codehere 1.0.1 → 1.0.2

package/dist/presentation/cli/commands/team-command.js

@@ -1,256 +0,0 @@
-/**
- * `codehere team`, the CLI face of the local-first team cost+audit ledger.
- *
- * The data layer (config, snapshots, merge, git sync) lives in
- * infrastructure/cost/team-ledger.ts so the CLI and the daemon (`GET /api/team`)
- * read the same core. This file is just the terminal rendering + subcommands.
- *
- * Subcommands:
- *   (none) / sync      write this machine's snapshot, sync the team repo, show merged view
- *   init [path]        create a team: make + git-init a shared folder and point at it
- *   join <git-url>     join a team: clone the shared repo and point at it
- *   set-dir <path>     point at an existing shared team directory
- *   budget <usd>       set the team's shared daily ceiling (off = clear)
- */
-import { existsSync, mkdirSync } from 'fs';
-import { execFileSync } from 'child_process';
-import { join as pathJoin, basename } from 'path';
-import { loadTeamConfig, saveTeamConfig, codehereHome, initTeamDir, isGitRepo, gitPull, gitShareMine, writeMyShare, buildTeamView, } from '../../../infrastructure/cost/team-ledger.js';
-import { success, error, info, heading, newline } from '../../../ui.js';
-function fmtUsd(n) {
-    return n >= 0.01 || n === 0 ? `$${n.toFixed(2)}` : `$${n.toFixed(3)}`;
-}
-export async function executeTeamCommand(subcommand, value, opts) {
-    const sub = subcommand ?? 'sync';
-    switch (sub) {
-        case 'sync':
-        case 'show':
-            return syncAndShow(Boolean(opts?.strict));
-        case 'init':
-            return initTeam(value);
-        case 'join':
-            if (!value) {
-                console.error(error('Usage:'), 'codehere team join <git-url>');
-                process.exit(1);
-            }
-            return joinTeam(value);
-        case 'set-dir':
-            if (!value) {
-                console.error(error('Usage:'), 'codehere team set-dir <path-to-shared-dir>');
-                process.exit(1);
-            }
-            return setDir(value);
-        case 'budget':
-            if (!value) {
-                console.error(error('Usage:'), 'codehere team budget <usd>   (or `off`)');
-                process.exit(1);
-            }
-            return setBudget(value);
-        default:
-            console.error(error('Unknown subcommand:'), sub);
-            console.error(info('Try:'), 'codehere team [sync | init [path] | join <git-url> | set-dir <path> | budget <usd>]');
-            process.exit(1);
-    }
-}
-function setDir(path) {
-    const cfg = loadTeamConfig();
-    cfg.dir = path;
-    saveTeamConfig(cfg);
-    console.log(success('Team directory set:'), path);
-    console.log(info('Next:'), 'run `codehere team` on each machine. Keep that folder in your own git/shared drive.');
-}
-// Create a team: make + git-init a shared folder, point at it, write the first
-// snapshot — so a lead sets up a team in one command, no hand-editing config.
-function initTeam(dir) {
-    const target = dir || pathJoin(codehereHome(), 'team-shared');
-    try {
-        initTeamDir(target); // shared core: mkdir + git-init + README (also used by POST /api/team/init)
-    }
-    catch {
-        console.error(error('Could not create team dir:'), target, '— check the path and permissions.');
-        process.exit(1);
-    }
-    const cfg = loadTeamConfig();
-    cfg.dir = target;
-    saveTeamConfig(cfg);
-    try {
-        writeMyShare(target);
-    }
-    catch {
-        /* best-effort first snapshot */
-    }
-    console.log(success('Team created:'), target);
-    console.log(info('Share it:'), 'push this folder to a git repo, then each teammate runs `codehere team join <git-url>`.');
-}
-// Join a team: clone the shared repo under ~/.codehere/teams/<name>, point at it,
-// write this machine's first snapshot.
-function joinTeam(url) {
-    // A join URL is shared/pasted, so it's a real attack surface. git's ext::/fd::
-    // (and file::) transports execute arbitrary commands, and a leading-dash URL is
-    // parsed as a git option (argument injection). Allow only real remote schemes.
