codehere 1.0.1 → 1.0.2

package/dist/presentation/cli/commands/context-source-command.js

@@ -1,217 +0,0 @@
-/**
- * CLI: `codehere context-source` · v0.8 S2.5
- *
- * Subcommands:
- *   list                  · show every registered provider + connection status
- *   connect <provider>    · open the browser to begin OAuth · prints URL
- *   disconnect <provider> · clear the stored OAuth token
- *
- * Talks to the running daemon at 127.0.0.1:3773. If the daemon isn't running,
- * we print a clear message rather than starting one silently.
- */
-import { colors, symbols } from '../../../ui.js';
-import { spawn } from 'child_process';
-const DAEMON_BASE = process.env.CODEHERE_DAEMON_URL || 'http://127.0.0.1:3773';
-export async function executeContextSourceCommand(sub, arg, options = {}) {
-    switch (sub) {
-        case undefined:
-        case 'list':
-            return list(options.json ?? false);
-        case 'connect':
-            return connect(arg, options.json ?? false, options.open !== false);
-        case 'disconnect':
-            return disconnect(arg, options.json ?? false);
-        default:
-            process.stderr.write(colors.error(`${symbols.error} Unknown subcommand: ${sub}\n`) +
-                colors.dim('Try: codehere context-source list | connect <provider> | disconnect <provider>\n'));
-            return 2;
-    }
-}
-async function fetchJson(path, init = {}) {
-    try {
-        const r = await fetch(DAEMON_BASE + path, init);
-        if (!r.ok) {
-            const text = await r.text();
-            return { ok: false, status: r.status, error: text };
-        }
-        return { ok: true, status: r.status, data: (await r.json()) };
-    }
-    catch (err) {
-        return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
-    }
-}
-function daemonUnreachableNote(err) {
-    return (colors.error(`${symbols.error} Daemon not reachable at ${DAEMON_BASE}.\n`) +
-        colors.dim(`   Start it with: `) +
-        colors.bold('codehere start') +
-        '\n' +
-        colors.dim(`   Detail: ${err}\n`));
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* list                                                                      */
-/* ──────────────────────────────────────────────────────────────────────── */
-async function list(json) {
-    const r = await fetchJson('/api/context-sources');
-    if (!r.ok) {
-        if (json) {
-            process.stdout.write(JSON.stringify({ error: 'daemon_unreachable', detail: r.error }, null, 2) + '\n');
-        }
-        else {
-            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
-        }
-        return 2;
-    }
-    const items = r.data?.providers ?? [];
-    if (json) {
-        process.stdout.write(JSON.stringify({ providers: items }, null, 2) + '\n');
-        return 0;
-    }
-    process.stdout.write('\n' + colors.bold('Context sources') + '\n\n');
-    if (!items.length) {
-        process.stdout.write(colors.dim('  (no providers registered)\n\n'));
-        return 0;
-    }
-    for (const p of items) {
-        const tag = statusTag(p.status);
-        const who = p.userLabel ? colors.gray('· ' + p.userLabel) : '';
-        process.stdout.write(`  ${tag}  ${colors.bold(p.label.padEnd(10))} ${colors.dim(p.scheme + '://')} ${who}\n`);
-        if (!p.clientIdConfigured) {
-            process.stdout.write('       ' + colors.warning(`set CODEHERE_${p.id.toUpperCase()}_CLIENT_ID before connect()`) + '\n');
-        }
-    }
-    process.stdout.write('\n' + colors.dim('Connect: ') + colors.bold('codehere context-source connect <provider>') + '\n\n');
-    return 0;
-}
-function statusTag(s) {
-    switch (s) {
-        case 'connected':
-            return colors.green('● connected   ');
-        case 'expired':
-            return colors.warning('● expired     ');
-        case 'manual':
-            return colors.gray('● manual      ');
-        case 'disconnected':
-            return colors.gray('○ disconnected');
-        default:
-            // A status this CLI doesn't know yet must never print "undefined"
-            // (2026-06-07 audit, Lane C: draw.io/GitHub rows did exactly that).
