codehere 1.0.1 → 1.0.2

package/dist/presentation/cli/commands/scan-command.js

@@ -1,52 +0,0 @@
-/**
- * CLI: scan — point codehere at an app, get the ONE thing that will get you hacked, in plain words.
- * Deterministic (orchestrates gitleaks + semgrep), zero model tokens. The 60-second ship-readiness hook
- * for non-experts (docs/PRODUCT_10X.md). Exit 1 when a critical blocker is found (CI-usable).
- */
-import { resolve } from 'node:path';
-import { colors, symbols } from '../../../ui.js';
-import { shipScan } from '../../../infrastructure/security/ship-scan.js';
-export async function executeScanCommand(target, options = {}) {
-    const dir = resolve(target || '.');
-    const r = shipScan(dir);
-    if (options.json) {
-        process.stdout.write(JSON.stringify(r, null, 2) + '\n');
-        return r.top && r.top.tier === 'critical' ? 1 : 0;
-    }
-    if (r.missing.length) {
-        process.stdout.write(colors.dim(`(${r.missing.join(' + ')} not installed — coverage reduced. brew install ${r.missing.join(' ')})\n`));
-    }
-    if (r.failed.length) {
-        process.stdout.write(colors.dim(`(${r.failed.join(' + ')} did not finish — that part of the app went unscanned.)\n`));
-    }
-    if (!r.top) {
-        // Name the scanners that ACTUALLY ran. The old copy hardcoded "gitleaks + semgrep" and printed
-        // "Observed, not assumed" even when semgrep was absent or had timed out — the product asserting
-        // a scan it never performed, which is the exact failure it exists to catch elsewhere.
-        const ran = [r.ran.gitleaks && 'gitleaks', r.ran.semgrep && 'semgrep', 'codehere’s own checks'].filter(Boolean);
-        const partial = r.missing.length > 0 || r.failed.length > 0;
-        process.stdout.write('\n' +
-            // Green is for a clean pass at full coverage. A hole in coverage is not a pass, so it does not
-            // get the green — it gets a plain line that says what was and wasn't looked at.
-            (partial
-                ? `${symbols.info} No ship-blockers found in what was scanned`
-                : colors.success(`${symbols.success} No ship-blockers found`)) +
-            colors.dim(`  — ${ran.join(' + ')} ran on this app and nothing critical surfaced.\n` +
-                (partial ? `Coverage was incomplete, so this is not an all-clear.\n` : '') +
-                `Observed, not assumed. (Fast pass on what actually gets apps hacked — not a full audit.)\n\n`));
-        return 0;
-    }
-    const t = r.top;
-    const crit = r.findings.filter((f) => f.tier === 'critical').length;
-    const rest = r.findings.length - 1;
-    // THE ONE — consequence first, plain language (the EPAM lesson: surface + don't bury it).
-    process.stdout.write('\n' + colors.error(`${symbols.error} 1 thing will get you hacked:`) + '\n\n');
-    process.stdout.write(`  ${t.what}\n`);
-    process.stdout.write(colors.dim(`  → ${t.file}:${t.line}  (found by ${t.tool}: ${t.ruleId})\n\n`));
-    if (rest > 0) {
-        const alsoCrit = crit > 1 ? ` (${crit - 1} also critical)` : '';
-        process.stdout.write(colors.dim(`Plus ${rest} more issue${rest > 1 ? 's' : ''}${alsoCrit} — fix the one above first.\n\n`));
-    }
-    return 1; // not safe to ship
-}
-//# sourceMappingURL=scan-command.js.map

package/dist/presentation/cli/commands/scan-tool-command.js

@@ -1,110 +0,0 @@
-/**
- * CLI Command: scan-tool
- *
- * Reads a Claude Code PreToolUse hook event from stdin (JSON),
- * runs Layer 0 security scan, and outputs a block/allow decision.
- *
- * This is the actual binary that Claude Code's hook system invokes.
- * It must be fast (<100ms) and never crash — any failure falls through to allow.
- *
- * Trust-override audit (added 2026-05-06 per CC frontier Q1 — auditable
- * permission trails): every fail-open path now writes an `overrideReason`
- * audit entry so the audit log captures EVERY tool call, not just the ones
- * the scanner could evaluate. Reviewers can `codehere audit --override-only`
- * to see all cases where the safety policy didn't run normally.
