKeys(keys) {
-    try {
-        writeFileAtomic(knownKeysPath(), JSON.stringify(keys, null, 2));
-    }
-    catch {
-        /* best-effort pin store */
-    }
-}
-/** Per-team signature roll-up against the trust anchor:
- *   - unsigned: no signature (legacy / signing unavailable) — BLOCKED, not FAIL.
- *   - tampered: signature doesn't self-verify, OR a KNOWN machine's key changed
- *               (re-signed by someone else) — the real forgery catch.
- *   - firstSeen: signed + first sight of this machine's key → caller should pin.
- *  Pure: knownKeys in, firstSeen out; buildTeamView does the I/O. */
-export function mergeTeamSignatures(shares, knownKeys = {}) {
-    const tampered = [];
-    const unsigned = [];
-    const firstSeen = {};
-    for (const m of shares) {
-        const v = verifyShareSignature(m);
-        if (v === 'unsigned') {
-            unsigned.push(m.machineId);
-            continue;
-        }
-        if (v === 'tampered') {
-            tampered.push(m.machineId);
-            continue;
-        }
-        // self-verifies — now check it against the key we first pinned for this machine
-        const pubkey = m.signature.pubkey;
-        const pinned = knownKeys[m.machineId];
-        if (pinned && pinned !== pubkey)
-            tampered.push(m.machineId); // key changed = re-signed forgery
-        else if (!pinned)
-            firstSeen[m.machineId] = pubkey; // TOFU: trust on first sight
-    }
-    return { tampered, unsigned, firstSeen };
-}
-/** Write this machine's snapshot into the team dir's spend/ folder, ed25519-signed
- *  with the machine's persisted key so a teammate can detect post-write edits. */
-export function writeMyShare(dir) {
-    const mine = myShare();
-    try {
-        const keys = loadOrCreateKeypair();
-        const sig = cryptoSign(null, Buffer.from(canonicalShareBytes(mine), 'utf-8'), keys.privateKey);
-        const pubRaw = keys.publicKey.export({ format: 'der', type: 'spki' });
-        mine.signature = { alg: 'ed25519', pubkey: pubRaw.toString('base64'), sig: sig.toString('base64') };
-    }
-    catch {
-        /* signing is best-effort — an unsigned share is flagged on read, never a crash */
-    }
-    const spendDir = join(dir, 'spend');
-    if (!existsSync(spendDir))
-        mkdirSync(spendDir, { recursive: true });
-    writeFileAtomic(join(spendDir, `${mine.machineId}.json`), JSON.stringify(mine, null, 2));
-    return mine;
-}
-/** Create a shareable team dir: ensure spend/, git-init it (best-effort), and a
- *  README. Shared by `codehere team init` (CLI) and POST /api/team/init (daemon)
- *  so both surfaces create a team the same way. */
-export function initTeamDir(dir) {
-    mkdirSync(join(dir, 'spend'), { recursive: true });
-    if (!isGitRepo(dir)) {
-        try {
-            execFileSync('git', ['init', '-q', '--', dir]);
-        }
-        catch {
-            /* git missing — still usable as a plain shared folder */
-        }
-    }
-    const readme = join(dir, 'README.md');
-    if (!existsSync(readme)) {
-        writeFileSync(readme, '# codehere team ledger\n\nShared cost + integrity record for this team. Each machine writes its own\nsnapshot under `spend/`. Keep this folder in a git repo your team controls —\ncodehere only reads/writes here; nothing leaves your machines.\n');
-    }
-}
-/** Read every machine's TODAY snapshot from the team dir, corruption-tolerant. */
-export function readAllShares(dir) {
-    const spendDir = join(dir, 'spend');
-    if (!existsSync(spendDir))
-        return [];
-    const out = [];
-    for (const file of readdirSync(spendDir)) {
-        if (!file.endsWith('.json'))
-            continue;
-        try {
-            const m = JSON.parse(readFileSync(join(spendDir, file), 'utf-8'));
-            if (m && m.date === todayStr() && typeof m.totalUsd === 'number')
-                out.push(m);
-        }
-        catch {
-            /* skip a corrupt teammate file rather than fail the whole view */
-        }
-    }
-    return out;
-}
-/** Assemble the merged TeamView from what's currently in the dir (read-only). */
-export function buildTeamView(dir, dailyUsd) {
-    const machines = readAllShares(dir).sort((a, b) => b.totalUsd - a.totalUsd);
-    const { teamTotal, perAgent, perAgentSessions, perProject, practice } = mergeTeamSpend(machines);
-    const { totalActions, broken } = mergeTeamActivity(machines);
-    const known = loadKnownKeys();
-    const { tampered, unsigned, firstSeen } = mergeTeamSignatures(machines, known);
-    if (Object.keys(firstSeen).length)
-        saveKnownKeys({ ...known, ...firstSeen }); // pin newly-seen teammate keys
-    return {
-        date: todayStr(),
-        myMachineId: machineId(),
-        machines,
-        teamTotal,
-        perAgent,
-        perAgentSessions,
-        perProject,
-        practice,
-        totalActions,
-        brokenChains: broken,
-        tamperedShares: tampered,
-        unsignedShares: unsigned,
-        dailyUsd,
-    };
-}
-// ── git sync ─────────────────────────────────────────────────────────────────
-// The team dir should be a DEDICATED git repo the team controls. Single-owner
-// per-machine files (spend/<id>.json) never conflict. All git ops are
-// best-effort: any failure (no remote, offline, not a repo) degrades to plain
-// shared-dir mode and never breaks the view.