-            return colors.gray(('○ ' + String(s ?? 'unknown')).padEnd(14).slice(0, 14));
-    }
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* connect                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-async function connect(providerArg, json, openBrowser) {
-    if (!providerArg) {
-        process.stderr.write(colors.error(`${symbols.error} Need a provider id: codehere context-source connect <id>\n`));
-        return 2;
-    }
-    const r = await fetchJson(`/api/context-sources/${encodeURIComponent(providerArg)}/connect`, { method: 'POST' });
-    if (!r.ok) {
-        let detail = null;
-        try {
-            detail = JSON.parse(r.error ?? '{}');
-        }
-        catch {
-            /* ignore */
-        }
-        if (detail?.error === 'provider_not_registered') {
-            const envVar = detail.envVar ?? `CODEHERE_${providerArg.toUpperCase()}_CLIENT_ID`;
-            if (json) {
-                process.stdout.write(JSON.stringify({ error: 'provider_not_registered', envVar, message: detail.message }, null, 2) + '\n');
-            }
-            else {
-                process.stderr.write(colors.error(`${symbols.error} ${providerArg} OAuth app not registered.\n`) +
-                    colors.dim(`   ${detail.message ?? ''}\n`) +
-                    colors.dim(`   Set the env var: `) +
-                    colors.bold(envVar) +
-                    '\n');
-            }
-            return 2;
-        }
-        if (json) {
-            process.stdout.write(JSON.stringify({ error: 'connect_failed', detail: r.error }, null, 2) + '\n');
-        }
-        else if (r.status === 0) {
-            // Only a NETWORK failure means the daemon is unreachable.
-            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
-        }
-        else {
-            // The daemon answered — show ITS message, don't blame the connection
-            // (2026-06-07 audit, Lane C: a 404 from a live daemon printed
-            // "Daemon not reachable").
-            let msg = r.error ?? `request failed (${r.status})`;
-            try {
-                const j = JSON.parse(msg);
-                msg = j.error || j.message || msg;
-            }
-            catch {
-                /* raw text is fine */
-            }
-            process.stderr.write(colors.error(`${symbols.error} ${providerArg}: ${msg}\n`));
-        }
-        return 2;
-    }
-    const url = r.data?.authorizeUrl;
-    if (!url) {
-        process.stderr.write(colors.error(`${symbols.error} Daemon did not return an authorize URL.\n`));
-        return 1;
-    }
-    if (json) {
-        process.stdout.write(JSON.stringify({ authorizeUrl: url }, null, 2) + '\n');
-        return 0;
-    }
-    process.stdout.write('\n' +
-        colors.bold(`Opening ${providerArg} OAuth flow`) +
-        '\n\n' +
-        colors.dim('  URL: ') +
-        url +
-        '\n\n' +
-        colors.dim('  Codehere will store the token at ~/.codehere/context-sources.json.\n') +
-        colors.dim('  You can close the browser tab when it says "connected".\n\n'));
-    if (openBrowser) {
-        openInBrowser(url);
-    }
-    return 0;
-}
-function openInBrowser(url) {
-    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
-    try {
-        const child = spawn(cmd, [url], { detached: true, stdio: 'ignore' });
-        child.unref();
-    }
-    catch {
-        // best-effort · the URL is already printed
-    }
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* disconnect                                                                 */
-/* ──────────────────────────────────────────────────────────────────────── */
-async function disconnect(providerArg, json) {
-    if (!providerArg) {
-        process.stderr.write(colors.error(`${symbols.error} Need a provider id: codehere context-source disconnect <id>\n`));
-        return 2;
-    }
-    const r = await fetchJson(`/api/context-sources/${encodeURIComponent(providerArg)}/disconnect`, { method: 'POST' });
-    if (!r.ok) {
-        if (json) {
-            process.stdout.write(JSON.stringify({ error: 'disconnect_failed', detail: r.error }, null, 2) + '\n');
-        }
-        else {
-            process.stderr.write(daemonUnreachableNote(r.error ?? ''));
-        }
-        return 2;
-    }
-    if (json) {
-        process.stdout.write(JSON.stringify(r.data) + '\n');
-        return 0;
-    }
-    if (r.data?.ok) {
-        process.stdout.write(colors.green(`${symbols.success} disconnected ${providerArg}\n`));
-    }
-    else {
-        process.stdout.write(colors.gray(`${symbols.dot} ${providerArg} was not connected\n`));
-    }
-    return 0;
-}
-//# sourceMappingURL=context-source-command.js.map

package/dist/presentation/cli/commands/hook-command.js

@@ -1,265 +0,0 @@
-/**
- * CLI Command: hook
- *
- * Manages Claude Code SDK hook integration.
