codiedev 0.10.0-beta.15 → 0.10.0-beta.17

package/dist/connect.js

@@ -223,6 +223,9 @@ async function runConnect(args = []) {
         deviceName: saved?.deviceName || os.hostname(),
         captureIgnoredPaths: saved?.captureIgnoredPaths ?? [],
         ...(auth ? { auth } : {}),
+        features: {
+            projects: responseData.features?.projects === true,
+        },
     };
     try {
         (0, utils_1.writeConfig)(config);

package/dist/hook.js

@@ -53,6 +53,7 @@ const launchContext_1 = require("./launchContext");
 const selfUpdate_1 = require("./selfUpdate");
 const version_1 = require("./version");
 const sync_1 = require("./packs/sync");
+const unreadNotice_1 = require("./unreadNotice");
 const captureLog_1 = require("./captureLog");
 const subagents_1 = require("./subagents");
 const captureExclusions_1 = require("./captureExclusions");
@@ -61,6 +62,7 @@ const copilotHooks_1 = require("./copilotHooks");
 const piHooks_1 = require("./piHooks");
 const cliSession_1 = require("./cliSession");
 const utils_2 = require("./utils");
+const promptGuard_1 = require("./promptGuard");
 function buildDiscoveryContext(skills) {
     if (skills.length === 0)
         return null;
@@ -222,19 +224,20 @@ async function postSessionSkip(config, sessionId, reason) {
 async function runSessionStart(hookInput, source = "claude-code") {
     const config = (0, utils_1.readConfig)();
     if (!config)
-        return;
+        return undefined;
     if (hookInput.session_id) {
         try {
-            await postJson(`${config.backendUrl}/api/cli/sessionStart`, {
+            const res = await postJsonForResponse(`${config.backendUrl}/api/cli/sessionStart`, {
                 sessionId: hookInput.session_id,
                 startedAt: Date.now(),
                 source,
             }, config.token, PING_TIMEOUT_MS);
+            return res?.unreadPings;
         }
         catch {
         }
     }
-    return;
+    return undefined;
 }
 function postJson(url, body, bearerToken, timeoutMs) {
     return new Promise((resolve, reject) => {
@@ -478,6 +481,40 @@ async function main() {
     if (process.argv[2]?.startsWith("security-"))
         process.exit(0);
     const captureIgnored = (0, captureExclusions_1.shouldIgnoreCaptureInput)((0, utils_1.readConfig)(), hookInput);
+    if (process.argv[2] === "prompt-guard-refresh") {
+        await (0, cliSession_1.ensureFreshToken)({ configPath: utils_2.CONFIG_PATH }).catch(() => undefined);
+        await (0, promptGuard_1.refreshPromptGuardPolicy)((0, utils_1.readConfig)());
+        process.exit(0);
+    }
+    const PROMPT_HOOKS = {
+        discover: "claude-code",
+        "discover-codex": "codex",
+        "discover-codie": "codie-harness",
+        "discover-copilot": "copilot",
+        "discover-pi": "pi",
+        "prompt-guard-cursor": "cursor",
+    };
+    const promptHarness = PROMPT_HOOKS[process.argv[2] ?? ""];
+    if (promptHarness) {
+        const guard = (0, promptGuard_1.checkPrompt)(hookInput.prompt, promptHarness, (0, promptGuard_1.readPromptGuardPolicy)());
+        (0, promptGuard_1.maybeSpawnPromptGuardRefresh)({ connected: Boolean((0, utils_1.readConfig)()) });
+        if (guard.blocked) {
+            (0, captureLog_1.appendCaptureLog)({
+                stage: "prompt-guard",
+                sessionId: hookInput.session_id ?? "unknown",
+                outcome: "ok",
+                detail: `blocked harness=${promptHarness} rule=${guard.key.rule}`,