- *
- * Usage (by hook system, not user):
- *   echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' | codehere scan-tool
- */
-import { processHookEvent, appendOverrideAudit, enableHookAuditQueue, flushHookAuditQueue, } from '../../../infrastructure/hooks/claude-sdk-hook.js';
-/** R1.2 · every exit path flushes the queued audit entries first: each is
- *  offered to the daemon (250ms cap) and falls back to a direct append marked
- *  writer:'hook-direct'. The flush itself never throws — the user's tool call
- *  must never break or hang on audit plumbing (core value #5). */
-async function flushAndExit(code) {
-    try {
-        await flushHookAuditQueue();
-    }
-    catch {
-        /* fail-open */
-    }
-    process.exit(code);
-}
-export async function executeScanToolCommand(options) {
-    // R1.2 · queue mode: appends in this hook process buffer instead of writing,
-    // so the flush can offer them to the daemon (the sole-writer path).
-    enableHookAuditQueue();
-    // Read all stdin
-    let raw = '';
-    try {
-        for await (const chunk of process.stdin) {
-            raw += chunk;
-        }
-    }
-    catch {
-        // If stdin read fails, allow the tool call — but log the override so
-        // the audit trail records that the scanner didn't get a chance to run.
-        appendOverrideAudit('stdin_read_failure');
-        return flushAndExit(0);
-    }
-    if (!raw.trim()) {
-        return flushAndExit(0);
-    }
-    // Parse event JSON
-    let event;
-    try {
-        event = JSON.parse(raw);
-    }
-    catch {
-        // Malformed JSON — allow by default (fail open for dev experience).
-        // We still record the override with a truncated copy of the raw payload
-        // so reviewers can see what arrived (helps diagnose hook misconfiguration).
-        appendOverrideAudit('event_parse_failure', {
-            toolInput: raw.substring(0, 500),
-        });
-        if (options.debug) {
-            process.stderr.write('[codehere] Warning: could not parse hook event JSON\n');
-        }
-        return flushAndExit(0);
-    }
-    try {
-        const decision = processHookEvent(event);
-        if (options.logOnly) {
-            // Log-only mode: never block, but log everything. If the scanner WOULD
-            // have blocked, record the override so the audit shows scanner intent
-            // vs actual outcome. Without this, --log-only mode produces an audit
-            // trail indistinguishable from a clean session.
-            if (decision?.decision === 'block') {
-                appendOverrideAudit('log_only_mode', {
-                    sessionId: event.session_id,
-                    toolName: event.tool_name,
-                });
-                if (options.debug) {
-                    process.stderr.write(`[codehere] Would block: ${decision.reason}\n`);
-                }
-            }
-            return flushAndExit(0);
-        }
-        if (decision?.decision === 'block') {
-            // Output block decision as JSON (Claude Code hook contract)
-            process.stdout.write(JSON.stringify(decision) + '\n');
-            // Also write to stderr for user visibility
-            process.stderr.write(`\n${decision.reason}\n`);
-            return flushAndExit(2); // non-zero exit = Claude Code treats as block signal
-        }
-        // Allow — exit 0 with no output
-        return flushAndExit(0);
-    }
-    catch {
-        // Any scan failure: fail open (allow), never break developer workflow.
-        // Record the override so the audit trail shows the scanner crashed for
-        // this tool call — reviewers can correlate with the timestamp to find
-        // the underlying error.
-        appendOverrideAudit('scan_exception', {
-            sessionId: event.session_id,
-            toolName: event.tool_name,
-        });
-        return flushAndExit(0);
-    }
-}
-//# sourceMappingURL=scan-tool-command.js.map

package/dist/presentation/cli/commands/search-command.js

@@ -1,51 +0,0 @@
-/**
- * `codehere search "<query>"` — REQUEST_METHOD stage 7 (Learn) / #19.
- * Search past agent sessions with PROVENANCE: which agent ran it, whether it
- * succeeded, in which project. Local-first (reads on-disk records, no network).
- * Follows the CLI color economy (DESIGN.md §5.2): colour carries meaning, and
- * the output stays legible under NO_COLOR (glyph + word carry the status).
