codiedev 0.10.0-beta.3 → 0.10.0-beta.5

package/dist/securityDeepScan.js

@@ -39,9 +39,6 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
-/** Adds component-addressable OSS scanner findings to the uploadable inventory.
- * Workspace-level findings (for example OSV dependency results) stay in the
- * deep-scan report because they do not identify one agent component. */
 function mergeDeepScanFindings(report, deep) {
     const byComponent = new Map();
     for (const finding of deep.findings) {
@@ -102,8 +99,6 @@ function collectFindingObjects(value, scanner, componentKey) {
             return;
         const row = child;
         const ruleId = row.rule_id ?? row.ruleId ?? row.id ?? row.code;
-        // Do not import scanner messages/descriptions: several engines include the
-        // matched source snippet there. Titles and rule names are bounded metadata.
         const title = row.title ?? row.rule_name ?? row.ruleName ?? row.name ??
             (ruleId !== undefined ? `Scanner finding ${String(ruleId)}` : undefined);
         const severityValue = row.severity ?? row.level ?? row.risk;
@@ -145,7 +140,7 @@ function runJsonScanner(args) {
                 try {
                     parsed = JSON.parse(stdout.slice(start, end + 1));
                 }
-                catch { /* handled below */ }
+                catch { }
             }
         }
     }
@@ -171,11 +166,6 @@ function pathsFor(report, kind, homeDir, workspace) {
         .map((component) => ({ component, filePath: actualPath(component.source, homeDir, workspace) }))
         .filter((item) => Boolean(item.filePath && fs.existsSync(item.filePath)));
 }
-/**
- * Runs optional open-source scanners. No scanner is downloaded implicitly.
- * MCP server connection is a separate opt-in because scanning a live stdio
- * server starts third-party code; the normal deep scan remains static.
- */
 function runDeepSecurityScan(report, options = {}) {
     const homeDir = path.resolve(options.homeDir ?? os.homedir());
     const workspace = path.resolve(options.workspace ?? process.cwd());
@@ -184,9 +174,6 @@ function runDeepSecurityScan(report, options = {}) {
     const runs = [];
     const skillPaths = pathsFor(report, "skill", homeDir, workspace);
     for (const { component, filePath } of skillPaths) {
-        // Cisco's scanner is preferred when present; ATR is the lightweight
-        // fallback. The current ATR CLI does not expose its internal detection
-        // lanes, so only high/critical findings are imported for review.
         const cisco = runJsonScanner({
             scanner: "cisco-skill-scanner", command: "skill-scanner",
             commandArgs: ["scan", filePath, "--format", "json"], componentKey: component.componentKey,

package/dist/securityDoctor.js

@@ -5,7 +5,6 @@ exports.securityDoctorChecks = securityDoctorChecks;
 const securityInstall_1 = require("./securityInstall");
 const securityPilot_1 = require("./securityPilot");
 const securityPolicy_1 = require("./securityPolicy");
-/** One security-health model shared by `doctor` and its legacy alias. */
 function collectSecurityDoctorReport(companyId) {
     const manifest = (0, securityInstall_1.readSecurityInstallManifest)();
     const integrity = (0, securityInstall_1.verifySecurityInstallManifest)(manifest);
@@ -27,7 +26,6 @@ function collectSecurityDoctorReport(companyId) {
         policySelfTest: { ok: pilot.ok, cases: pilot.cases.length },
     };
 }
-/** Convert security health into the same compact rows used by core doctor. */
 function securityDoctorChecks(report) {
     const checks = [
         {

package/dist/securityFeature.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAgentSecurityEnabled = isAgentSecurityEnabled;
-/** Security is opt-in per company. Missing/stale entitlement data is dormant. */
 function isAgentSecurityEnabled(config) {
     return config?.agentSecurityEnabled === true;
 }

