codehere 1.0.1 → 1.0.3

package/dist/infrastructure/orchestration/session-persistence.js

@@ -1,394 +0,0 @@
-/**
- * Session persistence — survives daemon restart.
- *
- * Beta.3 dogfood surfaced a reliability gap: after `ch start` exited and was
- * relaunched, the task UI was empty even when completed sessions had produced
- * valuable final reports. The audit log (hook-events.jsonl) persisted every
- * tool call but not the session-level PM state (prompt, artifacts, steps).
- *
- * This module adds a minimal two-record schema:
- *   { t: 'spawned',   id, agent, prompt, cwd, startedAt }
- *   { t: 'completed', id, status, durationMs, steps, artifacts, completedAt }
- *
- * On spawn, we write the first line. On exit, we write the second. On daemon
- * start, we read the last N pairs and surface them as read-only "persisted"
- * sessions (no kill button, no live stream; the subprocess died with the
- * previous daemon).
- *
- * Write path stays append-only — never rewrites history. Lock-free because
- * single writer (the daemon). If two daemons ran concurrently the worst case
- * is interleaved lines, which the reader tolerates.
- */
-import { existsSync, mkdirSync, appendFileSync, readFileSync } from 'fs';
-import { homedir } from 'os';
-import { join, dirname } from 'path';
-function sessionsFile() {
-    // Honor CODEHERE_HOME like the rest of the codebase (config, audit, threads)
-    // so a scratch home isolates sessions for dogfooding / the mock harness.
-    return join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'sessions.jsonl');
-}
-/**
- * A session's records must all land in the SAME file: the one resolved when it
- * was spawned. sessionsFile() reads env per-call, so a write that fires after
- * the environment moved on (async exit handlers; test suites that swap
- * CODEHERE_HOME per test) would otherwise scatter a session across homes —
- * the failover-skip flake forensics caught exactly this shape (a slow
- * real-claude exit record from another test's home, spawned-record absent —
- * full record in commit message). Spawn binds the
- * path; completed/finalReport reuse it. FIFO-capped — eviction only means a
- * later write falls back to the env-resolved path (prod-identical: the
- * daemon's home never changes mid-run).
- */
-const sessionFileById = new Map();
-const SESSION_FILE_CAP = 500;
-function bindSessionFile(id) {
-    const file = sessionsFile();
-    if (sessionFileById.size >= SESSION_FILE_CAP) {
-        const oldest = sessionFileById.keys().next().value;
-        if (oldest !== undefined)
-            sessionFileById.delete(oldest);
-    }
-    sessionFileById.set(id, file);
-    return file;
-}
-function fileForSession(id) {
-    return sessionFileById.get(id) ?? sessionsFile();
-}
-function ensureDirFor(file) {
-    const dir = dirname(file);
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-}
-export function appendSpawned(rec) {
-    try {
-        const file = bindSessionFile(rec.id);
-        ensureDirFor(file);
-        // S18 · practice is a property of the RUN, stamped once on the durable
-        // record at spawn — never re-derived from a later daemon's env. Seeded
-        // demo-* showcases keep their FEATURED meaning even if seeded under mock.
-        const mockDaemon = process.env.CODEHERE_MOCK === '1' || process.env.CODEHERE_MOCK === 'true';
-        const mockRun = mockDaemon && !rec.id.startsWith('demo-');
-        appendFileSync(file, JSON.stringify({ t: 'spawned', ...rec, mockRun }) + '\n', 'utf-8');
-    }
-    catch {
-        /* persistence is best-effort; never break the spawn path */
-    }
-}
-export function appendCompleted(rec) {
-    try {
-        const file = fileForSession(rec.id);
-        ensureDirFor(file);
-        appendFileSync(file, JSON.stringify({ t: 'completed', ...rec }) + '\n', 'utf-8');
-    }
-    catch {
-        /* best-effort */
-    }
-}
-/**
- * v0.6.x — persist a Final Report so it survives daemon restart.