-    if (/^-/.test(url) || /^(ext|fd|file)::/i.test(url) || !/^(https?:\/\/|git:\/\/|ssh:\/\/|git@[^/]+:)/.test(url)) {
-        console.error(error('Unsupported git URL:'), url);
-        console.error(info('Use:'), 'https:// , git:// , ssh:// , or git@host:owner/repo');
-        process.exit(1);
-    }
-    const name = basename(url.replace(/\.git$/, '')) || 'team-shared';
-    const target = pathJoin(codehereHome(), 'teams', name);
-    if (existsSync(target)) {
-        console.error(error('Already exists:'), target);
-        console.error(info('Point at it instead:'), `codehere team set-dir ${target}`);
-        process.exit(1);
-    }
-    try {
-        mkdirSync(pathJoin(codehereHome(), 'teams'), { recursive: true });
-        // Belt-and-suspenders: disable the command-executing transports at the git
-        // level too, and `--` so the URL can never be read as an option.
-        execFileSync('git', ['-c', 'protocol.ext.allow=never', '-c', 'protocol.allow=user', 'clone', '-q', '--', url, target], { stdio: 'inherit' });
-    }
-    catch {
-        console.error(error('Clone failed:'), url, '— check the URL and your access.');
-        process.exit(1);
-    }
-    if (!existsSync(pathJoin(target, 'spend')))
-        mkdirSync(pathJoin(target, 'spend'), { recursive: true });
-    const cfg = loadTeamConfig();
-    cfg.dir = target;
-    saveTeamConfig(cfg);
-    try {
-        writeMyShare(target);
-    }
-    catch {
-        /* best-effort */
-    }
-    console.log(success('Joined team:'), target);
-    console.log(info('Next:'), 'run `codehere team` to sync and see the merged view.');
-}
-function setBudget(value) {
-    const cfg = loadTeamConfig();
-    if (value.toLowerCase() === 'off') {
-        cfg.dailyUsd = null;
-        saveTeamConfig(cfg);
-        console.log(success('Team daily budget cleared.'));
-        return;
-    }
-    const num = Number(value.replace(/^\$/, ''));
-    if (!Number.isFinite(num) || num <= 0) {
-        console.error(error('Invalid amount:'), value, '(use a positive number, e.g. `codehere team budget 50`)');
-        process.exit(1);
-    }
-    cfg.dailyUsd = num;
-    saveTeamConfig(cfg);
-    console.log(success('Team daily budget set:'), fmtUsd(num));
-}
-function syncAndShow(strict = false) {
-    const cfg = loadTeamConfig();
-    if (!cfg.dir) {
-        console.error(error('No team directory set.'));
-        console.error(info('Set one (a folder your team controls, e.g. a shared git repo):'));
-        console.error('   codehere team set-dir /path/to/team-shared-dir');
-        process.exit(1);
-    }
-    if (!existsSync(cfg.dir)) {
-        console.error(error('Team directory does not exist:'), cfg.dir);
-        console.error(info('Create it (or clone the team repo) first, then re-run.'));
-        process.exit(1);
-    }
-    const gitMode = isGitRepo(cfg.dir);
-    const pulled = gitMode ? gitPull(cfg.dir) : false;
-    const mine = writeMyShare(cfg.dir);
-    const pushed = gitMode ? gitShareMine(cfg.dir, `spend/${mine.machineId}.json`) : null;
-    const view = buildTeamView(cfg.dir, cfg.dailyUsd);
-    newline();
-    console.log(heading(`Team spend today (${view.date}), estimate, not a provider invoice`));
-    console.log('  ' + '─'.repeat(48));
-    for (const m of view.machines) {
-        const me = m.machineId === view.myMachineId ? '  (this machine)' : '';
-        console.log(`  ${m.machineId.padEnd(28)} ${fmtUsd(m.totalUsd).padStart(9)}${me}`);
-    }
-    const agents = Object.entries(view.perAgent).sort((a, b) => b[1] - a[1]);
-    if (agents.length) {
-        console.log('  ' + '─'.repeat(48));
-        console.log(info('  by agent (cost · what each did)'));
-        for (const [agent, usd] of agents) {
-            const sess = view.perAgentSessions[agent] ?? 0;
-            console.log(`  ${agent.padEnd(20)} ${fmtUsd(usd).padStart(9)}   ${String(sess).padStart(3)} session${sess === 1 ? '' : 's'}`);
-        }
-    }
-    const projects = Object.entries(view.perProject).sort((a, b) => b[1] - a[1]);
-    if (projects.length) {
-        console.log('  ' + '─'.repeat(48));
-        console.log(info('  by project'));
-        for (const [proj, usd] of projects)
-            console.log(`  ${proj.padEnd(28)} ${fmtUsd(usd).padStart(9)}`);
-    }
-    // Practice runs sit OUTSIDE the totals (their cost is the mock's own
-    // fabrication, never billed) — one quiet line, only when any exist.