package/dist/securityInstall.js

@@ -47,6 +47,8 @@ const configDir_1 = require("./configDir");
 const detection_1 = require("./detection");
 const codexHookTrust_1 = require("./codexHookTrust");
 const version_1 = require("./version");
+const copilotInstallation_1 = require("./copilotInstallation");
+const harnessDirs_1 = require("./harnessDirs");
 const MANIFEST_FILE = "security-install.json";
 function sha256File(filePath) {
     return crypto.createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
@@ -55,11 +57,6 @@ function safeSnapshotName(index, filePath) {
     const digest = crypto.createHash("sha256").update(filePath).digest("hex").slice(0, 12);
     return `${String(index + 1).padStart(2, "0")}-${digest}-${path.basename(filePath)}`;
 }
-/**
- * Capture the exact pre-update hook configuration. This function never removes
- * or restores anything; it creates the evidence needed for an explicit,
- * administrator-approved rollback later.
- */
 function createSecurityInstallSnapshot(configPaths, stateDir = (0, configDir_1.codiedevStateDir)(), now = Date.now) {
     const timestamp = now();
     const id = `${timestamp}-${process.pid}`;
@@ -124,11 +121,6 @@ function verifySecurityInstallManifest(manifest) {
         detail: `v${manifest.cliVersion}; rollback snapshot ${manifest.rollbackSnapshotId} available`,
     };
 }
-/**
- * Restore only files recorded in the selected install manifest. The snapshot
- * location is validated before any write and each replacement is atomic, so a
- * partial copy cannot leave a hook configuration truncated.
- */
 function restoreSecurityInstallSnapshot(manifest) {
     if (!manifest)
         throw new Error("security install manifest is missing");
@@ -215,14 +207,15 @@ function inspectJsonSurface(surface, filePath, codexConfigPath) {
 }
 function inspectSecurityInstallation(paths = {}) {
     const home = os.homedir();
-    const claude = paths.claudeSettingsPath ?? path.join(home, ".claude", "settings.json");
-    const codex = paths.codexHooksPath ?? path.join(home, ".codex", "hooks.json");
+    const claude = paths.claudeSettingsPath ?? path.join((0, harnessDirs_1.claudeConfigDir)(), "settings.json");
+    const codex = paths.codexHooksPath ?? path.join((0, harnessDirs_1.codexHome)(), "hooks.json");
     const cursor = paths.cursorHooksPath ?? path.join(home, ".cursor", "hooks.json");
-    const codie = paths.codiePluginPath ?? path.join(home, ".config", "opencode", "plugins", "codiedev.js");
+    const codie = paths.codiePluginPath ?? path.join((0, harnessDirs_1.openCodeConfigDir)(), "plugins", "codiedev.js");
     const results = [
         inspectJsonSurface("claude-code", claude),
         inspectJsonSurface("codex", codex, paths.codexConfigPath),
         inspectJsonSurface("cursor", cursor),
+        { surface: "copilot", ...(0, copilotInstallation_1.inspectCopilotHooks)(paths.copilotHooksPath, true) },
     ];
     if (!fs.existsSync(codie)) {
         results.push({ surface: "codie-harness", status: "not-installed", detail: `${codie} not found` });