- *
- * Pre-fix: Final Reports lived only in SessionManager.finalReportBySession
- * (in-memory Map) and were lost on every daemon bounce. Founder hit this
- * 2026-05-03 after a Mac restart: completed sessions showed
- * "Generating report…" forever because there was no on-disk record + no
- * "report-unavailable" state in the UI.
- *
- * Append-only: Final Report fires AFTER the CompletedRecord (generateFinalReport
- * is async post-exit), so it gets its own record type. Reader merges by id.
- */
-/** S3 · persist the human's "mark resolved" ack so it sticks across reload.
- *  Append-only like every other record; reader merges by id (last wins). */
-export function appendResolved(rec) {
-    try {
-        const file = fileForSession(rec.id);
-        ensureDirFor(file);
-        appendFileSync(file, JSON.stringify({ t: 'resolved', ...rec }) + '\n', 'utf-8');
-    }
-    catch {
-        /* best-effort */
-    }
-}
-export function appendFinalReport(rec) {
-    try {
-        const file = fileForSession(rec.id);
-        ensureDirFor(file);
-        appendFileSync(file, JSON.stringify({ t: 'finalReport', ...rec }) + '\n', 'utf-8');
-    }
-    catch {
-        /* best-effort */
-    }
-}
-/** Tier 2.2 · persist the audit↔disk reconciliation so the OBSERVED signal
- *  survives a daemon restart (mirrors appendFinalReport's async-post-exit shape). */
-export function appendAuditRecon(id, recon) {
-    try {
-        const file = fileForSession(id);
-        ensureDirFor(file);
-        appendFileSync(file, JSON.stringify({ t: 'audit-recon', id, recon }) + '\n', 'utf-8');
-    }
-    catch {
-        /* best-effort */
-    }
-}
-/**
- * Walk the session log backward, pair spawned+completed records by id, return
- * the most recent `limit` completed pairs sorted newest-first.
- *
- * We only surface fully-completed sessions because an orphaned `spawned` with
- * no `completed` means either: (a) the daemon died mid-task (subprocess also
- * died, no artifacts), or (b) a concurrent daemon is mid-flight (not ours to
- * show). Either way, not useful in the UI.
- */
-/**
- * v0.7 — load a single completed session by id. Returns undefined if no
- * matching session exists or if the session is orphaned (spawned but never
- * completed). Used by `codehere verify <session-id>` (F-03 S2) and the
- * upcoming `codehere audit verify` CLI (F-05).
- *
- * Walks the whole file once. For 1k+ sessions this is fine; if it ever
- * becomes hot we can keep an in-memory index.
- *
- * Accepts a short-id prefix too (first 7+ chars), mirroring git's UX.
- * If the prefix is ambiguous we return the most recent match (newest-first
- * traversal). Returning undefined on ambiguity would surprise users at
- * the CLI · git's `--abbrev-commit` collisions are very rare in practice
- * for our id space.
- */
-/** S18 · classification for the joined record. The run-time stamp wins. For
- *  LEGACY records written before the stamp existed, the mock adapter leaves
- *  two durable on-record signals, and either proves the run was practice:
- *  (1) it mints its own resume tokens "mock-…" (mock-agent-repl.ts) — a real
- *  vendor CLI never does; (2) its ONLY edit artifact is the hardcoded,
- *  gitignored `codehere-mock-change.md` (MOCK_EDIT_FILE) — conductor practice
- *  runs carry no resume token but their steps touched it. Classified on read
- *  so pre-stamp practice never renders as the founder's real work. demo-*
- *  showcases keep their FEATURED meaning. Records with neither stamp nor
- *  signal stay undefined (the reader's env fallback — genuinely no signal). */
-function recordedMockRun(s, c) {
-    if (s.mockRun !== undefined)
-        return s.mockRun;
-    if (s.id.startsWith('demo-'))
-        return undefined;
-    if (c.nativeSessionId?.startsWith('mock-'))
-        return true;
-    if (c.steps?.some((st) => st.label?.includes('codehere-mock-change.md')))
-        return true;
-    return undefined;
-}
-export function loadSessionById(idOrPrefix) {
-    const file = sessionsFile();
-    if (!existsSync(file))
-        return undefined;