-    if (view.practice && view.practice.sessions > 0) {
-        console.log('  ' + '─'.repeat(48));
-        console.log(info(`  practice runs · ${view.practice.sessions} session${view.practice.sessions === 1 ? '' : 's'} · ${fmtUsd(view.practice.usd)} fabricated · not in the totals`));
-    }
-    console.log('  ' + '─'.repeat(48));
-    const totalLine = `  ${'TEAM TOTAL'.padEnd(28)} ${fmtUsd(view.teamTotal).padStart(9)}`;
-    if (view.dailyUsd !== null) {
-        const pct = Math.min(100, Math.round((view.teamTotal / view.dailyUsd) * 100));
-        console.log(totalLine + `   of ${fmtUsd(view.dailyUsd)} (${pct}%)`);
-        if (view.teamTotal >= view.dailyUsd)
-            console.log(error('  Over the team daily budget.'));
-        else if (pct >= 80)
-            console.log(info('  Approaching the team daily budget.'));
-    }
-    else {
-        console.log(totalLine);
-        console.log(info('  No team budget set, `codehere team budget <usd>` to add one.'));
-    }
-    if (view.totalActions > 0) {
-        newline();
-        console.log(heading('What the agents did (recorded, integrity-checked)'));
-        console.log('  ' + '─'.repeat(48));
-        for (const m of view.machines.filter((x) => x.audit).sort((a, b) => b.audit.actions - a.audit.actions)) {
-            const status = m.audit.chainOk ? success('chain ok') : error('chain BROKEN');
-            console.log(`  ${m.machineId.padEnd(28)} ${String(m.audit.actions).padStart(6)} actions  ${status}`);
-        }
-        console.log('  ' + '─'.repeat(48));
-        console.log(`  ${'TEAM ACTIONS'.padEnd(28)} ${String(view.totalActions).padStart(6)}`);
-        if (view.brokenChains.length)
-            console.log(error(`  Integrity broken on: ${view.brokenChains.join(', ')}. Investigate before trusting that record.`));
-    }
-    if (view.tamperedShares.length || view.unsignedShares.length) {
-        newline();
-        if (view.tamperedShares.length)
-            console.log(error(`  ✗ Signature/key mismatch on: ${view.tamperedShares.join(', ')} — altered, or re-signed with a different key than first seen. Don't trust that share.`));
-        if (view.unsignedShares.length)
-            console.log(info(`  Unsigned, can't verify: ${view.unsignedShares.join(', ')}.`));
-    }
-    else if (view.machines.length) {
-        newline();
-        console.log(success('  ✓ All shares signed; keys match the ones first seen (TOFU) — no post-write change detected.'));
-    }
-    newline();
-    if (gitMode) {
-        const pushMsg = pushed === 'pushed'
-            ? 'pushed yours'
-            : pushed === 'committed-local'
-                ? 'committed yours locally (no remote or offline)'
-                : pushed === 'nochange'
-                    ? 'yours unchanged'
-                    : 'could not push yours';
-        console.log(info('Synced:'), `git ${pulled ? 'pulled teammates' : 'pull skipped'}, ${pushMsg}. ${view.machines.length} machine(s) merged, all in your team's own repo, nothing sent to codehere.`);
-    }
-    else {
-        console.log(info('Local-first:'), `${view.machines.length} machine(s) merged from ${cfg.dir}, codehere sent nothing to a server.`);
-        console.log(info('Tip:'), 'make the team dir a git repo with a remote and codehere will pull/push it for you.');
-    }
-    // --strict: refuse to exit clean if the record can't be trusted. A tampered
-    // signature or a broken audit chain means the team total above is not a
-    // trustworthy record — fail closed so CI / a lead's gate catches it.