+            });
+            process.stdout.write(JSON.stringify(guard.response));
+            if (!captureIgnored)
+                await (0, promptGuard_1.reportPromptBlocked)((0, utils_1.readConfig)(), guard.key.rule, promptHarness);
+            process.exit(0);
+        }
+        if (promptHarness === "cursor") {
+            process.stdout.write(JSON.stringify({ continue: true }));
+            process.exit(0);
+        }
+    }
     const promptCommand = process.argv[2] ?? "";
     if (process.argv[2] === "discover" ||
         process.argv[2] === "discover-codex" ||
@@ -501,6 +538,8 @@ async function main() {
             (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
         if (source === "codex")
             (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
+        if ((0, launchContext_1.isScriptedPrompt)(source, hookInput))
+            return;
         if (source !== "copilot")
             await runDiscover(hookInput.prompt);
         return;
@@ -543,10 +582,11 @@ async function main() {
         process.argv[2] === "session-start-pi") {
         (0, sync_1.maybeSpawnPackSync)({ connected: Boolean((0, utils_1.readConfig)()), cli: path.join(__dirname, "cli.js") });
         (0, localScrub_1.maybeSpawnLocalScrub)({ connected: Boolean((0, utils_1.readConfig)()), cwd: hookInput.cwd });
+        (0, promptGuard_1.maybeSpawnPromptGuardRefresh)({ connected: Boolean((0, utils_1.readConfig)()) });
         const packNag = process.argv[2] === "session-start-opencode" || process.argv[2] === "session-start-pi" ? null : (0, sync_1.packNagLine)();
         if (packNag && process.argv[2] === "session-start")
             process.stdout.write(`${packNag}\n`);
-        await runSessionStart(hookInput, process.argv[2] === "session-start-opencode"
+        const unreadPings = await runSessionStart(hookInput, process.argv[2] === "session-start-opencode"
             ? "opencode"
             : process.argv[2] === "session-start-cursor"
                 ? "cursor"
@@ -555,13 +595,18 @@ async function main() {
                     : process.argv[2] === "session-start-pi"
                         ? "pi"
                         : "claude-code");
+        const unreadNotice = process.argv[2] === "session-start-opencode" || process.argv[2] === "session-start-pi"
+            ? null
+            : (0, unreadNotice_1.takeUnreadNotice)(unreadPings);
+        if (unreadNotice && process.argv[2] === "session-start")
+            process.stdout.write(`${unreadNotice}\n`);
         if ((0, utils_1.readConfig)() && (process.argv[2] === "session-start-cursor" || process.argv[2] === "session-start-copilot")) {
             const source = process.argv[2] === "session-start-cursor" ? "cursor" : "copilot";
             const { TEAM_SKILL_CONTEXT, teamSkillSessionOutput } = await Promise.resolve().then(() => __importStar(require("./teamSkillContext")));
             const prompt = hookInput.initialPrompt
                 ?? hookInput.initial_prompt;
             const discovered = typeof prompt === "string" ? await discoverContext(prompt) : null;
-            process.stdout.write(JSON.stringify(teamSkillSessionOutput(source, [TEAM_SKILL_CONTEXT, discovered, packNag].filter(Boolean).join("\n\n"))));
+            process.stdout.write(JSON.stringify(teamSkillSessionOutput(source, [TEAM_SKILL_CONTEXT, discovered, packNag, unreadNotice].filter(Boolean).join("\n\n"))));
         }
         return;
     }

