codehere 1.0.1 → 1.0.3

package/dist/infrastructure/security/file-collection.js

@@ -1,118 +0,0 @@
-/**
- * Canonical file-collection rules for the trust scanner.
- *
- * Historic bug: IGNORE_DIRS and the test-file filter lived in three places
- * (trust-command, mcp-helpers, report-command) and drifted. The v0.3.0-alpha
- * shipreadiness fix patched two of them; report-command kept the old rules
- * and produced different finding counts than `trust` for the same directory.
- *
- * Single source of truth now — every scanner entry point imports from here.
- */
-import { readdirSync, statSync } from 'fs';
-import { join, extname } from 'path';
-export const CODE_EXTENSIONS = new Set([
-    '.ts',
-    '.tsx',
-    '.js',
-    '.jsx',
-    '.mjs',
-    '.cjs',
-    '.py',
-    '.rb',
-    '.go',
-    '.java',
-    '.cs',
-    '.php',
-    '.sh',
-    '.bash',
-    '.zsh',
-    '.sql',
-    '.html',
-    '.vue',
-    '.svelte',
-]);
-export const IGNORE_DIRS = new Set([
-    // JS/TS
-    'node_modules',
-    'dist',
-    'build',
-    '.next',
-    '.nuxt',
-    '.svelte-kit',
-    '.turbo',
-    '.parcel-cache',
-    // Python
-    'venv',
-    '__pycache__',
-    '.pytest_cache',
-    '.ruff_cache',
-    '.mypy_cache',
-    '.tox',
-    '__pypackages__',
-    // Rust / Go / PHP / Java / .NET
-    'target',
-    'vendor',
-    '.gradle',
-    'obj',
-    // VCS / tooling / coverage / codehere
-    '.git',
-    '.hg',
-    '.svn',
-    'coverage',
-    '.cache',
-    '.codehere',
-    '.codehere-cache',
-    // Cloned reference repos used for dogfooding / comparison — not the user's code.
-    // Codehere convention; mirrors how `.git` is hidden tooling-data, not source.
-    '.oss-repos',
-    // Test fixtures / mocks (intentionally-vulnerable code used as scanner inputs)
-    'fixtures',
-    'test-fixtures',
-    '__fixtures__',
-    '__mocks__',
-]);
-// Test files contain deliberate vulnerability patterns as scanner inputs —
-// SQL injection strings, hardcoded "credentials" etc. — that inflate the
-// finding count without being real production risks. Skip by default.
-export const TEST_FILE_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
-export function shouldIgnoreDir(name) {
-    if (IGNORE_DIRS.has(name))
-        return true;
-    // Python virtualenv variants — .venv, .venv311, .venv-py3, venv3.11, env-py3
-    if (name.startsWith('.venv') || name.startsWith('venv'))
-        return true;
-    return false;
-}
-export function shouldIgnoreFile(name) {
-    return TEST_FILE_RE.test(name);
-}
-export function isCodeFile(name) {
-    return CODE_EXTENSIONS.has(extname(name)) && !shouldIgnoreFile(name);
-}
-/**
- * Walk a directory and return paths of code files worth scanning.
- * If `target` is a single file, it is returned as-is (explicit targets
- * are never excluded — user pointed at it on purpose).
- */
-export function collectCodeFiles(target) {
-    const stat = statSync(target);
-    if (stat.isFile())
-        return [target];
-    const files = [];
-    function walk(dir) {
-        for (const entry of readdirSync(dir, { withFileTypes: true })) {
-            if (shouldIgnoreDir(entry.name))
-                continue;
-            const full = join(dir, entry.name);
-            if (entry.isDirectory()) {
-                walk(full);
-            }
-            else if (isCodeFile(entry.name)) {
-                files.push(full);
-            }
-        }
-    }
-    walk(target);
-    return files;
-}
-//# sourceMappingURL=file-collection.js.map

package/dist/infrastructure/security/fix-code.js

@@ -1,144 +0,0 @@
-/**
- * AI fix + prove-closed for a CODE danger (not a leaked secret) — browser-auth, injection, unsafe HTML.