-    let content;
-    try {
-        content = readFileSync(file, 'utf-8');
-    }
-    catch {
-        return undefined;
-    }
-    const spawned = new Map();
-    const completed = [];
-    const finalReports = new Map();
-    const resolved = new Map();
-    const auditRecons = new Map();
-    for (const line of content.split('\n')) {
-        const trimmed = line.trim();
-        if (!trimmed)
-            continue;
-        let rec;
-        try {
-            rec = JSON.parse(trimmed);
-        }
-        catch {
-            continue;
-        }
-        if (rec.t === 'spawned')
-            spawned.set(rec.id, rec);
-        else if (rec.t === 'completed')
-            completed.push(rec);
-        else if (rec.t === 'finalReport')
-            finalReports.set(rec.id, rec);
-        else if (rec.t === 'resolved')
-            resolved.set(rec.id, rec.resolvedAt);
-        else if (rec.t === 'audit-recon')
-            auditRecons.set(rec.id, rec.recon);
-    }
-    // Newest-first to break prefix-collision ties toward the most recent
-    for (let i = completed.length - 1; i >= 0; i--) {
-        const c = completed[i];
-        if (c.id !== idOrPrefix && !c.id.startsWith(idOrPrefix))
-            continue;
-        const s = spawned.get(c.id);
-        if (!s)
-            continue;
-        const fr = finalReports.get(c.id);
-        const mockRun = recordedMockRun(s, c);
-        const failoverFrom = c.failoverFrom ?? s.failoverFrom;
-        const failoverTo = c.failoverTo ?? s.failoverTo;
-        const failoverReason = c.failoverReason ?? s.failoverReason;
-        return {
-            sessionId: s.id,
-            agent: s.agent,
-            prompt: s.prompt,
-            cwd: s.cwd,
-            startedAt: s.startedAt,
-            status: c.status === 'running' && c.completedAt > 0 ? 'completed' : c.status,
-            durationMs: c.durationMs,
-            completedAt: c.completedAt,
-            steps: c.steps,
-            artifacts: c.artifacts,
-            ...(c.turns ? { turns: c.turns } : {}),
-            ...(fr
-                ? {
-                    finalReport: {
-                        summary: fr.summary,
-                        generatedAt: fr.generatedAt,
-                        durationMs: fr.durationMs,
-                        source: fr.source,
-                    },
-                }
-                : {}),
-            ...(failoverFrom ? { failoverFrom } : {}),
-            ...(failoverTo ? { failoverTo } : {}),
-            ...(failoverReason ? { failoverReason } : {}),
-            ...(s.failoverAt ? { failoverAt: s.failoverAt } : {}),
-            ...(c.stalledReason ? { stalledReason: c.stalledReason } : {}),
-            ...(s.batchId ? { batchId: s.batchId } : {}),
-            ...(c.delegatedTo ? { delegatedTo: c.delegatedTo } : {}),
-            ...(c.nativeSessionId ? { nativeSessionId: c.nativeSessionId } : {}),
-            ...(c.delegateSessionId ? { delegateSessionId: c.delegateSessionId } : {}),
-            ...(auditRecons.get(c.id) ? { auditRecon: auditRecons.get(c.id) } : {}),
-            ...(s.importedFrom ? { importedFrom: s.importedFrom } : {}),
-            ...(s.importAudit ? { importAudit: s.importAudit } : {}),
-            ...(s.parentSessionId ? { parentSessionId: s.parentSessionId } : {}),
-            ...(s.isReview ? { isReview: true } : {}),
-            ...(resolved.has(c.id) ? { resolvedAt: resolved.get(c.id) } : {}),
-            ...(mockRun !== undefined ? { mockRun } : {}),
-            provenance: 'persisted',
-        };
-    }
-    return undefined;
-}
-export function loadRecent(limit = 20) {
-    const file = sessionsFile();
-    if (!existsSync(file))
-        return [];
-    let content;
-    try {
-        content = readFileSync(file, 'utf-8');
-    }
-    catch {
-        return [];
-    }
-    const spawned = new Map();
-    const completed = [];
-    /** v0.6.x — Final Reports keyed by sessionId. Last write wins
-     *  (rare in practice; reports fire once per session). */
-    const finalReports = new Map();