package/dist/inboxFormat.js

@@ -1,7 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.fileList = fileList;
 exports.formatInbox = formatInbox;
 const shared_1 = require("./commands/shared");
+function fileSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${Math.round(bytes / 1024)} KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function fileList(files) {
+    return files.map((f) => `${f.name} (${fileSize(f.size)})`).join(", ");
+}
 function formatInbox(opts) {
     const mentions = opts.mentions ?? [];
     const DEFAULT_LIMIT = 50;
@@ -25,6 +36,9 @@ function formatInbox(opts) {
         const where = p.subjectKey ? ` · on ${p.subjectKey}` : "";
         lines.push(`${dot}  ${from}${where} · ${(0, shared_1.timeAgo)(p.createdAt)}`);
         lines.push(`    ${p.preview || "(no body)"}`);
+        if (p.attachments?.length) {
+            lines.push(`    ${p.attachments.length === 1 ? "file" : "files"}: ${fileList(p.attachments)}`);
+        }
         lines.push(`    id: ${p.pingId}`);
         lines.push("");
     }
@@ -39,7 +53,9 @@ function formatInbox(opts) {
             lines.push(`    ${m.url}`);
         lines.push("");
     }
-    if (keptPings.length > 0)
+    if (keptPings.length > 0) {
         lines.push("Mark read: codiedev read <ping-id>");
+        lines.push('Reply:     codiedev reply <ping-id> "<message>"');
+    }
     return lines;
 }

package/dist/launchContext.js

@@ -7,7 +7,10 @@ exports.windowsAncestors = windowsAncestors;
 exports.detectCursorLaunch = detectCursorLaunch;
 exports.detectCopilotLaunch = detectCopilotLaunch;
 exports.hookLaunch = hookLaunch;
+exports.codexLaunchFromRolloutHead = codexLaunchFromRolloutHead;
+exports.isScriptedPrompt = isScriptedPrompt;
 const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
 const VALUE = /^[a-z0-9][a-z0-9_.:-]{0,39}$/;
 const CODIE_SUBCOMMANDS = ["run", "serve", "acp", "web", "attach"];
 function codieLaunchFromArgv(argv) {
@@ -148,3 +151,56 @@ function hookLaunch(hookCommand, input, deps = {}) {
     }
     return undefined;
 }
+const SCRIPTED_LAUNCHES = new Set([
+    "codex:exec", "codex:mcp",
+    "codie:run", "codie:serve", "codie:acp",
+    "cursor:print", "copilot:print",
+    "pi:print", "pi:json", "pi:rpc",
+]);
+const isScriptedLaunch = (launch) => launch.startsWith("sdk") || SCRIPTED_LAUNCHES.has(launch);
+function codexLaunchFromRolloutHead(head) {
+    const end = head.indexOf("\n");
+    if (end < 0)
+        return undefined;
+    try {
+        const first = JSON.parse(head.slice(0, end));
+        if (first?.type !== "session_meta")
+            return undefined;
+        const src = first.payload?.source;
+        if (typeof src === "string")
+            return VALUE.test(`codex:${src}`) ? `codex:${src}` : undefined;
+        if (src && typeof src === "object")
+            return `codex:${Object.keys(src)[0] ?? "other"}`;
+    }
+    catch {
+    }
+    return undefined;
+}
+function readHead(file, bytes = 256 * 1024) {
+    let fd;
+    try {
+        fd = (0, node_fs_1.openSync)(file, "r");
+        const buf = Buffer.alloc(bytes);
+        return buf.toString("utf8", 0, (0, node_fs_1.readSync)(fd, buf, 0, bytes, 0));
+    }
+    catch {
+        return "";
+    }
+    finally {
+        if (fd !== undefined)
+            (0, node_fs_1.closeSync)(fd);
+    }
+}
+function isScriptedPrompt(harness, input, deps = {}) {
+    if (typeof input.launch === "string" && VALUE.test(input.launch))
+        return isScriptedLaunch(input.launch);
+    if (harness === "claude-code") {
+        const entrypoint = (deps.env ?? process.env).CLAUDE_CODE_ENTRYPOINT;
+        return typeof entrypoint === "string" && entrypoint.startsWith("sdk");
+    }
+    if (harness === "codex" && typeof input.transcript_path === "string" && input.transcript_path) {
+        const launch = codexLaunchFromRolloutHead((deps.readHead ?? readHead)(input.transcript_path));
+        return launch !== undefined && isScriptedLaunch(launch);
+    }
+    return false;
+}