- * Spawns claude-code (subscription, async so it never blocks the daemon) to fix the specific issue,
- * then RE-SCANS to prove that exact danger no longer fires. Honest if it can't. Uses model spend.
- * The verify-loop (validated 0% false-positive) applied to the scan. docs/EXECUTION_PLAN step 2.
- */
-import { spawn } from 'node:child_process';
-import { shipScan } from './ship-scan.js';
-// Same pre-granted edit tools the daemon's claude-code adapter uses for headless -p mode.
-const CLAUDE_FLAGS = [
-    '--output-format',
-    'stream-json',
-    '--verbose',
-    '--allowedTools',
-    'Edit',
-    'Write',
-    'Read',
-    'Grep',
-    'Glob',
-    'MultiEdit',
-];
-const baseName = (p) => {
-    const s = String(p || '');
-    return s.split('/').pop() || s;
-};
-/** Turn one claude stream-json event into a plain-language step ('' = nothing worth showing). */
-function stepLabel(ev) {
-    if (!ev || ev.type !== 'assistant')
-        return '';
-    const content = ev.message?.content;
-    if (!Array.isArray(content))
-        return '';
-    for (const c of content) {
-        if (c?.type !== 'tool_use')
-            continue;
-        const name = String(c.name || '');
-        const input = c.input || {};
-        const f = baseName(input.file_path || input.path);
-        if (name === 'Edit' || name === 'MultiEdit' || name === 'Write')
-            return `Editing ${f}`;
-        if (name === 'Read')
-            return `Reading ${f}`;
-        if (name === 'Grep' || name === 'Glob')
-            return 'Searching the code';
-        return `Working (${name})`;
-    }
-    return '';
-}
-export async function fixCodeVuln(dir, top, onStep) {
-    const prompt = `There is a real security vulnerability in ${top.file} (around line ${top.line}): ${top.what} ` +
-        `Fix it properly so the app still works — change the code, don't just comment it. Edit only the file(s) needed in this project.`;
-    const env = { ...process.env };
-    delete env.ANTHROPIC_API_KEY; // use the Claude Code subscription, not pay-as-you-go
-    delete env.ANTHROPIC_AUTH_TOKEN;
-    // Don't repeat the same step twice in a row — keeps the live feed readable.
-    let lastLabel = '';
-    const step = (label) => {
-        if (!label || label === lastLabel)
-            return;
-        lastLabel = label;
-        try {
-            onStep?.(label);
-        }
-        catch {
-            /* a dead client must never crash the fix */
-        }
-    };
-    step('Starting the AI fix');
-    await new Promise((resolve) => {
-        let child;
-        try {
-            // Capture stdout (the stream-json feed) so we can surface live steps; stderr stays quiet.
-            child = spawn('claude', ['-p', prompt, ...CLAUDE_FLAGS], {
-                cwd: dir,
-                env: env,
-                stdio: ['ignore', 'pipe', 'ignore'],
-            });
-        }
-        catch {
-            resolve();
-            return;
-        }
-        let buf = '';
-        child.stdout?.on('data', (chunk) => {
-            buf += chunk.toString();
-            let nl;
-            while ((nl = buf.indexOf('\n')) >= 0) {
-                const line = buf.slice(0, nl).trim();
-                buf = buf.slice(nl + 1);
-                if (!line)
-                    continue;
-                let ev;
-                try {
-                    ev = JSON.parse(line);
-                }
-                catch {
-                    continue;
-                }
-                step(stepLabel(ev));
-            }
-        });
-        const timer = setTimeout(() => {
-            try {
-                child.kill('SIGKILL');
-            }
-            catch {
-                /* best effort */
-            }
-            resolve();
-        }, 180_000);
-        child.on('close', () => {
-            clearTimeout(timer);
-            resolve();
-        });
-        child.on('error', () => {
-            clearTimeout(timer);
-            resolve();
-        });
-    });
-    step('Re-scanning to prove the danger is gone');
-    // PROVE: re-scan and check the SAME danger (file + ruleId) is gone.