-    if (strict) {
-        const bad = [...view.tamperedShares, ...view.brokenChains];
-        if (bad.length) {
-            newline();
-            console.error(error('--strict: record integrity failed.'), `Untrustworthy: ${[...new Set(bad)].join(', ')}.`);
-            process.exit(1);
-        }
-    }
-}
-//# sourceMappingURL=team-command.js.map

package/dist/presentation/cli/commands/thread-command.js

@@ -1,370 +0,0 @@
-/**
- * CLI: `codehere thread` · v0.8 S4 · signed-payload share + import
- *
- * Subcommands:
- *   export <session-id> [--out <file>] [--json]
- *       Sign the session bundle and write it to <file> (or stdout when no --out).
- *   import <file> [--trust] [--json]
- *       Verify the signature. If the signer's key isn't trusted, refuse unless
- *       --trust is set OR the user is on a TTY and confirms. On valid+trusted,
- *       merge the session into ~/.codehere/sessions.jsonl so it appears in the
- *       dashboard.
- *   keys                   · print the local public key
- *   trust <pubkey> [label] · add a public key to the trusted set
- *   untrust <pubkey>       · remove
- *
- * No network. Both export and import are local file operations.
- */
-import { existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync } from 'fs';
-import { homedir, hostname } from 'os';
-import { dirname, join, isAbsolute, resolve } from 'path';
-import { colors, symbols } from '../../../ui.js';
-import { signBundle, verifyBundle, shortFingerprint, collectAuditEntriesForSession, verifyEmbeddedAuditChain, } from '../../../application/use-cases/thread-export.js';
-import { loadOrCreateKeypair, localPublicKeyBase64, trustKey, untrustKey, trustedKeySet, loadTrustedKeys, isKeyTrusted, } from '../../../infrastructure/orchestration/thread-key-store.js';
-import { loadSessionById } from '../../../infrastructure/orchestration/session-persistence.js';
-import { getVersion } from '../../../utils/version.js';
-export function executeThreadCommand(sub, arg, _extra, options = {}) {
-    switch (sub) {
-        case 'export':
-            return exportThread(arg, options);
-        case 'import':
-            return importThread(arg, options);
-        case 'keys':
-            return showKeys(options.json ?? false);
-        case 'trust':
-            return trustCmd(arg, options.label, options.json ?? false);
-        case 'untrust':
-            return untrustCmd(arg, options.json ?? false);
-        default:
-            process.stderr.write(colors.error(`${symbols.error} Unknown subcommand: ${sub ?? '(none)'}\n`) +
-                colors.dim('Try: codehere thread export <id> | import <file> | keys | trust <key> | untrust <key>\n'));
-            return 2;
-    }
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* export                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-function exportThread(sessionId, options) {
-    if (!sessionId) {
-        process.stderr.write(colors.error(`${symbols.error} Need a session id\n`));
-        return 2;
-    }
-    const session = loadSessionById(sessionId);
-    if (!session) {
-        process.stderr.write(colors.error(`${symbols.error} No session found matching "${sessionId}"\n`));
-        return 2;
-    }
-    const keys = loadOrCreateKeypair();
-    const body = {
-        schema: 1,
-        kind: 'thread',
-        sessionId: session.sessionId,
-        session,
-        // Embed the session's tool-call audit so a teammate can inspect what the
-        // agent did (signer-attested; see ThreadBundleBody.auditChain trust model).