-    const resolved = new Map();
-    const auditRecons = new Map();
-    for (const line of content.split('\n')) {
-        const trimmed = line.trim();
-        if (!trimmed)
-            continue;
-        let rec;
-        try {
-            rec = JSON.parse(trimmed);
-        }
-        catch {
-            continue;
-        }
-        if (rec.t === 'spawned')
-            spawned.set(rec.id, rec);
-        else if (rec.t === 'completed')
-            completed.push(rec);
-        else if (rec.t === 'finalReport')
-            finalReports.set(rec.id, rec);
-        else if (rec.t === 'resolved')
-            resolved.set(rec.id, rec.resolvedAt);
-        else if (rec.t === 'audit-recon')
-            auditRecons.set(rec.id, rec.recon);
-    }
-    const merged = [];
-    const includedIds = new Set();
-    const build = (c, s, fr) => {
-        const mockRun = recordedMockRun(s, c);
-        return {
-            sessionId: s.id,
-            agent: s.agent,
-            prompt: s.prompt,
-            cwd: s.cwd,
-            startedAt: s.startedAt,
-            // BUG 2 (May 1 2026) — defensive normalization for zombie records.
-            // Pre-fix sessions persisted before commit <THIS> were written with
-            // status='running' even when their completed-record carried real
-            // durationMs/completedAt — the conductor adapter mirrored its status
-            // AFTER emitting the exit event. The fix at the source (conductor-
-            // adapter.ts) prevents new zombies; this normalization repairs old
-            // records on read so the UI doesn't show a "running" badge on a
-            // session that obviously finished. We have no ground truth on what
-            // the actual exit code WAS for these old records, so 'completed' is
-            // the safest default — they'd been displayed as completed in the UI
-            // had this been a session-manager.ts bug. Mark explicitly via a
-            // synthetic note so debug viewers can tell normalization happened.
-            status: c.status === 'running' && c.completedAt > 0 ? 'completed' : c.status,
-            durationMs: c.durationMs,
-            completedAt: c.completedAt,
-            steps: c.steps,
-            artifacts: c.artifacts,
-            ...(c.turns ? { turns: c.turns } : {}),
-            ...(fr
-                ? {
-                    finalReport: {
-                        summary: fr.summary,
-                        generatedAt: fr.generatedAt,
-                        durationMs: fr.durationMs,
-                        source: fr.source,
-                    },
-                }
-                : {}),
-            ...((c.failoverFrom ?? s.failoverFrom) ? { failoverFrom: c.failoverFrom ?? s.failoverFrom } : {}),
-            ...((c.failoverTo ?? s.failoverTo) ? { failoverTo: c.failoverTo ?? s.failoverTo } : {}),
-            ...((c.failoverReason ?? s.failoverReason) ? { failoverReason: c.failoverReason ?? s.failoverReason } : {}),
-            ...(s.failoverAt ? { failoverAt: s.failoverAt } : {}),
-            ...(c.stalledReason ? { stalledReason: c.stalledReason } : {}),
-            ...(s.batchId ? { batchId: s.batchId } : {}),
-            ...(c.delegatedTo ? { delegatedTo: c.delegatedTo } : {}),
-            ...(c.nativeSessionId ? { nativeSessionId: c.nativeSessionId } : {}),
-            ...(c.delegateSessionId ? { delegateSessionId: c.delegateSessionId } : {}),
-            ...(auditRecons.get(c.id) ? { auditRecon: auditRecons.get(c.id) } : {}),
-            ...(s.importedFrom ? { importedFrom: s.importedFrom } : {}),
-            ...(s.importAudit ? { importAudit: s.importAudit } : {}),
-            ...(s.parentSessionId ? { parentSessionId: s.parentSessionId } : {}),
-            ...(s.isReview ? { isReview: true } : {}),
-            ...(resolved.has(c.id) ? { resolvedAt: resolved.get(c.id) } : {}),
-            ...(mockRun !== undefined ? { mockRun } : {}),
-            provenance: 'persisted',
-        };
-    };
-    // Walk completed in reverse so we return newest-first, up to `limit`.