- * Intercepts every Claude Code tool call and runs Layer 0 security scan.
- *
- * Usage:
- *   codehere hook install          # Add hooks to ~/.claude/settings.json
- *   codehere hook uninstall        # Remove hooks
- *   codehere hook status           # Show current hook config and recent events
- *   codehere hook log              # Show recent audit log
- *   codehere hook log --tail 50    # Last 50 events
- */
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, copyFileSync, unlinkSync, rmdirSync, } from 'fs';
-import { join, dirname } from 'path';
-import { homedir } from 'os';
-import { fileURLToPath } from 'url';
-import { generateHookConfig, AUDIT_FILE } from '../../../infrastructure/hooks/claude-sdk-hook.js';
-import { colors, success, error, warning, info, newline, sectionHeader } from '../../../ui.js';
-// ── Skills management ─────────────────────────────────────────────────────────
-const SKILLS_TARGET_DIR = join(homedir(), '.claude', 'commands', 'codehere');
-function getSkillsSourceDir() {
-    // When running from dist/, the .claude/commands dir is at package root
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    // dist/presentation/cli/commands → ../../../../.claude/commands
-    return join(__dirname, '..', '..', '..', '..', '.claude', 'commands');
-}
-function installSkills() {
-    const sourceDir = getSkillsSourceDir();
-    if (!existsSync(sourceDir))
-        return false;
-    if (!existsSync(SKILLS_TARGET_DIR)) {
-        mkdirSync(SKILLS_TARGET_DIR, { recursive: true });
-    }
-    const files = readdirSync(sourceDir).filter((f) => f.endsWith('.md'));
-    for (const file of files) {
-        copyFileSync(join(sourceDir, file), join(SKILLS_TARGET_DIR, file));
-    }
-    return files.length > 0;
-}
-function uninstallSkills() {
-    if (!existsSync(SKILLS_TARGET_DIR))
-        return;
-    try {
-        for (const file of readdirSync(SKILLS_TARGET_DIR)) {
-            unlinkSync(join(SKILLS_TARGET_DIR, file));
-        }
-        rmdirSync(SKILLS_TARGET_DIR);
-    }
-    catch {
-        /* ignore */
-    }
-}
-function skillsInstalled() {
-    return existsSync(SKILLS_TARGET_DIR) && readdirSync(SKILLS_TARGET_DIR).some((f) => f.endsWith('.md'));
-}
-const SETTINGS_PATH = join(homedir(), '.claude', 'settings.json');
-// ── helpers ──────────────────────────────────────────────────────────────────
-function readSettings() {
-    if (!existsSync(SETTINGS_PATH))
-        return {};
-    try {
-        return JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8'));
-    }
-    catch {
-        return {};
-    }
-}
-function writeSettings(settings) {
-    const dir = join(homedir(), '.claude');
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-    writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2) + '\n');
-}
-function isInstalled(settings) {
-    const hooks = (settings.hooks ?? {});
-    const preToolUse = (hooks.PreToolUse ?? []);
-    return preToolUse.some((entry) => entry.hooks?.some((h) => h.command?.includes('codehere scan-tool')));
-}
-// ── command ───────────────────────────────────────────────────────────────────
-export async function executeHookCommand(subcommand, options = {}) {
-    const sub = subcommand ?? 'status';
-    switch (sub) {
-        case 'install': {
-            const settings = readSettings();
-            if (isInstalled(settings)) {
-                console.log(warning('codehere hooks already installed'));
-                console.log(colors.dim(`  Config: ${SETTINGS_PATH}`));
-                console.log(colors.dim('  Run `codehere hook status` to see details'));
-                newline();
-                return;
-            }
-            const hookConfig = generateHookConfig({
-                logOnly: options.logOnly,
-                blockMode: options.blockMode,
-            });
-            // Merge with existing hooks config
-            const existingHooks = settings.hooks ?? {};
-            const mergedHooks = { ...existingHooks };
-            for (const [eventName, handlers] of Object.entries(hookConfig)) {
-                const existing = mergedHooks[eventName] ?? [];