-    const after = shipScan(dir);
-    const stillThere = after.findings.some((f) => f.file === top.file && f.ruleId === top.ruleId);
-    // A finding can only be proven closed by the scanner that FOUND it. If that scanner failed on the
-    // re-scan, the danger "disappears" for the same reason a switched-off smoke alarm reports no fire.
-    // Absence of a finding from a scanner that never ran is not proof, and this loop's whole value is
-    // that its proof means something. (codehere's own vibeChecks run in-process, so they always ran.)
-    const proverRan = top.tool === 'codehere' || after.ran[top.tool];
-    if (!stillThere && !proverRan) {
-        return {
-            ok: true,
-            provenClosed: false,
-            message: `The AI rewrote ${top.file}, but codehere could not prove the fix: ${top.tool} failed to complete the re-scan, so the "${top.ruleId}" danger is unverified rather than gone. Re-run the scan once ${top.tool} is working.`,
-        };
-    }
-    return {
-        ok: true,
-        provenClosed: !stillThere,
-        message: !stillThere
-            ? `Proven closed: the AI rewrote ${top.file} and codehere re-scanned it — the "${top.ruleId}" danger is gone. Give the change a quick look before you ship.`
-            : `The AI tried, but codehere re-scanned and the "${top.ruleId}" danger is STILL in ${top.file}. Not fixed — this one needs your eyes (or a different fix).`,
-    };
-}
-//# sourceMappingURL=fix-code.js.map

package/dist/infrastructure/security/fix-secret.js

@@ -1,89 +0,0 @@
-/**
- * Deterministic "fix + prove closed" for an exposed secret — the #1 vibe-coder ship-blocker.
- * ZERO model tokens. Moves the hardcoded secret out of your shippable code (→ process.env + a
- * gitignored .env), then PROVES it by re-reading the source. Honest: you must still ROTATE the key
- * (moving it doesn't undo the exposure that already happened). See docs/PRODUCT_10X.md (R3).
- */
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, writeFileSync, existsSync, appendFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, relative, isAbsolute } from 'node:path';
-function topSecret(dir) {
-    const tmp = join(mkdtempSync(join(tmpdir(), 'fixsec-')), 'gl.json');
-    spawnSync('gitleaks', ['detect', '--no-git', '--source', dir, '-f', 'json', '-r', tmp], { stdio: 'ignore' });
-    if (!existsSync(tmp))
-        return null;
-    let arr;
-    try {
-        arr = JSON.parse(readFileSync(tmp, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-    if (!arr || !arr.length)
-        return null;
-    // Prefer a secret still living in shippable source (not one already moved into a .env).
-    const f = arr.find((x) => !String(x.File || '').endsWith('.env')) || arr[0];
-    return {
-        file: String(f.File),
-        secret: String(f.Secret),
-        line: Number(f.StartLine || 0),
-        ruleId: String(f.RuleID || 'secret'),
-    };
-}
-function deriveVarName(line, ruleId) {
-    const m = line.match(/(?:const|let|var)?\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*[:=]/);
-    let name = m ? m[1] : `SECRET_${ruleId}`;
-    name = name
-        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
-        .toUpperCase()
-        .replace(/[^A-Z0-9_]/g, '_');
-    return name || 'APP_SECRET';
-}
-export function fixExposedSecret(dir) {
-    const t = topSecret(dir);
-    if (!t)
-        return {
-            ok: false,
-            reason: 'no_secret',
-            message: 'The top issue here is a code change, not a leaked key — auto-fix for code vulnerabilities is the next step (it needs an agent).',
-        };
-    if (!existsSync(t.file))
-        return { ok: false, reason: 'file_gone', message: 'The flagged file is no longer there.' };
-    let src = readFileSync(t.file, 'utf8');
-    if (!src.includes(t.secret))
-        return { ok: false, reason: 'not_found', message: 'Could not locate the secret in the file to replace.' };
-    const lineText = src.split('\n').find((l) => l.includes(t.secret)) || '';
-    const varName = deriveVarName(lineText, t.ruleId);
-    // Replace the literal with process.env.VARNAME (quoted forms first, bare as a fallback).
