codehere 1.0.1 → 1.0.2

package/dist/presentation/cli/commands/narrator-command.js

@@ -1,101 +0,0 @@
-/**
- * `codehere narrator` — read or customize the PM narrator prompt template.
- *
- * Subcommands:
- *   show                  — print active template + source (user / default)
- *                           and the path codehere reads
- *   edit                  — write the default template to ~/.codehere/narrator-prompt.md
- *                           if it doesn't already exist, then open in $EDITOR
- *                           (or print the path if no $EDITOR set)
- *   reset                 — delete the user-edited file, fall back to default
- *
- * The template uses {{placeholder}} substitution. Required placeholders:
- *   {{prompt}}, {{agent}}, {{elapsed_seconds}}, {{steps}}
- * Missing any → silent fallback to baked-in default at render time, so a
- * typo never breaks narration.
- *
- * Per claim_user_persona HIGH: the narrator IS the agent's voice for
- * non-technical users. Letting them control it is a v1 promise.
- */
-import { spawnSync } from 'child_process';
-import { existsSync, readFileSync } from 'fs';
-import { loadTemplate, resetTemplate, templatePath, writeDefaultTemplate, DEFAULT_TEMPLATE, } from '../../../application/use-cases/narrator-prompt-template.js';
-import { error, info, newline, success } from '../../../ui.js';
-export async function executeNarratorCommand(subcommand) {
-    const sub = subcommand ?? 'show';
-    switch (sub) {
-        case 'show':
-            return showNarrator();
-        case 'edit':
-            return editNarrator();
-        case 'reset':
-            return resetNarrator();
-        default:
-            console.error(error('Unknown subcommand:'), sub);
-            console.error(info('Try:'), 'codehere narrator [show | edit | reset]');
-            process.exit(1);
-    }
-}
-function showNarrator() {
-    const { source, template } = loadTemplate();
-    const path = templatePath();
-    newline();
-    console.log(info('Active template source:'), source === 'user' ? 'user-edited file' : 'baked-in default');
-    console.log(info('Path:'), path);
-    if (source === 'user') {
-        const sizeBytes = existsSync(path) ? readFileSync(path, 'utf-8').length : 0;
-        console.log(info('User file size:'), `${sizeBytes} bytes`);
-    }
-    else {
-        console.log(info('Customize with:'), 'codehere narrator edit');
-    }
-    newline();
-    console.log(info('Template (first 500 chars):'));
-    console.log(template.slice(0, 500) + (template.length > 500 ? '\n…(truncated)' : ''));
-    newline();
-}
-function editNarrator() {
-    const { wrote, path } = writeDefaultTemplate(false);
-    if (wrote) {
-        console.log(success('Wrote default template to:'), path);
-    }
-    else {
-        console.log(info('Existing template at:'), path);
-    }
-    const editor = process.env.EDITOR || process.env.VISUAL;
-    if (!editor) {
-        console.log(info('No $EDITOR set. Open this file in your editor of choice:'));
-        console.log('  ', path);
-        console.log(info('Then verify with:'), 'codehere narrator show');
-        return;
-    }
-    console.log(info('Opening in $EDITOR:'), editor);
-    // Fire the editor synchronously, inheriting tty so the user can edit.
-    const result = spawnSync(editor, [path], { stdio: 'inherit' });
-    if (result.status !== 0) {
-        console.error(error('Editor exited non-zero.'), 'Edits (if any) still saved.');
-    }
-    // Reload + report — gives the user immediate confirmation their edits parsed.