package/dist/securityInventory.js

@@ -43,6 +43,8 @@ const fs = __importStar(require("fs"));
 const http = __importStar(require("http"));
 const https = __importStar(require("https"));
 const os = __importStar(require("os"));
+const copilotHooks_1 = require("./copilotHooks");
+const harnessDirs_1 = require("./harnessDirs");
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const configDir_1 = require("./configDir");
@@ -89,8 +91,6 @@ function displayPath(filePath, homeDir, workspace) {
     if (resolved.startsWith(`${resolvedHome}${path.sep}`)) {
         return `~/${path.relative(resolvedHome, resolved)}`;
     }
-    // Never upload arbitrary absolute paths. The basename plus a short digest is
-    // enough to distinguish two external locations without exposing usernames.
     return `[external:${hash(resolved).slice(0, 10)}]/${path.basename(resolved)}`;
 }
 function fileScope(filePath, workspace) {
@@ -197,8 +197,6 @@ function jsoncToJson(text) {
         }
         output += char;
     }
-    // JSONC permits trailing commas. Comments are already gone, so remove a
-    // comma only when the next non-whitespace token closes an array or object.
     let withoutTrailingCommas = "";
     inString = false;
     escaped = false;
@@ -441,44 +439,56 @@ function securityInventoryDue(stateDir = (0, configDir_1.codiedevStateDir)(), ma
 }
 function buildSecurityInventory(options = {}) {
     const homeDir = path.resolve(options.homeDir ?? os.homedir());
+    const copilotDir = options.homeDir ? path.join(homeDir, ".copilot") : (0, copilotHooks_1.copilotHome)();
+    const claudeDir = options.homeDir ? path.join(homeDir, ".claude") : (0, harnessDirs_1.claudeConfigDir)();
+    const claudeJson = options.homeDir ? path.join(homeDir, ".claude.json") : (0, harnessDirs_1.claudeUserConfigPath)();
+    const codexDir = options.homeDir ? path.join(homeDir, ".codex") : (0, harnessDirs_1.codexHome)();
+    const openCodeDir = options.homeDir ? path.join(homeDir, ".config", "opencode") : (0, harnessDirs_1.openCodeConfigDir)();
     const workspace = path.resolve(options.workspace ?? process.cwd());
     const stateDir = options.stateDir ?? (0, configDir_1.codiedevStateDir)();
     const components = [];
     const jsonConfigs = [
-        path.join(homeDir, ".claude.json"), path.join(homeDir, ".claude", "settings.json"),
-        path.join(homeDir, ".claude", "settings.local.json"),
-        path.join(homeDir, ".cursor", "mcp.json"), path.join(homeDir, ".config", "opencode", "opencode.json"),
-        path.join(homeDir, ".config", "opencode", "opencode.jsonc"),
+        claudeJson, path.join(claudeDir, "settings.json"),
+        path.join(claudeDir, "settings.local.json"),
+        path.join(homeDir, ".cursor", "mcp.json"), path.join(openCodeDir, "opencode.json"),
+        path.join(openCodeDir, "opencode.jsonc"),
         path.join(homeDir, ".config", "Code", "User", "mcp.json"),
         path.join(homeDir, ".config", "Cursor", "User", "mcp.json"),
-        path.join(homeDir, ".codex", "hooks.json"),
+        path.join(codexDir, "hooks.json"),
+        path.join(homeDir, ".cursor", "hooks.json"),
+        ...walkFiles(path.join(copilotDir, "hooks"), (_file, name) => name.endsWith(".json"), 1),
         path.join(homeDir, "Library", "Application Support", "Code", "User", "mcp.json"),
         path.join(homeDir, "Library", "Application Support", "Cursor", "User", "mcp.json"),
         path.join(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
         path.join(workspace, ".mcp.json"), path.join(workspace, ".cursor", "mcp.json"),
         path.join(workspace, ".vscode", "mcp.json"),
         path.join(workspace, ".codex", "hooks.json"),
+        path.join(workspace, ".cursor", "hooks.json"),
+        ...walkFiles(path.join(workspace, ".github", "hooks"), (_file, name) => name.endsWith(".json"), 1),
         path.join(workspace, ".claude", "settings.json"), path.join(workspace, ".claude", "settings.local.json"),
         path.join(workspace, "opencode.json"), path.join(workspace, "opencode.jsonc"),
     ];
     for (const filePath of jsonConfigs)
         collectJsonConfig(filePath, homeDir, workspace, components);
-    for (const filePath of [path.join(homeDir, ".codex", "config.toml"), path.join(workspace, ".codex", "config.toml")]) {
+    for (const filePath of [path.join(codexDir, "config.toml"), path.join(workspace, ".codex", "config.toml")]) {
         collectCodexToml(filePath, homeDir, workspace, components);
     }
     collectSkills([
-        path.join(homeDir, ".claude", "skills"), path.join(homeDir, ".codex", "skills"),
+        path.join(claudeDir, "skills"), path.join(codexDir, "skills"),
         path.join(homeDir, ".agents", "skills"), path.join(homeDir, ".cursor", "skills"),
+        path.join(copilotDir, "skills"), path.join(workspace, ".github", "skills"),
         path.join(workspace, ".claude", "skills"), path.join(workspace, ".codex", "skills"),
         path.join(workspace, ".agents", "skills"), path.join(workspace, ".cursor", "skills"),
     ], homeDir, workspace, components);
     collectExtensions([
         path.join(homeDir, ".vscode", "extensions"), path.join(homeDir, ".cursor", "extensions"),
     ], homeDir, workspace, components);
-    const pluginDirs = [path.join(homeDir, ".config", "opencode", "plugins"), path.join(workspace, ".opencode", "plugins")];
+    const pluginDirs = [path.join(openCodeDir, "plugins"), path.join(workspace, ".opencode", "plugins")];
     collectLooseFiles(pluginDirs.flatMap((dir) => walkFiles(dir, (_file, name) => /\.(?:js|mjs|cjs|ts)$/.test(name), 2)), "plugin", homeDir, workspace, components);
     collectLooseFiles([
-        path.join(homeDir, ".claude", "CLAUDE.md"), path.join(homeDir, ".codex", "AGENTS.md"),
+        path.join(claudeDir, "CLAUDE.md"), path.join(codexDir, "AGENTS.md"),
+        path.join(copilotDir, "copilot-instructions.md"), path.join(workspace, ".github", "copilot-instructions.md"),
+        ...walkFiles(path.join(homeDir, ".cursor", "rules"), (_file, name) => /\.(?:md|mdc)$/.test(name), 3),
         path.join(workspace, "CLAUDE.md"), path.join(workspace, "AGENTS.md"),
         ...walkFiles(path.join(workspace, ".cursor", "rules"), (_file, name) => /\.(?:md|mdc)$/.test(name), 3),
     ], "instruction", homeDir, workspace, components);