-        auditChain: collectAuditEntriesForSession(session.sessionId),
-        exporter: {
-            hostname: safeHostname(),
-            codehereVersion: getVersion(),
-        },
-        exportedAt: new Date().toISOString(),
-    };
-    const bundle = signBundle(body, keys);
-    const text = JSON.stringify(bundle, null, 2);
-    if (options.out) {
-        const outPath = isAbsolute(options.out) ? options.out : resolve(process.cwd(), options.out);
-        mkdirSync(dirname(outPath), { recursive: true });
-        writeFileSync(outPath, text, 'utf-8');
-        if (options.json) {
-            process.stdout.write(JSON.stringify({ ok: true, path: outPath, fingerprint: shortFingerprint(bundle.publicKey) }) + '\n');
-        }
-        else {
-            process.stdout.write(colors.green(`${symbols.success} Exported`) +
-                colors.dim(`  ${outPath}\n`) +
-                colors.dim(`   signed by ${shortFingerprint(bundle.publicKey)}\n`) +
-                colors.dim(`   share via Slack/email/PR · recipient runs:  `) +
-                colors.bold(`codehere thread import ${outPath}\n`));
-        }
-        return 0;
-    }
-    // No --out · print to stdout (machine-pipe-friendly)
-    process.stdout.write(text + '\n');
-    return 0;
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* import                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-function importThread(filePath, options) {
-    if (!filePath) {
-        process.stderr.write(colors.error(`${symbols.error} Need a file path\n`));
-        return 2;
-    }
-    const fp = isAbsolute(filePath) ? filePath : resolve(process.cwd(), filePath);
-    if (!existsSync(fp)) {
-        process.stderr.write(colors.error(`${symbols.error} Not found: ${fp}\n`));
-        return 2;
-    }
-    let raw;
-    try {
-        raw = JSON.parse(readFileSync(fp, 'utf-8'));
-    }
-    catch (err) {
-        process.stderr.write(colors.error(`${symbols.error} Invalid JSON: ${err instanceof Error ? err.message : String(err)}\n`));
-        return 2;
-    }
-    const verdict = verifyBundle(raw, trustedKeySet());
-    if (verdict.status === 'malformed') {
-        if (options.json) {
-            process.stdout.write(JSON.stringify({ ok: false, error: 'malformed', detail: verdict.reason }) + '\n');
-        }
-        else {
-            process.stderr.write(colors.error(`${symbols.error} Malformed bundle: ${verdict.reason}\n`));
-        }
-        return 2;
-    }
-    if (verdict.status === 'tampered') {
-        if (options.json) {
-            process.stdout.write(JSON.stringify({ ok: false, error: 'tampered', detail: verdict.reason }) + '\n');
-        }
-        else {
-            process.stderr.write(colors.error(`${symbols.error} Signature INVALID · refusing to import\n`) +
-                colors.dim(`   ${verdict.reason}\n`));
-        }
-        return 1;
-    }
-    // status: 'valid' or 'unknown_key'
-    const bundle = verdict.status === 'valid' ? verdict.bundle : verdict.bundle;
-    const fp_key = shortFingerprint(bundle.publicKey);
-    // Re-verify the embedded tool-call audit so the recipient SEES what the agent
-    // did — not just the narration. Honest semantics: "verified" is gated on
-    // verified>0 (a valid AuditChainCheck is true even for an empty set), and a
-    // tampered entry is surfaced loudly. The bundle SIGNATURE already proved the
-    // chain is signer-attested + unaltered-in-transit; this confirms each entry's
-    // self-hash on top.
-    const auditCheck = bundle.body.auditChain
-        ? verifyEmbeddedAuditChain(bundle.body.auditChain)
-        : undefined;
-    if (verdict.status === 'unknown_key') {
-        if (!options.trust) {
-            if (options.json) {
-                process.stdout.write(JSON.stringify({
-                    ok: false,
-                    error: 'unknown_key',
-                    publicKey: bundle.publicKey,
-                    fingerprint: fp_key,
-                    hint: 'Re-run with --trust to add this key to your trust store and import.',
-                }) + '\n');
-            }
-            else {
-                process.stderr.write(colors.warning(`${symbols.warning} Signer's key is not in your trust store\n`) +
-                    colors.dim(`   fingerprint: ${fp_key}\n`) +
-                    colors.dim(`   The signature is cryptographically valid but you've never trusted this key.\n`) +
-                    colors.dim(`   To trust + import:  `) +
-                    colors.bold(`codehere thread import ${fp} --trust\n`) +
-                    colors.dim(`   To inspect first:   `) +
-                    colors.bold(`codehere thread trust ${bundle.publicKey} <label>`) +
-                    '\n');
-            }
-            return 2;
-        }
-        // --trust set · add key to store and continue
-        trustKey(bundle.publicKey, options.label);
-    }
-    // Persist into ~/.codehere/sessions.jsonl as 3 records (spawned, completed, finalReport)
-    const ses = bundle.body.session;
-    // No-clobber / idempotent import (Phase 2.5 multi-human): re-importing the same
-    // session must not duplicate it in a shared room. Append-only never LOSES work,
-    // but a second import would double the records (and any count-based view).