-    const after = loadTemplate();
-    if (after.source === 'user') {
-        console.log(success('Active template:'), 'user-edited file (parses, all placeholders present).');
-    }
-    else {
-        console.log(error('Template missing required placeholders.'), 'Falling back to default until fixed.');
-        console.log(info('Required:'), '{{prompt}}, {{agent}}, {{elapsed_seconds}}, {{steps}}');
-    }
-}
-function resetNarrator() {
-    const { removed, path } = resetTemplate();
-    if (removed) {
-        console.log(success('Removed user-edited template.'), 'Narrator now uses the baked-in default.');
-        console.log(info('File was at:'), path);
-    }
-    else {
-        console.log(info('No user-edited template to remove.'), 'Already on the baked-in default.');
-    }
-    // Don't load DEFAULT_TEMPLATE for any side effect — just acknowledge it's the
-    // active source now. (Imported above so future test shape stays available.)
-    void DEFAULT_TEMPLATE;
-}
-//# sourceMappingURL=narrator-command.js.map

package/dist/presentation/cli/commands/permission-command.js

@@ -1,105 +0,0 @@
-/**
- * `codehere permission` — manage per-cwd .codehere/permissions.yaml.
- *
- * Subcommands:
- *   list                          — show current allow/deny entries
- *   allow <pattern> [--reason X]  — append an allow entry
- *   deny  <pattern> [--reason X]  — append a deny entry (reserved; no-op today)
- *   remove <pattern>              — drop the matching entry from both buckets
- *
- * Always operates on the CURRENT working directory's
- * .codehere/permissions.yaml. Creates the file if missing. Writes are
- * idempotent — re-running `allow X` won't add a duplicate.
- *
- * Per claim_user_persona HIGH: the CLI is the developer escape hatch;
- * the slice-2 web-UI panel (forthcoming) wraps the same primitive for
- * non-technical users. The YAML format is the source of truth either way.
- */
-import { loadPermissions, addPermissionEntry, removePermissionEntry, } from '../../../infrastructure/security/permissions-config.js';
-import { colors, success, error, warning, info, newline } from '../../../ui.js';
-export async function executePermissionCommand(subcommand, pattern, options = {}) {
-    const sub = subcommand ?? 'list';
-    switch (sub) {
-        case 'list':
-            return listPermissions();
-        case 'allow':
-            if (!pattern) {
-                console.error(error('Usage:'), 'codehere permission allow <pattern> [--reason "..."]');
-                process.exit(1);
-            }
-            return addEntry('allow', pattern, options.reason);
-        case 'deny':
-            if (!pattern) {
-                console.error(error('Usage:'), 'codehere permission deny <pattern> [--reason "..."]');
-                process.exit(1);
-            }
-            return addEntry('deny', pattern, options.reason);
-        case 'remove':
-            if (!pattern) {
-                console.error(error('Usage:'), 'codehere permission remove <pattern>');
-                process.exit(1);
-            }
-            return removeEntry(pattern);
-        default:
-            console.error(error('Unknown subcommand:'), sub);
-            console.error(info('Available:'), 'list · allow · deny · remove');
-            process.exit(1);
-    }
-}
-function listPermissions() {
-    const cfg = loadPermissions(process.cwd());
-    if (cfg.allow.length === 0 && cfg.deny.length === 0) {
-        console.log(colors.dim('  (no permissions.yaml in this folder yet)'));
-        console.log(colors.dim('  Run `codehere permission allow <pattern> --reason "..."` to add an entry.'));
-        newline();
-        return;
-    }
-    if (cfg.allow.length > 0) {
-        console.log(success('allow:'));
-        for (const e of cfg.allow) {
-            console.log(`  • ${e.pattern}`);
-            if (e.reason)
-                console.log(colors.dim(`      reason: ${e.reason}`));
-            if (e.addedAt)
-                console.log(colors.dim(`      added:  ${e.addedAt}`));
-        }