package/dist/securityPilot.js

@@ -26,8 +26,6 @@ function constrainedPolicy(now) {
         fetchedAt: now,
     };
 }
-/** Safe, side-effect-free policy validation. No command is executed and none
- * of the synthetic values are real credentials. */
 function runSyntheticSecurityPilot(cwd = process.cwd(), now = Date.now) {
     const cases = [];
     const policy = constrainedPolicy(now());

package/dist/securityPolicy.js

@@ -55,13 +55,6 @@ function policyFile(companyId) {
     const scope = companyId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 128);
     return `security-policy.${scope}.json`;
 }
-/**
- * Vendor policy roots are compiled into the endpoint binary. This prevents a
- * compromised control-plane response from introducing the key that verifies
- * that same response. Additional customer-managed roots may still be supplied
- * through CODIEDEV_SECURITY_POLICY_PUBLIC_KEYS, but they cannot replace the
- * Codiedev production root with the same key id.
- */
 exports.BUILT_IN_POLICY_KEYS = {
     "codiedev-prod-2026-01": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA0H+UISjTn4zhd6Pk9YmrMBqnJEJmv9fXoavXorlV2cU=\n-----END PUBLIC KEY-----\n",
 };

package/dist/selfUpdate.js

@@ -0,0 +1,331 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.planSelfUpdate = planSelfUpdate;
+exports.isSelfUpdateDue = isSelfUpdateDue;
+exports.readSelfUpdateState = readSelfUpdateState;
+exports.maybeSpawnSelfUpdate = maybeSpawnSelfUpdate;
+exports.findInstalledHookScript = findInstalledHookScript;
+exports.runSelfUpdate = runSelfUpdate;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const version_1 = require("./version");
+const versionCheck_1 = require("./versionCheck");
+const configDir_1 = require("./configDir");
+const captureLog_1 = require("./captureLog");
+const launcher_1 = require("./launcher");
+const PKG = "codiedev";
+const DAY_MS = 24 * 60 * 60 * 1000;
+const LOCK_STALE_MS = 10 * 60 * 1000;
+const INSTALL_TIMEOUT_MS = 5 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 5_000;
+function planSelfUpdate(deps) {
+    const { env } = deps;
+    if (env.CODIEDEV_NO_UPDATE_CHECK || env.CODIEDEV_NO_AUTO_UPDATE) {
+        return { kind: "skip", reason: "disabled" };
+    }
+    if (env.CI || env.CONTINUOUS_INTEGRATION || env.GITHUB_ACTIONS || env.BUILD_NUMBER) {
+        return { kind: "skip", reason: "ci" };
+    }
+    if (deps.isContainer)
+        return { kind: "skip", reason: "container" };
+    const p = deps.hookScriptReal.replace(/\\/g, "/");
+    if (/\/(?:_npx|\.npm\/_npx)\//.test(p))
+        return { kind: "skip", reason: "npx" };
+    const pkgDir = path.dirname(path.dirname(deps.hookScriptReal));
+    if (!deps.isWritable(pkgDir))
+        return { kind: "skip", reason: "readonly" };
+    if (/\/\.pnpm\/|\/pnpm\/global\/|\/global\/v\d+\/[^/]+\/node_modules\/codiedev\/|\/store\/v\d+\/links\//.test(p)) {
+        return deps.viaLauncher ? { kind: "pnpm" } : { kind: "skip", reason: "pnpm-direct" };
+    }
+    if (/\/install\/global\/node_modules\/codiedev\/dist\/hook\.js$/.test(p))
+        return { kind: "bun" };
+    const unix = p.match(/^(.*)\/lib\/node_modules\/codiedev\/dist\/hook\.js$/);
+    if (unix && deps.platform !== "win32")
+        return { kind: "npm", prefix: unix[1] };
+    const win = p.match(/^(.*)\/node_modules\/codiedev\/dist\/hook\.js$/);
+    if (win && deps.platform === "win32")
+        return { kind: "npm", prefix: win[1] };
+    return { kind: "skip", reason: "unmanaged" };
+}
+function isSelfUpdateDue(state, nowMs) {
+    return !state || nowMs - state.lastAttemptAt > DAY_MS;
+}
+function statePath() {
+    return path.join((0, configDir_1.codiedevStateDir)(), ".self-update.json");
+}
+function lockPath() {
+    return path.join((0, configDir_1.codiedevStateDir)(), ".self-update.lock");
+}
+function readSelfUpdateState() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(statePath(), "utf8"));
+        return typeof parsed.lastAttemptAt === "number" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeState(state) {
+    try {
+        fs.mkdirSync((0, configDir_1.codiedevStateDir)(), { recursive: true });
+        fs.writeFileSync(statePath(), JSON.stringify(state), "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function maybeSpawnSelfUpdate(hookEntry) {
+    try {