-    src = src
-        .split(`"${t.secret}"`)
-        .join(`process.env.${varName}`)
-        .split(`'${t.secret}'`)
-        .join(`process.env.${varName}`)
-        .split(t.secret)
-        .join(`process.env.${varName}`);
-    writeFileSync(t.file, src);
-    // Move the value to a gitignored .env.
-    const env = join(dir, '.env');
-    if (!existsSync(env) || !readFileSync(env, 'utf8').includes(`${varName}=`))
-        appendFileSync(env, `${varName}=${t.secret}\n`);
-    const gi = join(dir, '.gitignore');
-    const giTxt = existsSync(gi) ? readFileSync(gi, 'utf8') : '';
-    if (!/^\.env\s*$/m.test(giTxt))
-        writeFileSync(gi, (giTxt && !giTxt.endsWith('\n') ? `${giTxt}\n` : giTxt) + '.env\n');
-    // PROVE CLOSED: the secret must be gone from shippable source.
-    const provenClosed = !readFileSync(t.file, 'utf8').includes(t.secret);
-    const file = isAbsolute(t.file) ? relative(dir, t.file) : t.file;
-    return {
-        ok: true,
-        file,
-        varName,
-        provenClosed,
-        rotate: true,
-        message: provenClosed
-            ? `Proven closed: the secret is gone from ${file} — it now reads process.env.${varName}, and the value moved to .env (now gitignored, so it won't ship or get committed). ⚠ You MUST still rotate this key now — it was already exposed, so revoke the old value.`
-            : `Moved the secret to .env, but couldn't fully verify removal from ${file} — please check it by hand.`,
-    };
-}
-//# sourceMappingURL=fix-secret.js.map

package/dist/infrastructure/security/permissions-config.js

@@ -1,235 +0,0 @@
-import { writeFileAtomic } from '../storage/atomic-write.js';
-/**
- * Per-cwd permissions config — P18 slice 1 primitive.
- *
- * Reads `.codehere/permissions.yaml` from a project's cwd and lets the
- * trust-scorer SKIP findings whose matched text fits an allow pattern.
- *
- * Use case: codehere blocks `rm -rf node_modules` because the pattern
- * matches `rm -rf /`. The user knows it's safe in THIS cwd. They run
- * `codehere permission allow "rm -rf node_modules"` (slice 2 CLI) and
- * future blocks for that exact pattern in this cwd are skipped.
- *
- * Schema (.codehere/permissions.yaml):
- *
- *   allow:
- *     - pattern: "rm -rf node_modules"
- *       reason: "OK to nuke deps in this repo"
- *       addedAt: 2026-05-08T20:00:00Z
- *     - pattern: "ANTHROPIC_API_KEY"
- *       reason: "Doc explains env vars; not actually leaking"
- *
- * Allow patterns are STRINGS not regex — exact substring match against
- * the audit-finding `matched` field. Keeps the schema simple +
- * non-technical-user friendly. Regex support is a v0.7 follow-up.
- *
- * Per claim_user_persona HIGH: the YAML is human-readable; non-
- * technical users can edit it directly. Per overconfidence-guard:
- * we DON'T claim the allow-list is "secure" — it's user CONSENT,
- * not codehere certification.
- */
-import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
-const EMPTY = { allow: [], deny: [] };
-/**
- * Load .codehere/permissions.yaml from a cwd. Returns empty config if
- * the file doesn't exist or fails to parse. Defensive: never throws —
- * caller treats absence as "no overrides", which is the safest default
- * (the scanner blocks normally).