-    for (let i = completed.length - 1; i >= 0 && merged.length < limit; i--) {
-        const c = completed[i];
-        const s = spawned.get(c.id);
-        if (!s || includedIds.has(c.id))
-            continue; // orphan / dup (harmless)
-        merged.push(build(c, s, finalReports.get(c.id)));
-        includedIds.add(c.id);
-    }
-    // Always include seeded demo-* sessions even past the recent-N cap. They're
-    // pinned to FEATURED in the dashboard and are the fixtures /verify observes —
-    // dropping them off the list once you have >limit real runs is a bug (it's
-    // what made /verify report seeded fixtures as "not rendered"). Newest-first.
-    for (let i = completed.length - 1; i >= 0; i--) {
-        const c = completed[i];
-        if (!c.id.startsWith('demo-') || includedIds.has(c.id))
-            continue;
-        const s = spawned.get(c.id);
-        if (!s)
-            continue;
-        merged.push(build(c, s, finalReports.get(c.id)));
-        includedIds.add(c.id);
-    }
-    return merged;
-}
-//# sourceMappingURL=session-persistence.js.map

package/dist/infrastructure/orchestration/thread-key-store.js

@@ -1,127 +0,0 @@
-/**
- * Thread-export key storage · v0.8 S4.
- *
- * Two responsibilities:
- *   1. Per-machine Ed25519 keypair · generated on first export · persisted
- *      at ~/.codehere/keys/thread-signing.{pem,pub.pem}. Used to SIGN
- *      bundles. 0600 on private file.
- *   2. Trusted-keys registry · ~/.codehere/keys/trusted.json maps base64
- *      public keys to { label, addedAt }. When importing a bundle whose
- *      key is in the trust store, replay proceeds silently. Otherwise the
- *      caller (CLI or web UI) prompts the user to trust + continue.
- *
- * Both files live ENTIRELY on the user's machine. Codehere never sends
- * keys anywhere. The trust model is "users trust their friends' keys" ·
- * same shape as SSH known_hosts.
- */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { homedir } from 'os';
-import { join } from 'path';
-import { generateKeypair, exportPrivatePem, exportPublicPem, importPrivatePem, importPublicPem, publicKeyToBase64, } from '../../application/use-cases/thread-export.js';
-export function keysDir() {
-    const home = process.env.CODEHERE_HOME || homedir();
-    return join(home, '.codehere', 'keys');
-}
-function privPath() {
-    return join(keysDir(), 'thread-signing.pem');
-}
-function pubPath() {
-    return join(keysDir(), 'thread-signing.pub.pem');
-}
-function trustedPath() {
-    return join(keysDir(), 'trusted.json');
-}
-/**
- * Load (or generate) the local signing keypair. First call creates a new
- * one and persists it; subsequent calls re-read from disk.
- */
-export function loadOrCreateKeypair() {
-    mkdirSync(keysDir(), { recursive: true });
-    if (existsSync(privPath()) && existsSync(pubPath())) {
-        const priv = readFileSync(privPath(), 'utf-8');
-        const pub = readFileSync(pubPath(), 'utf-8');
-        return {
-            privateKey: importPrivatePem(priv),
-            publicKey: importPublicPem(pub),
-        };
-    }
-    const fresh = generateKeypair();
-    writeFileSync(privPath(), exportPrivatePem(fresh.privateKey), 'utf-8');
-    writeFileSync(pubPath(), exportPublicPem(fresh.publicKey), 'utf-8');
-    try {
-        chmodSync(privPath(), 0o600);
-    }
-    catch { }
-    return fresh;
-}
-/**
- * Return the local key's base64 string (used in bundle equality + UI display).
- * Doesn't generate · only reads. Returns null if no key exists yet.
