codiedev 0.10.0-beta.10 → 0.10.0-beta.13

package/dist/cli.js

@@ -1,5 +1,38 @@
 #!/usr/bin/env node
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const connect_1 = require("./connect");
 const cliSession_1 = require("./cliSession");
@@ -110,6 +143,7 @@ Privacy:
   codiedev ignore <path>                 Never capture this folder or its children
   codiedev unignore <path>               Stop ignoring a folder
   codiedev ignored [path]                List ignored folders, or check one path
+  codiedev scrub [--dry-run]             Remove keys from past agent sessions on this machine
 
 Capture:
   codiedev note "<text>"                 Capture a passing thought
@@ -545,6 +579,11 @@ async function main() {
             case "read":
                 await (0, inbox_1.runRead)(rest);
                 return;
+            case "scrub": {
+                const { runScrubCommand } = await Promise.resolve().then(() => __importStar(require("./commands/scrub")));
+                process.exitCode = await runScrubCommand(rest);
+                return;
+            }
             case "note":
                 await (0, note_1.runNote)(rest);
                 return;

package/dist/commands/agents.js

@@ -154,7 +154,7 @@ result to \`/agent/.codiedev/output.json\`.
   Preinstalled: Python 3.12 with openai, mcp, httpx, pydantic; Node 22 with
   openai, @modelcontextprotocol/sdk, tsx; git, curl.
 - **Exit code:** 0 = succeeded. An exception or non-zero exit = failed, with
-  the last log line as the error. Everything printed goes to the run's log.
+  the exception (or the last log line) as the error. Everything printed goes to the run's log.
 
 ## The sandbox
 
@@ -168,12 +168,16 @@ variables:
 | \`CODIEDEV_GATEWAY_URL\`, \`CODIEDEV_API_KEY\` | The same two, under Codiedev names |
 | \`CODIEDEV_AGENT\`, \`CODIEDEV_RUN_ID\` | This agent's name and this run's id |
 | \`CODIEDEV_ATTEMPT\`, \`CODIEDEV_MAX_ATTEMPTS\` | Which try this is, out of how many |
+| \`CODIEDEV_MODEL\` | The agent's default model: the first one its key allows (unset when it allows every model) |
 | your secrets | Each by its own name, e.g. \`GITHUB_TOKEN\` |
 
 **Models:** use a model id from your company's **Models** page, like
 \`openai/gpt-5.1-codex-mini\`. A model your company hasn't approved fails with
 \`model_not_allowed\`. Calls are traced under the agent's name and count
 toward its \`budgetUsd\` (a monthly budget for the agent, not per run).
+A call counts toward a run's cost when it sends the header
+\`X-Codiedev-Run-Id: $CODIEDEV_RUN_ID\`. \`agents.openai()\` does; for any other
+client or tool, add the header yourself (see opencode below).
 