- */
-export function loadPermissions(cwd) {
-    if (!cwd || typeof cwd !== 'string')
-        return EMPTY;
-    const file = join(cwd, '.codehere', 'permissions.yaml');
-    if (!existsSync(file))
-        return EMPTY;
-    let raw;
-    try {
-        raw = readFileSync(file, 'utf-8');
-    }
-    catch {
-        return EMPTY;
-    }
-    return parsePermissionsYaml(raw);
-}
-/**
- * Tiny YAML subset parser — only handles the shape this file uses
- * (top-level allow/deny lists of {pattern, reason, addedAt} objects).
- * No external dep; the codehere repo already avoids the `yaml` package
- * for read paths to keep cold-start fast. Format errors yield empty
- * config (same posture as missing file).
- */
-export function parsePermissionsYaml(raw) {
-    const cfg = { allow: [], deny: [] };
-    let bucket = null;
-    let pending = null;
-    for (const line of raw.split('\n')) {
-        const stripped = line.replace(/#.*$/, '').trimEnd();
-        if (!stripped.trim())
-            continue;
-        // Top-level key: "allow:" or "deny:"
-        const top = stripped.match(/^(allow|deny)\s*:\s*$/);
-        if (top) {
-            // Flush any pending entry into the previous bucket
-            if (pending && bucket && pending.pattern)
-                cfg[bucket].push(pending);
-            pending = null;
-            bucket = top[1];
-            continue;
-        }
-        if (!bucket)
-            continue;
-        // List entry start: "  - pattern: ..."
-        const listStart = stripped.match(/^\s*-\s+pattern\s*:\s*(.+)$/);
-        if (listStart) {
-            if (pending && pending.pattern)
-                cfg[bucket].push(pending);
-            pending = { pattern: unquote(listStart[1]) };
-            continue;
-        }
-        // Continuation field on a pending entry
-        const cont = stripped.match(/^\s+(reason|addedAt)\s*:\s*(.+)$/);
-        if (cont && pending) {
-            const key = cont[1];
-            pending[key] = unquote(cont[2]);
-        }
-    }
-    if (pending && bucket && pending.pattern)
-        cfg[bucket].push(pending);
-    return cfg;
-}
-function unquote(s) {
-    const t = s.trim();
-    if ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))) {
-        return t.slice(1, -1);
-    }
-    return t;
-}
-/**
- * Check whether a finding's matched text is allow-listed in this cwd.
- * Substring match — exact-text patterns are simpler for non-technical
- * users than regex. Returns the matching entry (for audit-trail
- * provenance) or null if no match.
- */
-export function isAllowed(matchedText, cwd) {
-    const cfg = loadPermissions(cwd);
-    for (const entry of cfg.allow) {
-        if (entry.pattern && matchedText.includes(entry.pattern))
-            return entry;
-    }
-    return null;
-}
-/**
- * Filter a findings list against the allow-list for a cwd. Returns
- * the findings that survived (i.e., were NOT allow-listed). Used by
- * the trust-scorer / pre-prompt-scan to drop findings that the user
- * has explicitly approved.
- *
- * Side-effect-free: the allow-listed findings are dropped from the
- * caller's perspective. The audit log writer can still record the
- * full finding list IF the caller wants (then mark which were
- * allow-listed). This function is the simple "what should we still
- * block on" filter.
- */
-export function filterAllowed(findings, cwd) {
-    if (findings.length === 0)
-        return { surviving: [], allowed: [] };
-    const cfg = loadPermissions(cwd);
-    if (cfg.allow.length === 0)
-        return { surviving: findings, allowed: [] };
-    const surviving = [];
-    const allowed = [];
-    for (const f of findings) {
-        const hit = cfg.allow.find((e) => e.pattern && f.matched.includes(e.pattern));
-        if (hit)
-            allowed.push({ finding: f, entry: hit });
-        else
-            surviving.push(f);
-    }
-    return { surviving, allowed };
-}
-// ── Write surface (P18 slice 3) ─────────────────────────────────────────────
-// Shared by the CLI (`codehere permission allow ...`) and the HTTP write
-// endpoint (POST /api/permissions). Single source of truth for the
-// idempotent-add semantics + the YAML serializer.