-function git(dir, args, timeout = 20_000) {
-    execFileSync('git', args, { cwd: dir, stdio: 'ignore', timeout });
-}
-export function isGitRepo(dir) {
-    try {
-        git(dir, ['rev-parse', '--is-inside-work-tree'], 5_000);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function gitPull(dir) {
-    try {
-        git(dir, ['pull', '--quiet', '--no-edit']);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Stage + commit ONLY this machine's snapshot (never `git add -A`), then push. */
-export function gitShareMine(dir, relFile) {
-    try {
-        git(dir, ['add', relFile]);
-        let hasChange = false;
-        try {
-            git(dir, ['diff', '--cached', '--quiet']); // exit 0 = nothing staged
-        }
-        catch {
-            hasChange = true; // exit 1 = staged change present
-        }
-        if (!hasChange)
-            return 'nochange';
-        git(dir, ['commit', '-q', '-m', `team snapshot: ${machineId()}`]);
-        try {
-            git(dir, ['push', '--quiet']);
-            return 'pushed';
-        }
-        catch {
-            return 'committed-local'; // no remote / offline; still recorded locally
-        }
-    }
-    catch {
-        return 'failed';
-    }
-}
-//# sourceMappingURL=team-ledger.js.map

package/dist/infrastructure/discovery/discovery-log.js

@@ -1,85 +0,0 @@
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'fs';
-import { homedir, hostname } from 'os';
-import { dirname, join } from 'path';
-// Continuous-discovery instrument (Teresa Torres / producttalk.org method).
-// Two jobs, both local-first and best-effort:
-//  1. record a behavioural signal, "the record was opened on this machine", deduped
-//     per local day so a polling dashboard can't inflate it. Honest scope: each member
-//     runs their own local daemon, so this is a PER-MACHINE-LOCAL signal (the operator's
-//     own opens); it is NOT yet aggregated across the team into one cross-machine number.
-//  2. expose the in-product recruiting link (the scheduler) for the interview hook.
-// Never throws into a request handler; state lives on disk under ~/.codehere.
-function discoveryFile() {
-    return join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'discovery.jsonl');
-}
-function localDate(now) {
-    const y = now.getFullYear();
-    const m = String(now.getMonth() + 1).padStart(2, '0');
-    const d = String(now.getDate()).padStart(2, '0');
-    return `${y}-${m}-${d}`;
-}
-function readEvents() {
-    try {
-        if (!existsSync(discoveryFile()))
-            return [];
-        return readFileSync(discoveryFile(), 'utf-8')
-            .split('\n')
-            .filter(Boolean)
-            .map((l) => {
-            try {
-                return JSON.parse(l);
-            }
-            catch {
-                return null;
-            }
-        })
-            .filter((e) => !!e && e.t === 'record-open' && typeof e.machine === 'string' && typeof e.date === 'string');
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Record that the shared record was opened on this machine, once per local day.
- * A per-machine-local behavioural proxy (each member's daemon records its own opens;
- * not yet aggregated across the team). Deduped so polling can't inflate it. Best-effort.
- */
-export function recordOpenOncePerDay(machine = hostname(), now = new Date()) {
-    try {
-        const date = localDate(now);
-        for (const e of readEvents()) {
-            if (e.machine === machine && e.date === date)
-                return; // already counted today
-        }
-        mkdirSync(dirname(discoveryFile()), { recursive: true });
-        const entry = { t: 'record-open', machine, date, at: now.toISOString() };
-        appendFileSync(discoveryFile(), JSON.stringify(entry) + '\n');
-    }
-    catch {
-        /* best-effort: a discovery metric must never break a request */
-    }
-}
-export function discoverySummary(now = new Date()) {
-    const events = readEvents();
-    if (!events.length)
-        return { recordOpenDays: 0, lastOpen: null, weeklyActive: false };
-    const days = new Set(events.map((e) => e.date));
-    const times = events
-        .map((e) => Date.parse(e.at))
-        .filter((n) => !Number.isNaN(n))
-        .sort((a, b) => b - a);
-    const lastOpen = times.length ? new Date(times[0]).toISOString() : null;
-    const weeklyActive = times.length ? times[0] >= now.getTime() - 7 * 24 * 60 * 60 * 1000 : false;
-    return { recordOpenDays: days.size, lastOpen, weeklyActive };
-}
-/**
- * The interview scheduler link for the in-product recruiting hook.
- * Opt-in: empty string hides the hook entirely (so the dashboard is unchanged by
- * default). Set CODEHERE_DISCOVERY_URL to a scheduler (Calendly-style) to enable it.
- */
-export function recruitUrl() {
-    const url = (process.env.CODEHERE_DISCOVERY_URL || '').trim();
-    // Only http(s) — block javascript:/data: so the in-product link can never execute.
-    return /^https?:\/\//i.test(url) ? url : '';
-}
-//# sourceMappingURL=discovery-log.js.map