package/dist/launcher.js

@@ -37,15 +37,17 @@ exports.LAUNCHER_FILE = void 0;
 exports.launcherPath = launcherPath;
 exports.usesLauncher = usesLauncher;
 exports.readInstallRecord = readInstallRecord;
+exports.isInTempDir = isInTempDir;
 exports.stableHookScript = stableHookScript;
 exports.recordCurrentInstall = recordCurrentInstall;
 exports.ensureLauncher = ensureLauncher;
 exports.resetLauncherCacheForTests = resetLauncherCacheForTests;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const configDir_1 = require("./configDir");
 exports.LAUNCHER_FILE = "codiedev-hook-launcher.cjs";
-const LAUNCHER_REVISION = 1;
+const LAUNCHER_REVISION = 2;
 function launcherPath() {
     return path.join((0, configDir_1.codiedevStateDir)(), "bin", exports.LAUNCHER_FILE);
 }
@@ -67,6 +69,12 @@ try {
   if (rec && typeof rec.hookScript === "string" && fs.existsSync(rec.hookScript)) target = rec.hookScript;
 } catch {}
 if (!target && fs.existsSync(FALLBACK)) target = FALLBACK;
+if (!target) {
+  // Both stranded (e.g. a deleted temp build): use a global install next to this node.
+  const prefix = path.dirname(path.dirname(process.execPath));
+  target = [path.join(prefix, "lib", "node_modules", "codiedev", "dist", "hook.js"),
+    path.join(prefix, "node_modules", "codiedev", "dist", "hook.js")].find((p) => fs.existsSync(p)) || null;
+}
 if (!target) process.exit(0);
 process.env.CODIEDEV_VIA_LAUNCHER = "1";
 process.argv[1] = target;
@@ -97,11 +105,26 @@ function packageVersionFor(hookScript) {
         return undefined;
     }
 }
+function isInTempDir(p, tmp = os.tmpdir()) {
+    const real = (x) => {
+        try {
+            return fs.realpathSync(x);
+        }
+        catch {
+            return path.resolve(x);
+        }
+    };
+    const rel = path.relative(real(tmp), real(p));
+    return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
 function stableHookScript(hookScript, globalCandidates = globalHookScripts()) {
     if (!hookScript || !path.isAbsolute(hookScript) || hookScript.includes(`${path.sep}~${path.sep}`))
         return null;
     if (!fs.existsSync(hookScript))
         return null;
+    if (process.env.CODIEDEV_ALLOW_TEMP_HOOK !== "1" && isInTempDir(hookScript)) {
+        return globalCandidates.find((p) => path.isAbsolute(p) && fs.existsSync(p) && !isInTempDir(p)) ?? null;
+    }
     if (hookScript.includes(`${path.sep}_npx${path.sep}`)) {
         const global = globalCandidates.find((p) => path.isAbsolute(p) && fs.existsSync(p));
         if (global)

package/dist/localScrub.js

@@ -97,6 +97,12 @@ function sessionStores(env = process.env, home = os.homedir(), stateDir = (0, co
             root: path.join((0, copilotHooks_1.copilotHome)(env, home), "session-state"),
             match: (f) => path.basename(f) === "workspace.yaml",
         },
+        {
+            harness: "copilot",
+            kind: "json",
+            root: path.join((0, copilotHooks_1.copilotHome)(env, home), "session-state"),
+            match: (f) => path.basename(f) === "index.json" && path.basename(path.dirname(f)) === "rewind-file-snapshots",
+        },
         { harness: "pi", kind: "jsonl", root: path.join((0, harnessDirs_1.piAgentDir)(env, home), "sessions"), match: isJsonl },
         { harness: "pi", kind: "jsonl", root: path.join(stateDir, "managed", "pi", "agent", "sessions"), match: isJsonl },
         { harness: "opencode", kind: "json", root: path.join(stateDir, "opencode-captures"), match: (f) => f.endsWith(".json") },