-    }
-    if (cfg.deny.length > 0) {
-        console.log(warning('deny (reserved · currently no-op):'));
-        for (const e of cfg.deny) {
-            console.log(`  • ${e.pattern}`);
-            if (e.reason)
-                console.log(colors.dim(`      reason: ${e.reason}`));
-        }
-    }
-    newline();
-}
-function addEntry(bucket, pattern, reason) {
-    const result = addPermissionEntry({ cwd: process.cwd(), pattern, bucket, reason });
-    if (result.status === 'already_present') {
-        console.log(warning(`Pattern already in ${bucket}-list:`), pattern);
-        if (result.entry.reason)
-            console.log(colors.dim(`  reason: ${result.entry.reason}`));
-        if (reason && reason !== result.entry.reason) {
-            console.log(colors.dim('  (use `codehere permission remove <pattern>` first to change the reason)'));
-        }
-        newline();
-        return;
-    }
-    console.log(success(`Added to ${bucket}-list:`), pattern);
-    if (reason)
-        console.log(colors.dim(`  reason: ${reason}`));
-    console.log(colors.dim(`  file:   ${result.filePath}`));
-    newline();
-}
-function removeEntry(pattern) {
-    const { removed } = removePermissionEntry(process.cwd(), pattern);
-    if (removed === 0) {
-        console.log(warning('No entry found for pattern:'), pattern);
-        newline();
-        return;
-    }
-    console.log(success(`Removed ${removed} entr${removed === 1 ? 'y' : 'ies'} for:`), pattern);
-    newline();
-}
-//# sourceMappingURL=permission-command.js.map

package/dist/presentation/cli/commands/protocols-builder.js

@@ -1,254 +0,0 @@
-/**
- * F3 Task 7 — protocols/hook_patterns.json exporter.
- *
- * Reads the trust-scorer's CODE_PATTERNS bank (the in-code TypeScript
- * source of truth for the safety hook's pattern matchers) and exports it
- * to .codehere/protocols/hook_patterns.json so the patterns are:
- *
- *   - inspectable     (auditors, security reviewers can read the JSON)
- *   - version-controllable (the file lives in the repo)
- *   - shareable       (cross-tool: e.g. PR our patterns into the
- *                      agentic-stack ecosystem per ADR-006)
- *   - extensible      (project-specific patterns under `patterns_project[]`
- *                      survive re-exports)
- *
- * Schema split (regenerable / preserved):
- *   patterns_builtin[]  — regenerated from CODE_PATTERNS on each export
- *   patterns_project[]  — user-edited; preserved across re-exports
- *
- * Each pattern is identified by a stable `id` slugified from category +
- * description. Same code → same id, so users can reference patterns
- * deterministically (e.g. "ignore the `secrets-hardcoded-credential`
- * pattern in this folder").
- *
- * Forward-compatibility: regex is serialized as a JSON-portable string
- * (no special characters that would break JSON parsing); the flags are
- * a separate field. This avoids the JSON-vs-RegExp impedance mismatch.
- */
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
-import { join, dirname } from 'path';
-import { CODE_PATTERNS } from '../../../infrastructure/security/trust-scorer.js';
-/**
- * Slugify category + description into a stable id.
- *
- *   "Secrets" + "Hardcoded credential" → "secrets-hardcoded-credential"
- *   "SQL Injection" + "String interpolation in SQL query" → "sql-injection-string-interpolation-in-sql-query"
- *
- * Stability matters: re-exports must produce the same id from the same
- * source. Cite this slug in test fixtures, downstream tools, project
- * overrides etc.
- */
-function slugifyPatternId(category, description) {
-    return (category + ' ' + description)
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '');
-}
-/**
- * Serialize a JS RegExp to a JSON-portable {regex, flags} pair.
- * `regex` is the source string (without surrounding `/`); `flags` is the
- * flags string ('gi' etc.).
- */
-function serializeRegex(re) {
-    return { regex: re.source, flags: re.flags };
-}
-/**
- * Assign stable, source-order-independent ids to a list of patterns.