- */
-import { searchSessions } from '../../../application/use-cases/search-sessions.js';
-import { colors, symbols, newline } from '../../../ui.js';
-function statusGlyph(status) {
-    const s = status.toLowerCase();
-    if (/completed|done/.test(s))
-        return colors.verified(symbols.success); // ✓ verified
-    if (/error|caught|stopped|failed/.test(s))
-        return colors.caught(symbols.error); // ✕
-    return colors.dim('·'); // ·  pending / other
-}
-export function executeSearchCommand(query, options) {
-    const limit = options.limit ? Math.max(1, parseInt(options.limit, 10) || 10) : 10;
-    const hits = searchSessions(query, { limit });
-    if (options.json) {
-        process.stdout.write(JSON.stringify(hits, null, 2) + '\n');
-        return 0;
-    }
-    if (!hits.length) {
-        process.stdout.write(colors.dim(`No past sessions match "${query}".\n`));
-        return 0;
-    }
-    newline();
-    process.stdout.write(colors.heading(`${hits.length} past session${hits.length === 1 ? '' : 's'} for "${query}"`) +
-        colors.dim('  (provenance: which agent · whether it succeeded)') +
-        '\n\n');
-    for (const h of hits) {
-        // provenance line: agent · verdict · status · id · project
-        process.stdout.write('  ' +
-            colors.identity(h.agent.padEnd(12)) +
-            ' ' +
-            statusGlyph(h.status) +
-            ' ' +
-            colors.dim(h.status.padEnd(10)) +
-            ' ' +
-            colors.evidence(h.sessionId.slice(0, 8)) +
-            '  ' +
-            colors.dim(h.project) +
-            '\n');
-        process.stdout.write('    ' + colors.dim(h.snippet) + '\n\n');
-    }
-    process.stdout.write(colors.dim('Open one:  ') + colors.bold('codehere verify <id>') + '\n\n');
-    return 0;
-}
-//# sourceMappingURL=search-command.js.map

package/dist/presentation/cli/commands/setup-command.js

@@ -1,330 +0,0 @@
-/**
- * Setup Wizard Command
- * Interactive first-time setup for Codehere
- * Checks environment, API keys, and guides users through configuration
- */
-import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs';
-import { join } from 'path';
-import { getConfigManager } from '../../../infrastructure/config/config-manager.js';
-import { colors, separator, newline, sectionHeader, success, error, warning, info } from '../../../ui.js';
-import { executionTracer } from '../../../infrastructure/observability/execution-tracer.js';
-import { findCodebaseRoot } from '../../../domain/services/codebase-detector.js';
-import { readinessForAllAgents } from '../../../infrastructure/orchestration/session-manager.js';
-/**
- * What codehere actually needs to run a task: at least one coding-agent CLI
- * that's installed AND signed in. Most engineers have `claude` or `codex`
- * logged in by subscription with no API key set, so framing setup around
- * `ANTHROPIC_API_KEY` told them they were blocked when they weren't. This
- * reuses the same readiness check that powers the web dashboard's squad bar.
- */
-function summarizeAgents() {
-    let all;
-    try {
-        all = readinessForAllAgents();
-    }
-    catch {
-        all = [];
-    }
-    return { ready: all.filter((a) => a.state === 'ready'), all };
-}
-/** One status line per agent, plain English. Used by both the TTY wizard and
- *  the non-TTY summary so they say the same thing. */
-function printAgentLines(all) {
-    for (const a of all) {
-        if (a.state === 'ready') {
-            console.log(success(`${a.label}: ready`));
-        }
-        else if (a.state === 'needs_auth') {
-            const hint = a.authHint?.command ? colors.dim(`  (sign in: ${a.authHint.command})`) : '';
-            console.log(warning(`${a.label}: installed, needs sign-in`) + hint);
-        }
-        else if (a.state === 'billed_key_required') {
-            // Surface the adapter's own authHint instead of a hardcoded "paid" label —
-            // some agents (Aider via LiteLLM) actually have a $0 path the detail names.
-            console.log(colors.dim(`○ ${a.label}: installed, needs a model + key`));
-            if (a.authHint?.detail)
-                console.log(colors.dim(`  ${a.authHint.detail}`));
-        }
-        else {
-            const hint = a.installHint?.command ? colors.dim(`  (install: ${a.installHint.command})`) : '';
-            console.log(colors.dim(`○ ${a.label}: not installed`) + hint);
-        }
-    }
-}
-/**
- * The free-tier setup recipe (Phase 1 — free-tier-first). One compact,
- * copy-pasteable line per vendor showing the CHEAPEST way to get it running —
- * so a user testing all 5 vendors knows exactly how to do it for ~$0. Shown
- * when no agent is ready yet (the moment the user needs it). Mirrors the
- * per-agent readiness authHints; kept here as one consolidated cheatsheet
- * because the readiness hints surface one-at-a-time, not as a plan.