 **Dependencies** from \`package.json\` install into \`/agent/node_modules\`, so
 their binaries are in \`/agent/node_modules/.bin\`. Python packages are importable
@@ -193,7 +197,9 @@ config = {
     "autoupdate": False, "share": "disabled", "permission": "allow",
     "provider": {"codiedev": {
         "npm": "@ai-sdk/openai-compatible",
-        "options": {"baseURL": os.environ["OPENAI_BASE_URL"], "apiKey": "{env:OPENAI_API_KEY}"},
+        "options": {"baseURL": os.environ["OPENAI_BASE_URL"], "apiKey": "{env:OPENAI_API_KEY}",
+                    # Counts its model calls toward this run's cost.
+                    "headers": {"X-Codiedev-Run-Id": os.environ["CODIEDEV_RUN_ID"]}},
         "models": {MODEL: {}},
     }},
 }
@@ -455,13 +461,21 @@ function writeGuides(dir) {
     if (!fs.existsSync(path.join(dir, "CLAUDE.md")))
         fs.writeFileSync(path.join(dir, "CLAUDE.md"), "@AGENTS.md\n");
 }
+function fillTemplate(text, file, name, model) {
+    let out = text.replace(/%NAME%/g, name);
+    if (!model) {
+        const fallback = file.endsWith(".py") ? 'os.environ.get("CODIEDEV_MODEL", "codiedev/fast")' : '(process.env.CODIEDEV_MODEL ?? "codiedev/fast")';
+        out = out.replace(/"%MODEL%"/g, fallback);
+    }
+    return out.replace(/%MODEL%/g, model ?? "codiedev/fast");
+}
 async function initFromTemplate(name, dir, id, args) {
-    const model = flag(args, "--model") ?? "codiedev/fast";
+    const model = flag(args, "--model");
     const starter = agentTemplates_generated_1.TEMPLATES.find((t) => t.id === id);
     if (starter) {
         for (const [rel, text] of Object.entries(starter.files)) {
             fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
-            fs.writeFileSync(path.join(dir, rel), text.replace(/%NAME%/g, name).replace(/%MODEL%/g, model));
+            fs.writeFileSync(path.join(dir, rel), fillTemplate(text, rel, name, model));
         }
         writeGuides(dir);
         console.log(`Created ${path.relative(process.cwd(), dir) || "."}/ from the ${starter.title} template.`);
@@ -502,16 +516,15 @@ async function cmdInit(args) {
     if (existing)
         fail(`${dir} already has an ${existing}`);
     fs.mkdirSync(dir, { recursive: true });
-    const model = flag(args, "--model") ?? "codiedev/fast";
-    const fill = (t) => t.replace(/%NAME%/g, name).replace(/%MODEL%/g, model);
+    const model = flag(args, "--model");
     let entrypoint = "agent.py";
     if (lang.startsWith("py")) {
-        fs.writeFileSync(path.join(dir, "agent.py"), fill(STARTER_AGENT));
+        fs.writeFileSync(path.join(dir, "agent.py"), fillTemplate(STARTER_AGENT, "agent.py", name, model));
         fs.writeFileSync(path.join(dir, "requirements.txt"), "# Extra packages for this agent, one per line. openai, mcp, httpx and pydantic are preinstalled.\n");
     }
     else {
         entrypoint = lang.startsWith("t") ? "agent.ts" : "agent.mjs";
-        fs.writeFileSync(path.join(dir, entrypoint), fill(STARTER_TS));
+        fs.writeFileSync(path.join(dir, entrypoint), fillTemplate(STARTER_TS, entrypoint, name, model));
         fs.writeFileSync(path.join(dir, "package.json"), JSON.stringify({ name, private: true, type: "module", dependencies: {} }, null, 2) + "\n");
     }
     fs.writeFileSync(path.join(dir, "agent.json"), JSON.stringify({ name, entrypoint, timeoutSec: 600 }, null, 2) + "\n");