- *
- * The sort key is (category, description, regex.source) — a 3-tier
- * comparator. The first two tiers come from K2 Round 1 (sort by
- * category + description so duplicates get deterministic suffix
- * assignment). The 3rd tier (regex source) is the codex Round 2 fix:
- * (category, description) alone leaves stable-sort fall-through to
- * source order when two patterns share both fields, which means
- * reordering CODE_PATTERNS would still flip which one gets the base id
- * vs `-2`. Adding regex.source disambiguates definitively — two patterns
- * with identical category + description + regex are the SAME pattern;
- * they can't both exist.
- *
- * Returns a new sorted array with `id` attached. Pure; safe to test
- * with arbitrary fixtures.
- */
-export function assignStableIds(patterns) {
-    const sorted = [...patterns].sort((a, b) => {
-        const c = a.category.localeCompare(b.category);
-        if (c !== 0)
-            return c;
-        const d = a.description.localeCompare(b.description);
-        if (d !== 0)
-            return d;
-        return a.regex.source.localeCompare(b.regex.source);
-    });
-    const seenIds = new Map();
-    return sorted.map((p) => {
-        const baseId = slugifyPatternId(p.category, p.description);
-        const seen = seenIds.get(baseId) ?? 0;
-        seenIds.set(baseId, seen + 1);
-        const id = seen === 0 ? baseId : `${baseId}-${seen + 1}`;
-        return { ...p, id };
-    });
-}
-/**
- * Build the export object from CODE_PATTERNS. Pure — does not touch disk.
- *
- * Delegates id assignment to `assignStableIds` so the source-order-
- * independence property has a direct unit test (see protocols-export.test.ts).
- */
-export function buildHookPatternsExport() {
-    const withIds = assignStableIds(CODE_PATTERNS);
-    const builtin = withIds.map((p) => {
-        const { regex, flags } = serializeRegex(p.regex);
-        const out = {
-            id: p.id,
-            regex,
-            regex_flags: flags,
-            severity: p.severity,
-            category: p.category,
-            description: p.description,
-        };
-        if (p.cwe)
-            out.cwe = p.cwe;
-        if (p.scanRaw)
-            out.scanRaw = p.scanRaw;
-        if (p.requiresContext) {
-            const ctx = serializeRegex(p.requiresContext);
-            out.requiresContext = { regex: ctx.regex, flags: ctx.flags };
-        }
-        return out;
-    });
-    return {
-        version: 'v0.5',
-        generatedAt: new Date().toISOString(),
-        source: 'agent/src/infrastructure/security/trust-scorer.ts',
-        _note: "Exported from codehere's trust-scorer pattern bank via 'codehere protocols export'. " +
-            "DO NOT hand-edit `patterns_builtin[]` · it's regenerated on every export. " +
-            'Add project-specific patterns to `patterns_project[]` · those are preserved across re-exports. ' +
-            'Pattern ids are stable slugs of category + description; reference them deterministically.',
-        patterns_builtin: builtin,
-        patterns_project: [],
-    };
-}
-/**
- * Detect whether the on-disk file is the init-time placeholder.
- *
- * Two placeholder shapes are recognized:
- *
- *   1. POST-2026-04-28 seed (current init) — split schema, empty arrays:
- *      { version, patterns_builtin: [], patterns_project: [], _note }
- *
- *   2. PRE-2026-04-28 seed (legacy init) — single empty `patterns` array:
- *      { version, patterns: [], _note }
- *
- * Either one is safe to overwrite without --force. A NON-empty legacy
- * `patterns` array is NOT a placeholder — see `extractLegacyProjectPatterns`
- * below which migrates user content into `patterns_project[]` rather than
- * silently discarding it (codex Round 1 fix — the legacy seed's _note
- * explicitly told users to add patterns to the legacy field, so users may
- * have followed that guidance).
- */
-function isInitPlaceholder(parsed) {
-    if (typeof parsed !== 'object' || parsed === null)
-        return false;
-    const obj = parsed;
-    // Current shape: split schema, both arrays empty.