- */
-export function localPublicKeyBase64() {
-    if (!existsSync(pubPath()))
-        return null;
-    try {
-        const pub = readFileSync(pubPath(), 'utf-8');
-        return publicKeyToBase64(importPublicPem(pub));
-    }
-    catch {
-        return null;
-    }
-}
-export function loadTrustedKeys() {
-    const path = trustedPath();
-    const local = localPublicKeyBase64();
-    const seed = { schema: 1, keys: {} };
-    if (local)
-        seed.keys[local] = { label: 'this machine', addedAt: Date.now() };
-    if (!existsSync(path))
-        return seed;
-    try {
-        const raw = JSON.parse(readFileSync(path, 'utf-8'));
-        if (raw && typeof raw === 'object' && raw.schema === 1 && typeof raw.keys === 'object') {
-            // Always include the local key implicitly even if the trusted file
-            // doesn't list it (avoids "can't import my own export" if file is
-            // wiped or corrupted).
-            if (local && !raw.keys[local]) {
-                raw.keys[local] = { label: 'this machine', addedAt: Date.now() };
-            }
-            return raw;
-        }
-    }
-    catch {
-        /* fall through to seed */
-    }
-    return seed;
-}
-export function saveTrustedKeys(file) {
-    mkdirSync(keysDir(), { recursive: true });
-    writeFileSync(trustedPath(), JSON.stringify(file, null, 2) + '\n', 'utf-8');
-    try {
-        chmodSync(trustedPath(), 0o600);
-    }
-    catch { }
-}
-export function isKeyTrusted(publicKeyB64) {
-    return !!loadTrustedKeys().keys[publicKeyB64];
-}
-export function trustKey(publicKeyB64, label) {
-    const file = loadTrustedKeys();
-    file.keys[publicKeyB64] = { label, addedAt: Date.now() };
-    saveTrustedKeys(file);
-}
-export function untrustKey(publicKeyB64) {
-    const file = loadTrustedKeys();
-    const local = localPublicKeyBase64();
-    if (local && publicKeyB64 === local)
-        return false; // can't untrust own key
-    if (!file.keys[publicKeyB64])
-        return false;
-    delete file.keys[publicKeyB64];
-    saveTrustedKeys(file);
-    return true;
-}
-export function trustedKeySet() {
-    return new Set(Object.keys(loadTrustedKeys().keys));
-}
-//# sourceMappingURL=thread-key-store.js.map

package/dist/infrastructure/orchestration/write-pass-store.js

@@ -1,38 +0,0 @@
-/**
- * Write-pass store · v0.9 S6 part B · in-memory holding tank for pending
- * write-passes. Lives only in the daemon process · cleared on restart by
- * design. The audit chain is the durable record · this store just holds
- * the intent between emission and decision so the UI can poll it.
- *
- * Scope decisions:
- *   - In-memory only. A pending write that survives a daemon restart is
- *     a half-thought · the agent should re-emit. Persistence would invite
- *     replay attacks (an old approval against a payload the user no longer
- *     remembers).
- *   - Per-id Map. O(1) get/set. No iteration ordering guarantees · the
- *     UI lists them by intent.emittedAt for display.
- *   - Status transitions go through applyDecision / applyResponse in
- *     write-pass.ts so the store stays dumb · it's just a typed Map.
- */
-const store = new Map();
-/** Place a freshly-validated intent in the store as 'pending'. */
-export function putPending(intent) {
-    const status = { kind: 'pending', intent };
-    store.set(intent.id, status);
-    return status;
-}
-export function getById(passId) {
-    return store.get(passId);
-}
-export function setStatus(status) {
-    store.set(status.intent.id, status);
-}
-export function listPending() {
-    return [...store.values()].filter((s) => s.kind === 'pending');
-}
-export function listForSession(sessionId) {
-    return [...store.values()]
-        .filter((s) => s.intent.sessionId === sessionId)
-        .sort((a, b) => a.intent.emittedAt - b.intent.emittedAt);
-}
-//# sourceMappingURL=write-pass-store.js.map