-                mergedHooks[eventName] = [...existing, ...handlers];
-            }
-            settings.hooks = mergedHooks;
-            writeSettings(settings);
-            const skillsOk = installSkills();
-            console.log(success('codehere hooks installed'));
-            newline();
-            console.log(colors.bold('What happens now:'));
-            console.log('  Every Bash, Edit, Write, and MultiEdit call your AI makes is');
-            console.log('  scanned by codehere before it executes.');
-            console.log('  Zero API calls. < 5ms per scan. Runs entirely on your machine.');
-            newline();
-            console.log(colors.bold('Scan covers:'));
-            console.log('  • Prompt injection & jailbreak attempts');
-            console.log('  • Credential theft (API keys, SSH keys, env vars)');
-            console.log('  • Destructive operations (rm -rf, DB drops, force push)');
-            console.log('  • Code injection (curl|bash, reverse shells)');
-            console.log('  • Supply chain attacks (typosquatting packages)');
-            console.log('  • OWASP Top 10 patterns (SQLi, XSS, hardcoded secrets)');
-            newline();
-            console.log(colors.bold('Audit log:'));
-            console.log(colors.dim(`  ${AUDIT_FILE}`));
-            newline();
-            if (options.logOnly) {
-                console.log(warning('Mode: log-only (no blocking). Run without --log-only to enable blocking.'));
-                newline();
-            }
-            console.log(colors.dim('  Config written to: ' + SETTINGS_PATH));
-            if (skillsOk) {
-                console.log(colors.dim(`  Skills installed to: ${SKILLS_TARGET_DIR}`));
-                newline();
-                console.log(colors.bold('Slash commands now available in your AI assistant:'));
-                console.log(colors.dim('  /codehere:trust        · scan current project'));
-                console.log(colors.dim('  /codehere:report       · generate shareable audit report'));
-                console.log(colors.dim('  /codehere:audit        · pre-merge security check'));
-                console.log(colors.dim('  /codehere:hook-status  · check hook health'));
-            }
-            newline();
-            console.log(colors.dim('  Restart your AI assistant for changes to take effect.'));
-            newline();
-            break;
-        }
-        case 'uninstall': {
-            const settings = readSettings();
-            if (!isInstalled(settings)) {
-                console.log(info('codehere hooks are not installed'));
-                return;
-            }
-            const hooks = settings.hooks;
-            for (const [eventName, handlers] of Object.entries(hooks)) {
-                if (Array.isArray(handlers)) {
-                    hooks[eventName] = handlers.filter((entry) => !entry.hooks?.some((h) => h.command?.includes('codehere scan-tool')));
-                }
-            }
-            writeSettings(settings);
-            uninstallSkills();
-            console.log(success('codehere hooks and skills removed'));
-            console.log(colors.dim('Restart your AI assistant for changes to take effect.'));
-            newline();
-            break;
-        }
-        case 'status': {
-            const settings = readSettings();
-            const installed = isInstalled(settings);
-            sectionHeader('codehere Hook Status');
-            newline();
-            if (installed) {
-                console.log(success('Running') + '  Intercepting every tool call before it executes.');
-            }
-            else {
-                console.log(warning('Not installed') + '  Run `codehere hook install` to activate.');
-            }
-            newline();
-            const skills = skillsInstalled();
-            if (skills) {
-                console.log(info('Skills') + '  /codehere:trust  /codehere:report  /codehere:audit  /codehere:hook-status');
-            }
-            else {
-                console.log(colors.dim('Skills:   not installed (run `codehere hook install` to add)'));
-            }