- */
-function printFreeTierRecipe() {
-    console.log(colors.bold('Set up any agent for free (or near-free):'));
-    console.log(colors.cyan('  Claude') +
-        colors.dim('    run `claude` › /login · uses your Claude subscription (no API key, no per-token bill)'));
-    console.log(colors.cyan('  Gemini') +
-        colors.dim('    export GEMINI_API_KEY=…   free tier › https://aistudio.google.com/apikey'));
-    console.log(colors.cyan('  Codex') +
-        colors.dim('     run `codex login` with a ChatGPT Plus/Pro account · flat, no per-token charge'));
-    console.log(colors.cyan('  OpenCode') +
-        colors.dim('  run `opencode auth` · point at a local Ollama model or a free provider ($0)'));
-    console.log(colors.cyan('  Aider') +
-        colors.dim('     reuse the free Gemini key: `--model gemini/gemini-2.5-flash` (routes via LiteLLM, $0)'));
-}
-/**
- * Check if any API key is configured
- */
-function checkAPIKey() {
-    const providers = [
-        { env: 'ANTHROPIC_API_KEY', name: 'Anthropic' },
-        { env: 'OPENAI_API_KEY', name: 'OpenAI' },
-        { env: 'COHERE_API_KEY', name: 'Cohere' },
-        { env: 'OPENROUTER_API_KEY', name: 'OpenRouter' },
-    ];
-    for (const { env, name } of providers) {
-        const key = process.env[env];
-        if (key && key.trim() && !key.includes('your_key_here') && key.length > 10) {
-            return { configured: true, provider: name, key };
-        }
-    }
-    return { configured: false };
-}
-/**
- * Detect codebase type and root
- */
-function detectCodebase() {
-    const cwd = process.cwd();
-    // Check for common project indicators
-    const indicators = {
-        node: ['package.json'],
-        python: ['requirements.txt', 'setup.py', 'pyproject.toml'],
-        rust: ['Cargo.toml'],
-        go: ['go.mod'],
-        java: ['pom.xml', 'build.gradle'],
-    };
-    for (const [type, files] of Object.entries(indicators)) {
-        for (const file of files) {
-            if (existsSync(join(cwd, file))) {
-                return { detected: true, type, root: cwd };
-            }
-        }
-    }
-    return { detected: false, root: cwd };
-}
-/**
- * Detect preferred model from config
- */
-function detectModel() {
-    try {
-        const configPath = join(process.cwd(), 'data', 'model-config.json');
-        if (existsSync(configPath)) {
-            const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-            return config.preferredModel || config.modelFamily || null;
-        }
-    }
-    catch {
-        // Ignore errors
-    }
-    return null;
-}
-/**
- * Create config directory if needed
- */
-function ensureConfigDir() {
-    const configDir = join(process.cwd(), 'data');
-    if (!existsSync(configDir)) {
-        mkdirSync(configDir, { recursive: true });
-    }
-    return configDir;
-}
-/**
- * Save setup configuration
- */
-function saveSetupConfig(result) {
-    const configDir = ensureConfigDir();
-    const configPath = join(configDir, 'setup-config.json');
-    const config = {
-        setupComplete: true,
-        setupDate: new Date().toISOString(),
-        apiKeyConfigured: result.apiKeyConfigured,
-        modelDetected: result.modelDetected,
-        codebaseDetected: result.codebaseDetected,
-    };
-    writeFileSync(configPath, JSON.stringify(config, null, 2));
-}
-/**
- * Check if setup has been completed before
- */
-function isSetupComplete() {
-    try {
-        const configPath = join(process.cwd(), 'data', 'setup-config.json');
-        if (existsSync(configPath)) {
-            const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-            return config.setupComplete === true;
-        }
-    }
-    catch {
-        // Ignore errors
-    }
-    return false;
-}
-/**
- * Execute setup wizard
- */
-export async function executeSetupCommand(force = false) {
-    // Check for interactive terminal
-    const isTTY = process.stdin.isTTY && process.stdout.isTTY;
-    if (!isTTY) {
-        const { ready, all } = summarizeAgents();
-        console.log(colors.bold('Setup'));
-        console.log();
-        if (all.length)
-            printAgentLines(all);
-        console.log();
-        if (ready.length) {
-            console.log(success(`You're ready. ${ready[0].label} is set up.`));
-            console.log(colors.dim('  Next: codehere start   (open the dashboard)'));
-        }
-        else {
-            console.log(warning('No coding agent is set up yet.'));
-            console.log();
-            printFreeTierRecipe();
-        }
-        return;
-    }
-    // Start execution tracing
-    const codebaseInfo = findCodebaseRoot(process.cwd());
-    executionTracer.startRun('setup', {
-        codebaseId: codebaseInfo?.rootPath || process.cwd(),
-    });
-    try {
-        const isFirstTime = !isSetupComplete() || force;
-        newline();
-        console.log(colors.bold('Setup'));
-        newline();
-        // Check if already set up
-        if (!force && isSetupComplete()) {
-            console.log(info('Setup has already been completed.'));
-            newline();
-            console.log(colors.dim('Run with --force to reconfigure.'));
-            newline();
-            return;
-        }
-        const result = {
-            apiKeyConfigured: false,
-            modelDetected: null,
-            codebaseDetected: false,
-            configPath: join(process.cwd(), 'data'),
-        };
-        // Step 1: Coding agents — codehere drives agent CLIs, not raw API keys.