-    if (loadSessionById(ses.sessionId)) {
-        if (options.json) {
-            process.stdout.write(JSON.stringify({ ok: true, sessionId: ses.sessionId, alreadyImported: true, fingerprint: fp_key }) + '\n');
-        }
-        else {
-            process.stdout.write(colors.dim(`${symbols.info} session ${ses.sessionId.slice(0, 8)} is already imported · nothing to do\n`));
-        }
-        return 0;
-    }
-    const home = process.env.CODEHERE_HOME || homedir();
-    const sessionsPath = join(home, '.codehere', 'sessions.jsonl');
-    mkdirSync(dirname(sessionsPath), { recursive: true });
-    const lines = [];
-    lines.push(JSON.stringify({
-        t: 'spawned',
-        id: ses.sessionId,
-        agent: ses.agent,
-        prompt: ses.prompt,
-        cwd: ses.cwd,
-        startedAt: ses.startedAt,
-        // S18 · practice classification is a property of the RUN on the exporter's
-        // machine, carried by the bundle — never the importing daemon's env.
-        // Absent in a legacy bundle = the work was real and audit-attested; an
-        // import performed on a mock daemon must never demote a teammate's real
-        // work to practice. Stamped explicitly so no spawned-record writer leaves
-        // the field env-classified.
-        mockRun: ses.mockRun === true,
-        // Provenance: attribute this session to the signer it was imported from,
-        // so a shared room shows "from teammate <fingerprint>", not as if local.
-        importedFrom: fp_key,
-        // Persist the audit attestation — the bundle isn't stored, so the room
-        // needs this to show the proof badge. attested gated on verified>0 && no tamper.
-        ...(auditCheck
-            ? {
-                importAudit: {
-                    total: auditCheck.total,
-                    verified: auditCheck.verified,
-                    tampered: auditCheck.tampered.length,
-                    attested: auditCheck.verified > 0 && auditCheck.tampered.length === 0,
-                },
-            }
-            : {}),
-    }));
-    lines.push(JSON.stringify({
-        t: 'completed',
-        id: ses.sessionId,
-        status: ses.status,
-        durationMs: ses.durationMs,
-        completedAt: ses.completedAt,
-        steps: ses.steps,
-        artifacts: ses.artifacts,
-    }));
-    if (ses.finalReport) {
-        lines.push(JSON.stringify({
-            t: 'finalReport',
-            id: ses.sessionId,
-            summary: ses.finalReport.summary,
-            generatedAt: ses.finalReport.generatedAt,
-            durationMs: ses.finalReport.durationMs,
-        }));
-    }
-    appendFileSync(sessionsPath, lines.join('\n') + '\n', 'utf-8');
-    if (options.json) {
-        process.stdout.write(JSON.stringify({
-            ok: true,
-            sessionId: ses.sessionId,
-            trusted: verdict.status === 'valid' ? true : 'just-added',
-            fingerprint: fp_key,
-            audit: auditCheck
-                ? {
-                    total: auditCheck.total,
-                    verified: auditCheck.verified,
-                    tampered: auditCheck.tampered.length,
-                    legacy: auditCheck.legacy,
-                    // "verified" is true ONLY when entries were actually checked +
-                    // none tampered — never on a bare/empty chain.
-                    attested: auditCheck.verified > 0 && auditCheck.tampered.length === 0,
-                }
-                : null,
-        }) + '\n');
-    }
-    else {
-        process.stdout.write(colors.green(`${symbols.success} Imported`) +
-            colors.dim(`  session ${ses.sessionId.slice(0, 8)} · signed by ${fp_key}\n`));
-        process.stdout.write(formatAuditLine(auditCheck));
-        process.stdout.write(colors.dim(`   view it:  `) +
-            colors.bold(`codehere start`) +
-            colors.dim(` then click the task in the dashboard\n`));
-    }
-    return 0;
-}
-/**
- * Honest one-line summary of the embedded audit chain for the import surface.
- * The "✓ verified" claim is gated on verified>0 (NOT bare check.valid, which is
- * true for an empty/all-legacy set where nothing was checked); a tampered entry
- * is surfaced as a loud warning. Returns '' when there's no chain to report.