-    if (Array.isArray(obj.patterns_builtin) &&
-        obj.patterns_builtin.length === 0 &&
-        Array.isArray(obj.patterns_project) &&
-        obj.patterns_project.length === 0) {
-        return true;
-    }
-    // Legacy shape: single empty `patterns` array, no _builtin/_project.
-    if (Array.isArray(obj.patterns) &&
-        obj.patterns.length === 0 &&
-        obj.patterns_builtin === undefined &&
-        obj.patterns_project === undefined) {
-        return true;
-    }
-    return false;
-}
-/**
- * Extract user-added patterns from the LEGACY `patterns[]` field, if any.
- * Used to migrate non-empty legacy files into `patterns_project[]` so users
- * who followed the legacy seed's _note advice ("add patterns to `patterns`")
- * don't lose their work on first export (codex Round 1 fix).
- *
- * Returns `null` if the file isn't a legacy-shape file with non-empty
- * patterns; callers fall through to the normal --rebuild path which reads
- * `patterns_project[]` directly.
- */
-function extractLegacyProjectPatterns(parsed) {
-    if (typeof parsed !== 'object' || parsed === null)
-        return null;
-    const obj = parsed;
-    if (Array.isArray(obj.patterns) &&
-        obj.patterns.length > 0 &&
-        obj.patterns_builtin === undefined &&
-        obj.patterns_project === undefined) {
-        return obj.patterns;
-    }
-    return null;
-}
-/**
- * Disk-side wrapper: build + write to .codehere/protocols/hook_patterns.json.
- *
- * If the existing file is the init-time placeholder, overwrite without
- * requiring --rebuild. Otherwise:
- *   - existing file present + no --rebuild → 'exists' (refuse)
- *   - existing file present + --rebuild → preserve patterns_project[],
- *                                          regenerate patterns_builtin[]
- *   - no existing file → write fresh
- */
-export function writeHookPatternsExport(codehereDir, options = {}) {
-    const targetPath = join(codehereDir, 'protocols/hook_patterns.json');
-    let preservedProject = [];
-    if (existsSync(targetPath)) {
-        let parsed;
-        try {
-            parsed = JSON.parse(readFileSync(targetPath, 'utf8'));
-        }
-        catch {
-            return { result: 'failed', path: targetPath, error: 'existing file is not valid JSON' };
-        }
-        // Codex Round 1 fix: migrate non-empty legacy `patterns[]` content into
-        // `patterns_project[]` BEFORE the placeholder/rebuild branches. The
-        // legacy init seed's _note told users to add patterns to the legacy
-        // field; a fresh export must preserve any content they added rather
-        // than silently discard it.
-        const legacy = extractLegacyProjectPatterns(parsed);
-        if (legacy !== null) {
-            preservedProject = legacy;
-            // Fall through to writing — we treat a non-empty-legacy file as
-            // overwriteable (the legacy patterns now live in preservedProject).
-        }
-        else if (isInitPlaceholder(parsed)) {
-            // Empty placeholder (either schema shape) — overwrite without --rebuild.
-        }
-        else if (!options.rebuild) {
-            return { result: 'exists', path: targetPath };
-        }
-        else {
-            // --rebuild + non-placeholder, non-legacy existing file → preserve
-            // patterns_project[].
-            const obj = parsed;
-            if (Array.isArray(obj.patterns_project)) {
-                preservedProject = obj.patterns_project;
-            }
-        }
-    }
-    const built = buildHookPatternsExport();
-    built.patterns_project = preservedProject;
-    try {
-        mkdirSync(dirname(targetPath), { recursive: true });
-        writeFileSync(targetPath, JSON.stringify(built, null, 2) + '\n');
-    }
-    catch (e) {
-        return { result: 'failed', path: targetPath, error: e instanceof Error ? e.message : String(e) };
-    }
-    return {
-        result: 'exported',
-        path: targetPath,
-        builtinCount: built.patterns_builtin.length,
-        projectCount: built.patterns_project.length,
-    };
-}
-//# sourceMappingURL=protocols-builder.js.map

package/dist/presentation/cli/commands/protocols-command.js

@@ -1,84 +0,0 @@
-/**
- * Protocols Command — F3 v0.5 protocols layer operations.