package/dist/commands/scrub.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SCRUB_HELP = void 0;
+exports.parseScrubArgs = parseScrubArgs;
+exports.formatScrubSummary = formatScrubSummary;
+exports.runScrubCommand = runScrubCommand;
+const localScrub_1 = require("../localScrub");
+exports.SCRUB_HELP = `codiedev scrub — remove keys from past agent sessions on this machine
+
+Usage:
+  codiedev scrub [--dry-run] [--path <file>]... [--session <id>]... [--min-age <minutes>]
+
+Cleans the session files Claude Code, Codex, Cursor, Copilot, OpenCode/Codie
+and pi keep locally, using the same rules as the Codiedev server. Each key is
+replaced with [REDACTED:<kind>]. Sessions changed in the last hour are skipped
+so open sessions are never touched. When signed in, what was found (session,
+key type and last 4, removed or not) shows on your Security page; the keys
+themselves never leave this machine.
+
+  --dry-run          Count what would be cleaned; change nothing
+  --path <file>      Only this file (repeatable)
+  --session <id>     With --path <opencode.db>: only this OpenCode/Codie session
+  --min-age <min>    Skip files changed in the last <min> minutes (default 60)
+`;
+function parseScrubArgs(args) {
+    let dryRun = false;
+    let help = false;
+    const only = [];
+    const sessions = [];
+    let minAgeMs = localScrub_1.MIN_AGE_MS;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--dry-run")
+            dryRun = true;
+        else if (a === "--help" || a === "-h")
+            help = true;
+        else if (a === "--path" && args[i + 1])
+            only.push(args[++i]);
+        else if (a === "--session" && args[i + 1])
+            sessions.push(args[++i]);
+        else if (a === "--min-age" && args[i + 1]) {
+            const m = Number(args[++i]);
+            if (Number.isFinite(m) && m >= 0)
+                minAgeMs = m * 60_000;
+        }
+    }
+    return { dryRun, help, minAgeMs, ...(only.length ? { only } : {}), ...(sessions.length ? { onlySessions: sessions } : {}) };
+}
+function formatScrubSummary(s) {
+    const lines = [];
+    const verb = s.dryRun ? "Would remove" : "Removed";
+    lines.push(s.redactions === 0
+        ? `No keys found in ${s.scanned} session file${s.scanned === 1 ? "" : "s"} checked.`
+        : `${verb} ${s.redactions} key${s.redactions === 1 ? "" : "s"}${s.dryRun ? "" : ` from ${s.cleaned} file${s.cleaned === 1 ? "" : "s"}`} (${s.scanned} checked).`);
+    for (const [h, t] of Object.entries(s.byHarness))
+        lines.push(`  ${h}: ${t.redactions} in ${t.files} file${t.files === 1 ? "" : "s"}`);
+    if (s.skippedRecent)
+        lines.push(`Skipped ${s.skippedRecent} changed in the last hour (may be open).`);
+    if (s.skippedLarge)
+        lines.push(`Skipped ${s.skippedLarge} over 100 MB.`);
+    if (s.changedWhileCleaning)
+        lines.push(`Left ${s.changedWhileCleaning} alone: changed while cleaning.`);
+    if (s.errors)
+        lines.push(`${s.errors} couldn't be read or written.`);
+    if (s.unfinished)
+        lines.push("Stopped at the time limit; the next run continues.");
+    if (s.leftInCursor.keys > 0) {
+        const { keys, chats } = s.leftInCursor;
+        lines.push(`${keys} key${keys === 1 ? " is" : "s are"} still in ${chats} Cursor chat${chats === 1 ? "" : "s"}. ` +
+            "Cursor's own chat store can't be cleaned without breaking the chat; delete those chats in Cursor to remove them.");
+    }
+    return lines.join("\n");
+}
+async function runScrubCommand(args) {
+    const opts = parseScrubArgs(args);
+    if (opts.help) {
+        console.log(exports.SCRUB_HELP);
+        return 0;
+    }
+    const summary = await (0, localScrub_1.runAndReport)({
+        dryRun: opts.dryRun,
+        only: opts.only,
+        onlySessions: opts.onlySessions,
+        minAgeMs: opts.minAgeMs,
+        budgetMs: 10 * 60_000,
+    });
+    console.log(formatScrubSummary(summary));
+    if (summary.reported)
+        console.log("Sent to your Security page in Codiedev (key type and last 4 only, never the key).");
+    return summary.errors > 0 ? 1 : 0;
+}

package/dist/hook.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildDiscoveryContext = buildDiscoveryContext;
+const localScrub_1 = require("./localScrub");
 const captureSignals_1 = require("./captureSignals");
 const transcriptModels_1 = require("./transcriptModels");
 const fs = __importStar(require("fs"));
@@ -442,6 +443,15 @@ async function main() {
         }
         process.exit(0);
     }
+    if (process.argv[2] === "local-scrub") {
+        try {
+            const { runAndReport } = await Promise.resolve().then(() => __importStar(require("./localScrub")));
+            await runAndReport();
+        }
+        catch {
+        }
+        process.exit(0);
+    }
     if (process.argv[2] === "self-update") {
         await (0, selfUpdate_1.runSelfUpdate)(process.argv[1]);
         process.exit(0);
@@ -489,6 +499,8 @@ async function main() {
             await runCodexLimitSweep(hookInput.session_id);
         if (source === "codex")
             (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
+        if (source === "codex")
+            (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()) });
         if (source !== "copilot")
             await runDiscover(hookInput.prompt);
         return;
@@ -530,6 +542,7 @@ async function main() {
         process.argv[2] === "session-start-opencode" ||
         process.argv[2] === "session-start-pi") {
         (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
+        (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()) });
         const packNag = process.argv[2] === "session-start-opencode" || process.argv[2] === "session-start-pi" ? null : (0, sync_1.packNagLine)();
         if (packNag && process.argv[2] === "session-start")
             process.stdout.write(`${packNag}\n`);