-        sectionHeader('Step 1: Your coding agents');
-        const { ready, all } = summarizeAgents();
-        if (all.length)
-            printAgentLines(all);
-        newline();
-        const apiKeyCheck = checkAPIKey();
-        if (ready.length) {
-            console.log(success(`You're ready. ${ready[0].label} is set up.`));
-            result.apiKeyConfigured = true; // at least one agent can spawn right now
-        }
-        else if (apiKeyCheck.configured) {
-            // No agent CLI ready, but a key is present — some adapters (e.g. Aider) run off it.
-            console.log(success(`${apiKeyCheck.provider} API key found.`));
-            console.log(colors.dim('  No agent CLI detected yet · install one for the full experience.'));
-            result.apiKeyConfigured = true;
-        }
-        else {
-            console.log(warning('No coding agent is set up yet.'));
-            newline();
-            printFreeTierRecipe();
-            newline();
-        }
-        newline();
-        // Step 2: Model Detection
-        sectionHeader('Step 2: Model Configuration');
-        const model = detectModel();
-        if (model) {
-            console.log(success(`Preferred Model: ${model}`));
-            result.modelDetected = model;
-        }
-        else {
-            console.log(info('Model: Using default (Claude Sonnet)'));
-            console.log(colors.dim('  Configurable via .codehere/providers.json'));
-            result.modelDetected = 'Claude Sonnet (default)';
-        }
-        newline();
-        // Step 3: Codebase Detection
-        sectionHeader('Step 3: Codebase Detection');
-        const codebase = detectCodebase();
-        if (codebase.detected) {
-            console.log(success(`Codebase: Detected (${codebase.type})`));
-            console.log(colors.dim(`  Root: ${codebase.root}`));
-            result.codebaseDetected = true;
-        }
-        else {
-            console.log(warning('Codebase: Not detected'));
-            console.log(colors.dim("  Make sure you're in your project directory."));
-            result.codebaseDetected = false;
-        }
-        newline();
-        // Step 4: Summary
-        sectionHeader('Setup Summary');
-        const summaryItems = [
-            ['API Key', result.apiKeyConfigured ? success('Configured') : error('Not Configured')],
-            ['Model', result.modelDetected || info('Default')],
-            ['Codebase', result.codebaseDetected ? success('Detected') : warning('Not Detected')],
-        ];
-        summaryItems.forEach(([label, status]) => {
-            console.log(`  ${label.padEnd(15)} ${status}`);
-        });
-        newline();
-        // Step 5: Save Configuration
-        if (result.apiKeyConfigured) {
-            const configManager = getConfigManager();
-            // Update codebase info if detected
-            if (codebase.detected) {
-                configManager.updateCodebase(codebase.root);
-            }
-            // Update model preference if detected
-            if (model) {
-                configManager.setPreference('defaultModel', model.replace(' (default)', ''));
-            }
-            // Save configuration
-            configManager.saveConfig();
-            result.configPath = configManager.getConfigPath();
-            newline();
-            console.log(success('Done.'));
-            newline();
-            console.log(colors.bold('Next steps:'));
-            console.log(colors.dim(`  1. ${colors.cyan('codehere start')}        Open the task intake at :3773`));
-            console.log(colors.dim(`  2. ${colors.cyan('codehere hook install')} Audit every Claude Code action`));
-            console.log(colors.dim(`  3. ${colors.cyan('codehere trust .')}      Scan your project (no API key)`));
-            newline();
-            saveSetupConfig(result);
-            // Track onboarding completion for first-time users
-            if (isFirstTime) {
-                const onboardingConfig = {
-                    onboardingComplete: true,
-                    onboardingDate: new Date().toISOString(),
-                    commandCount: 0, // Will be tracked by feature discovery
-                };
-                const onboardingPath = join(ensureConfigDir(), 'onboarding.json');
-                writeFileSync(onboardingPath, JSON.stringify(onboardingConfig, null, 2));
-            }
-        }
-        else {
-            console.log(separator('═', 80));
-            console.log(warning('Setup Incomplete'));
-            console.log(separator('═', 80));
-            newline();
-            console.log(colors.bold('Please configure your API key to continue.'));
-            console.log(colors.dim('Run this command again after setting up your API key.'));
-            newline();
-        }
-    }
-    finally {
-        executionTracer.endRun();
-    }
-}
-//# sourceMappingURL=setup-command.js.map