package/dist/localScrubReport.js

@@ -182,8 +182,10 @@ function sessionKeyOf(harness, file) {
     const base = path.basename(file);
     if (base === "history.jsonl")
         return "history";
-    if (harness === "copilot")
-        return path.basename(path.dirname(file));
+    if (harness === "copilot") {
+        const dir = path.dirname(file);
+        return path.basename(path.basename(dir) === "rewind-file-snapshots" ? path.dirname(dir) : dir);
+    }
     const uuid = base.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i);
     if (uuid)
         return uuid[1];

package/dist/managedPi.js

@@ -190,6 +190,7 @@ function prepareManagedPiDir(opts) {
     });
     fs.rmSync(path.join(agentDir, "auth.json"), { force: true });
     fs.rmSync(path.join(agentDir, "extensions"), { recursive: true, force: true });
+    fs.writeFileSync(path.join(agentDir, "AGENTS.md"), (0, utils_1.codiedevInstructionsText)(), { mode: 0o600 });
     const guard = path.join(agentDir, exports.GUARD_FILE);
     fs.writeFileSync(guard, exports.GUARD_SOURCE, { mode: 0o600 });
     const capture = path.join(agentDir, exports.CAPTURE_FILE);

package/dist/mcp.js

@@ -158,10 +158,10 @@ const TOOLS = [
     },
     {
         name: "codiedev_ping",
-        description: "Send a message to a teammate on Codiedev, optionally attached to a " +
-            "specific artifact. Use when the user asks to ping, ask, share with, " +
-            "or get feedback from a teammate by name (e.g. 'ping a teammate about " +
-            "this spec'). Recipients are resolved by first name, full name, or email " +
+        description: "Send a message to a teammate on Codiedev, optionally with an " +
+            "artifact (they also get read access to it). Use when the user asks to " +
+            "ping, ask, send something to, or get feedback from a teammate by name " +
+            "(e.g. 'send this spec to a teammate'). Recipients are resolved by first name, full name, or email " +
             "within the current org. They're notified by email and can reply " +
             "from their own agent.",
         inputSchema: {
@@ -178,8 +178,13 @@ const TOOLS = [
                 },
                 subjectKey: {
                     type: "string",
-                    description: "Optional filename key of an artifact the message is about " +
-                        "(e.g. 'spec-214.md'). Leaving blank sends a standalone ping.",
+                    description: "Optional filename key of an artifact to send (e.g. " +
+                        "'spec-214.md'). The teammate also gets read access to it. " +
+                        "Leaving blank sends a standalone ping.",
+                },
+                edit: {
+                    type: "boolean",
+                    description: "With subjectKey: give edit access instead of read (owner only).",
                 },
             },
             required: ["to", "body"],
@@ -229,7 +234,7 @@ const TOOLS = [
             "without sending a notification. Use when the user says 'share this " +
             "with a teammate' or 'give someone access', and doesn't want to surface " +
             "it as a message. If they want the teammate actively notified, use " +
-            "codiedev_send_to instead.",
+            "codiedev_ping with subjectKey instead.",
         inputSchema: {
             type: "object",
             properties: {
@@ -248,36 +253,13 @@ const TOOLS = [
             required: ["filename", "to"],
         },
     },
-    {
-        name: "codiedev_send_to",
-        description: "Grant access to an artifact AND send a short message to a " +
-            "teammate. Use when the user asks to 'send this to a teammate', 'ask " +
-            "someone to look at this', or 'share this with a teammate and tell them X'. " +
-            "This is the active handoff version of codiedev_share_with — the " +
-            "recipient gets a ping in their inbox.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                filename: { type: "string", description: "Artifact filename." },
-                to: { type: "string", description: "Teammate first name, full name, or email." },
-                message: {
-                    type: "string",
-                    description: "Optional short note to send with the share. If omitted, only " +
-                        "the grant is created (no ping).",
-                },
-            },
-            required: ["filename", "to"],
-        },
-    },
     {