-            newline();
-            console.log(colors.dim('Config:   ') + SETTINGS_PATH);
-            console.log(colors.dim('Audit log:') + ' ' + AUDIT_FILE);
-            newline();
-            // Autonomous mode callout
-            console.log(colors.bold('Autonomous mode (shift+tab)'));
-            console.log(colors.dim('  When Claude Code runs without approval prompts, this hook is your'));
-            console.log(colors.dim('  last line of defense. Every tool call is scanned before it executes.'));
-            console.log(colors.dim('  After a session: `codehere status --sessions` to review what happened.'));
-            newline();
-            // Show recent audit stats
-            if (existsSync(AUDIT_FILE)) {
-                const lines = readFileSync(AUDIT_FILE, 'utf-8').split('\n').filter(Boolean).slice(-1000); // last 1000 events
-                if (lines.length > 0) {
-                    const entries = lines
-                        .map((l) => {
-                        try {
-                            return JSON.parse(l);
-                        }
-                        catch {
-                            return null;
-                        }
-                    })
-                        .filter(Boolean);
-                    const total = entries.length;
-                    const blocked = entries.filter((e) => e.blocked).length;
-                    const critical = entries.filter((e) => (e.criticalFindings ?? 0) > 0).length;
-                    console.log(colors.bold("What it's seen") + colors.dim(' (last 1000 events):'));
-                    console.log(`  ${colors.cyan(String(total))} tool calls scanned`);
-                    console.log(`  ${blocked > 0 ? colors.red(String(blocked)) : colors.green('none')} blocked`);
-                    console.log(`  ${critical > 0 ? colors.red(String(critical)) : colors.green('none')} with critical findings`);
-                    newline();
-                    if (blocked > 0) {
-                        console.log(colors.dim('  Run `codehere status --sessions` to see which sessions had blocks.'));
-                        newline();
-                    }
-                }
-            }
-            else {
-                console.log(colors.dim("  No events logged yet · run Claude Code and it'll start tracking."));
-                newline();
-            }
-            break;
-        }
-        case 'log': {
-            const tail = options.tail ?? 20;
-            if (!existsSync(AUDIT_FILE)) {
-                console.log(info('No audit log yet'));
-                console.log(colors.dim('  Run `codehere hook install` first'));
-                return;
-            }
-            const lines = readFileSync(AUDIT_FILE, 'utf-8').split('\n').filter(Boolean).slice(-tail);
-            if (lines.length === 0) {
-                console.log(info('Audit log is empty'));
-                return;
-            }
-            sectionHeader(`Hook Audit Log (last ${lines.length})`);
-            newline();
-            for (const line of lines) {
-                try {
-                    const entry = JSON.parse(line);
-                    const ts = new Date(entry.timestamp).toLocaleTimeString();
-                    const status = entry.blocked ? colors.red('[BLOCKED]') : colors.green('[ALLOW]  ');
-                    const risk = entry.riskScore > 0 ? colors.yellow(` risk:${entry.riskScore}`) : '';
-                    const tool = colors.cyan(entry.toolName.padEnd(10));
-                    const preview = entry.toolInput.substring(0, 60).replace(/\n/g, ' ');
-                    console.log(`  ${ts}  ${status}  ${tool}${risk}  ${colors.dim(preview)}`);
-                }
-                catch {
-                    // skip malformed line
-                }
-            }
-            newline();
-            break;
-        }
-        default: {
-            console.log(error(`Unknown subcommand: ${sub}`));
-            console.log(colors.dim('Usage: codehere hook install|uninstall|status|log'));
-            process.exit(1);
-        }
-    }
-}
-//# sourceMappingURL=hook-command.js.map