- *
- * Today: `codehere protocols export` writes the trust-scorer's pattern
- * bank to .codehere/protocols/hook_patterns.json. Future: `protocols
- * import`, `protocols verify`, `protocols diff` etc.
- *
- * The dispatch shape mirrors `memory-command.ts` so future actions slot
- * in without touching index.ts beyond a single .option() addition.
- */
-import { existsSync } from 'fs';
-import { join } from 'path';
-import { colors, success, info, error, newline } from '../../../ui.js';
-import { findCodebaseRoot } from '../../../domain/services/codebase-detector.js';
-import { writeHookPatternsExport } from './protocols-builder.js';
-function executeProtocolsExport(options) {
-    const codeInfo = findCodebaseRoot();
-    const root = codeInfo?.rootPath ?? process.cwd();
-    const codehereDir = join(root, '.codehere');
-    newline();
-    console.log(colors.bold('codehere protocols export'));
-    console.log(colors.dim(`  exporting trust-scorer pattern bank › ${codehereDir}/protocols/hook_patterns.json`));
-    newline();
-    if (!existsSync(codehereDir)) {
-        console.log(`  ${error('refused')} .codehere/ not found at this root.`);
-        console.log(`  ${colors.dim('Run')} ${colors.cyan('codehere init')} ${colors.dim('first.')}`);
-        newline();
-        process.exitCode = 1;
-        return;
-    }
-    const result = writeHookPatternsExport(codehereDir, { rebuild: !!options.rebuild });
-    switch (result.result) {
-        case 'exported': {
-            const projectNote = result.projectCount && result.projectCount > 0
-                ? ` · ${result.projectCount} project pattern${result.projectCount === 1 ? '' : 's'} preserved`
-                : '';
-            console.log(`  ${success('exported')} ${result.path}  ${colors.dim(`(${result.builtinCount} built-in patterns${projectNote})`)}`);
-            break;
-        }
-        case 'exists':
-            console.log(`  ${info('exists  ')} ${result.path}  ${colors.dim('(use --rebuild to refresh built-in patterns; project patterns are preserved)')}`);
-            break;
-        case 'failed':
-            console.log(`  ${error('failed  ')} ${result.path}  ${colors.dim(`(${result.error})`)}`);
-            process.exitCode = 1;
-            break;
-    }
-    newline();
-    console.log(colors.bold('Next:'));
-    console.log(`  - Inspect ${colors.cyan('.codehere/protocols/hook_patterns.json')} to see what the safety hook matches`);
-    console.log(`  - Add project-specific patterns under ${colors.cyan('patterns_project[]')} · they survive re-exports`);
-    console.log(`  ${colors.dim('(Edit patterns_builtin[] is a no-op · re-exports overwrite it from trust-scorer.ts.)')}`);
-    newline();
-}
-export function executeProtocolsCommand(action, options = {}) {
-    try {
-        switch (action) {
-            case 'export':
-                executeProtocolsExport(options);
-                return;
-            case undefined:
-            case 'help':
-                console.log(`
-codehere protocols <action> — F3 protocols layer operations
-
-  export    Export trust-scorer pattern bank to .codehere/protocols/hook_patterns.json
-
-Coming later:
-  import    Apply patterns from a file (cross-tool ingestion)
-  verify    Check that the on-disk file matches the in-code pattern bank
-`);
-                return;
-            default:
-                console.error(`\n  ${error('failed')} unknown protocols action: ${action}\n  Try: codehere protocols help\n`);
-                process.exitCode = 1;
-        }
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        console.error(`\n  ${error('failed')} codehere protocols ${action ?? ''} · ${msg}\n`);
-        process.exitCode = 1;
-    }
-}
-//# sourceMappingURL=protocols-command.js.map