         name: "codiedev_search",
         description: "Search the team's artifact library by natural-language query. Use " +
             "when the user asks 'has anyone solved X?', 'find me the spec on Y', " +
             "or 'look for prior work on Z'. Always search before pushing a new " +
             "artifact so the user doesn't duplicate work. Returns ranked hits " +
-            "with title, type, filename key, and a snippet. For open-ended " +
-            "questions where the user wants a synthesized answer (not just a list " +
-            "of hits), prefer codiedev_ask instead.",
+            "with title, type, filename key, and a snippet.",
         inputSchema: {
             type: "object",
             properties: {
@@ -287,32 +269,6 @@ const TOOLS = [
             required: ["query"],
         },
     },
-    {
-        name: "codiedev_ask",
-        description: "Ask a natural-language question of the team's collective memory and " +
-            "get a synthesized answer with citations. Searches across both " +
-            "auto-extracted artifacts (specs / decisions / bugfixes) AND raw " +
-            "session transcripts, then has an LLM compose an answer that cites " +
-            "the actual sources. Use when the user asks 'why did we…?', 'what " +
-            "does the team know about X?', 'has anyone done Y here before?', " +
-            "'who decided Z and why?', or any open-ended question about prior " +
-            "work where they want context, not just a hit list. For exact-match " +
-            "lookups (find me spec-x), prefer codiedev_pull. For browsing or " +
-            "filtering by kind/tag, prefer codiedev_get_library. For surfacing " +
-            "ranked hits without LLM synthesis, prefer codiedev_search.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                question: {
-                    type: "string",
-                    description: "Natural-language question. Open-ended is fine — e.g. 'why " +
-                        "did we drop pg-bouncer?' or 'how does the team think about " +
-                        "feature flags?'.",
-                },
-            },
-            required: ["question"],
-        },
-    },
     {
         name: "codiedev_get_library",
         description: "List artifacts in the team library — both docs (spec / decision / " +
@@ -442,8 +398,6 @@ async function dispatchTool(name, args, config) {
             return await handleShareWith(args, config);
         case "codiedev_send_to":
             return await handleSendTo(args, config);
-        case "codiedev_ask":
-            return await handleAsk(args, config);
         case "codiedev_search":
             return await handleSearch(args, config);
         case "codiedev_get_library":
@@ -533,12 +487,13 @@ async function handlePing(args, config) {
     const to = asString(args.to);
     const body = asString(args.body);
     const subjectKey = asStringOrUndefined(args.subjectKey);
+    const grant = subjectKey ? (args.edit === true ? "edit" : "read") : undefined;
     if (!to)
         throw new Error("to required");
     if (!body)
         throw new Error("body required");
     try {
-        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/ping", { config, body: { to, body, subjectKey } });
+        const res = await (0, shared_1.apiRequest)("POST", "/api/cli/ping", { config, body: { to, body, subjectKey, ...(grant ? { grant } : {}) } });
         return {
             content: [
                 {
@@ -704,23 +659,6 @@ async function handleSearch(args, config) {
     }
     return { content: [{ type: "text", text: lines.join("\n") }] };
 }
-async function handleAsk(args, config) {
-    const question = asString(args.question);
-    if (!question)
-        throw new Error("question required");
-    const res = await (0, shared_1.apiRequest)("POST", "/api/cli/ask", { config, body: { question } });
-    const lines = [res.answer];
-    if (res.citations && res.citations.length > 0) {
-        lines.push("", "Sources:");
-        for (const c of res.citations) {
-            const label = c.kind === "artifact"
-                ? `[${c.type}] ${c.title}`
-                : `[session] ${c.title}`;
-            lines.push(`  • ${label}`);
-        }
-    }
-    return { content: [{ type: "text", text: lines.join("\n") }] };
-}
 async function handleGetLibrary(args, config) {
     const scope = asStringOrUndefined(args.scope);
     const type = asStringOrUndefined(args.type);