- */
-function formatAuditLine(check) {
-    if (!check || check.total === 0) {
-        return colors.dim(`   (no tool-call audit was included in this bundle)\n`);
-    }
-    if (check.tampered.length > 0) {
-        return colors.error(`   ${symbols.error} audit chain INCONSISTENT · ${check.tampered.length} of ${check.total} entr${check.tampered.length === 1 ? 'y was' : 'ies were'} altered after writing · the signer's tool-call record is not internally consistent\n`);
-    }
-    if (check.verified > 0) {
-        // Honest framing: this is signer ATTESTATION, not independent provenance —
-        // the hashes match and the bundle is signed, but trust reduces to the signer's
-        // key (a malicious signer could fabricate a consistent chain). Say exactly that
-        // rather than a bare "verified" that implies more than self-hash + signature.
-        return colors.green(`   ${symbols.success} ${check.verified} agent tool call${check.verified === 1 ? '' : 's'} recorded` +
-            colors.dim(` · hashes intact, as attested by this signer (your trust = the key above)\n`));
-    }
-    // total>0 but nothing verifiable (all legacy/no chain fields).
-    return colors.dim(`   ${check.legacy} audit entr${check.legacy === 1 ? 'y' : 'ies'} present but unverifiable (no chain fields)\n`);
-}
-/* ──────────────────────────────────────────────────────────────────────── */
-/* keys / trust / untrust                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-function showKeys(json) {
-    loadOrCreateKeypair();
-    const localB64 = localPublicKeyBase64() ?? '';
-    const trusted = loadTrustedKeys();
-    if (json) {
-        process.stdout.write(JSON.stringify({
-            local: { publicKey: localB64, fingerprint: shortFingerprint(localB64) },
-            trusted: Object.entries(trusted.keys).map(([k, v]) => ({
-                publicKey: k,
-                fingerprint: shortFingerprint(k),
-                label: v.label,
-                addedAt: v.addedAt,
-            })),
-        }, null, 2) + '\n');
-        return 0;
-    }
-    process.stdout.write('\n' + colors.bold('This machine') + '\n');
-    process.stdout.write('  ' + colors.cyan(shortFingerprint(localB64)) + colors.dim('  signs your exports\n\n'));
-    process.stdout.write(colors.bold('Trusted keys') + colors.dim('  (imports from these accepted silently)\n'));
-    const entries = Object.entries(trusted.keys);
-    if (entries.length === 0) {
-        process.stdout.write('  ' + colors.dim('(empty)\n'));
-    }
-    else {
-        for (const [k, v] of entries) {
-            const label = v.label || '(no label)';
-            process.stdout.write('  ' + colors.cyan(shortFingerprint(k)) + '  ' + colors.dim(label) + '\n');
-        }
-    }
-    process.stdout.write('\n' + colors.dim('Add a key:    ') + colors.bold('codehere thread trust <pubkey> <label>') + '\n');
-    process.stdout.write(colors.dim('Remove a key: ') + colors.bold('codehere thread untrust <pubkey>') + '\n\n');
-    return 0;
-}
-function trustCmd(pubkey, label, json) {
-    if (!pubkey) {
-        process.stderr.write(colors.error(`${symbols.error} Need a public key (base64)\n`));
-        return 2;
-    }
-    trustKey(pubkey, label);
-    if (json) {
-        process.stdout.write(JSON.stringify({ ok: true, fingerprint: shortFingerprint(pubkey) }) + '\n');
-    }
-    else {
-        process.stdout.write(colors.green(`${symbols.success} trusted ${shortFingerprint(pubkey)}\n`));
-    }
-    return 0;
-}
-function untrustCmd(pubkey, json) {
-    if (!pubkey) {
-        process.stderr.write(colors.error(`${symbols.error} Need a public key (base64)\n`));
-        return 2;
-    }
-    const ok = untrustKey(pubkey);
-    if (json) {
-        process.stdout.write(JSON.stringify({ ok }) + '\n');
-    }
-    else if (ok) {
-        process.stdout.write(colors.green(`${symbols.success} untrusted ${shortFingerprint(pubkey)}\n`));
-    }
-    else {
-        process.stdout.write(colors.gray(`${symbols.dot} key not in trust store (or it's this machine's own key · can't remove)\n`));
-    }
-    return 0;
-}
-function safeHostname() {
-    try {
-        return hostname();
-    }
-    catch {
-        return undefined;
-    }
-}
-// Public alias for the connection-status check used in the daemon HTTP routes.
-export { isKeyTrusted };
-//# sourceMappingURL=thread-command.js.map