-import { mkdirSync } from 'fs';
-/**
- * Idempotent add — if the pattern already exists in the bucket, returns
- * status='already_present' with the existing entry. Otherwise appends +
- * writes the file. Writes via Write tool semantics (overwrites the
- * whole YAML each time; entries are O(N) so re-serialization is cheap).
- */
-export function addPermissionEntry(input) {
-    const bucket = input.bucket ?? 'allow';
-    const cfg = loadPermissions(input.cwd);
-    const list = cfg[bucket];
-    const existing = list.find((e) => e.pattern === input.pattern);
-    if (existing) {
-        return {
-            status: 'already_present',
-            bucket,
-            entry: existing,
-            filePath: join(input.cwd, '.codehere', 'permissions.yaml'),
-        };
-    }
-    const entry = {
-        pattern: input.pattern,
-        ...(input.reason ? { reason: input.reason } : {}),
-        addedAt: new Date().toISOString(),
-    };
-    cfg[bucket].push(entry);
-    const filePath = writePermissionsConfig(input.cwd, cfg);
-    return { status: 'added', bucket, entry, filePath };
-}
-/**
- * Idempotent remove — drops every entry whose pattern matches across
- * BOTH buckets. Returns count of removed entries.
- */
-export function removePermissionEntry(cwd, pattern) {
-    const cfg = loadPermissions(cwd);
-    const before = cfg.allow.length + cfg.deny.length;
-    cfg.allow = cfg.allow.filter((e) => e.pattern !== pattern);
-    cfg.deny = cfg.deny.filter((e) => e.pattern !== pattern);
-    const after = cfg.allow.length + cfg.deny.length;
-    const removed = before - after;
-    if (removed > 0)
-        writePermissionsConfig(cwd, cfg);
-    return { removed, filePath: join(cwd, '.codehere', 'permissions.yaml') };
-}
-function writePermissionsConfig(cwd, cfg) {
-    const dir = join(cwd, '.codehere');
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
-    const filePath = join(dir, 'permissions.yaml');
-    writeFileAtomic(filePath, serializePermissionsYaml(cfg));
-    return filePath;
-}
-export function serializePermissionsYaml(cfg) {
-    const out = [];
-    out.push('# codehere permissions — per-folder allow/deny list');
-    out.push('# See: codehere permission --help');
-    out.push('');
-    for (const bucket of ['allow', 'deny']) {
-        out.push(`${bucket}:`);
-        if (cfg[bucket].length === 0) {
-            out.push('  []');
-        }
-        else {
-            for (const e of cfg[bucket]) {
-                out.push(`  - pattern: ${quoteYaml(e.pattern)}`);
-                if (e.reason)
-                    out.push(`    reason: ${quoteYaml(e.reason)}`);
-                if (e.addedAt)
-                    out.push(`    addedAt: ${quoteYaml(e.addedAt)}`);
-            }
-        }
-        out.push('');
-    }
-    return out.join('\n');
-}
-function quoteYaml(s) {
-    if (s.includes('"') && !s.includes("'"))
-        return `'${s}'`;
-    return `"${s.replace(/"/g, '\\"')}"`;
-}
-//# sourceMappingURL=permissions-config.js.map

package/dist/infrastructure/security/scan-types.js

@@ -1,10 +0,0 @@
-/**
- * The shape a scan finding takes, shared by everything that produces or consumes one.
- *
- * These lived in ship-scan.ts, which made vibe-checks.ts import from the module that imports
- * it — a type-only cycle, erased at compile time and harmless at runtime, but the release
- * checklist requires zero circular dependencies and a type-only cycle is still a cycle a
- * later value import can turn into a real one.
- */
-export {};
-//# sourceMappingURL=scan-types.js.map