+        if (!hookEntry || process.env.CODIEDEV_NO_AUTO_UPDATE || process.env.CODIEDEV_NO_UPDATE_CHECK)
+            return;
+        const now = Date.now();
+        if (!isSelfUpdateDue(readSelfUpdateState(), now))
+            return;
+        if (!writeState({ lastAttemptAt: now, lastResult: "spawned" }))
+            return;
+        const child = (0, child_process_1.spawn)(process.execPath, [hookEntry, "self-update"], {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        child.unref();
+    }
+    catch {
+    }
+}
+function acquireLock() {
+    const lock = lockPath();
+    try {
+        fs.mkdirSync(lock);
+        return true;
+    }
+    catch {
+        try {
+            if (Date.now() - fs.statSync(lock).mtimeMs > LOCK_STALE_MS) {
+                fs.rmSync(lock, { recursive: true, force: true });
+                fs.mkdirSync(lock);
+                return true;
+            }
+        }
+        catch {
+        }
+        return false;
+    }
+}
+function detectContainer(env) {
+    if (env.KUBERNETES_SERVICE_HOST)
+        return true;
+    if (fs.existsSync("/.dockerenv") || fs.existsSync("/run/.containerenv"))
+        return true;
+    try {
+        return /docker|containerd|kubepods|lxc/.test(fs.readFileSync("/proc/1/cgroup", "utf8"));
+    }
+    catch {
+        return false;
+    }
+}
+function registryBase(env) {
+    const configured = env.npm_config_registry || env.NPM_CONFIG_REGISTRY;
+    return (configured || "https://registry.npmjs.org").replace(/\/+$/, "");
+}
+async function fetchLatest(env) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${registryBase(env)}/${PKG}/latest`, {
+            headers: { Accept: "application/json" },
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return null;
+        const json = (await res.json());
+        return typeof json.version === "string" ? json.version : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function installCommand(plan, version, env) {
+    const spec = `${PKG}@${version}`;
+    const configured = env.npm_config_registry || env.NPM_CONFIG_REGISTRY;
+    const registry = configured ? ["--registry", registryBase(env)] : [];
+    switch (plan.kind) {
+        case "npm": {
+            const args = ["i", "-g", "--prefix", plan.prefix, "--no-fund", "--no-audit", ...registry, spec];
+            const execDir = path.dirname(process.execPath);
+            const npmCli = [
+                path.join(execDir, "node_modules", "npm", "bin", "npm-cli.js"),
+                path.join(execDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+            ].find((p) => fs.existsSync(p));
+            if (npmCli)
+                return { cmd: process.execPath, args: [npmCli, ...args] };
+            return { cmd: process.platform === "win32" ? "npm.cmd" : "npm", args, shell: process.platform === "win32" };
+        }
+        case "pnpm":
+            return { cmd: "pnpm", args: ["add", "-g", ...registry, spec], shell: process.platform === "win32" };
+        case "bun":
+            return { cmd: "bun", args: ["add", "-g", ...registry, spec] };
+        default:
+            return null;
+    }
+}
+function readVersionAt(hookScript) {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(path.dirname(path.dirname(hookScript)), "package.json"), "utf8"));
+        return typeof pkg.version === "string" ? pkg.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+function findInstalledHookScript(plan, hookEntry, version, pnpmRoot = pnpmGlobalRoot) {
+    if (plan.kind !== "pnpm")
+        return readVersionAt(hookEntry) === version ? hookEntry : null;
+    const root = pnpmRoot();
+    if (!root)
+        return null;
+    const candidates = [path.join(root, PKG, "dist", "hook.js")];
+    try {
+        for (const entry of fs.readdirSync(root)) {
+            candidates.push(path.join(root, entry, "node_modules", PKG, "dist", "hook.js"));
+        }
+    }
+    catch {
+    }
+    for (const candidate of candidates) {
+        if (readVersionAt(candidate) !== version)
+            continue;
+        try {
+            return fs.realpathSync(candidate);
+        }
+        catch {
+        }
+    }
+    return null;
+}
+function pnpmGlobalRoot() {
+    const root = (0, child_process_1.spawnSync)("pnpm", ["root", "-g"], {
+        encoding: "utf8",
+        timeout: 30_000,
+        shell: process.platform === "win32",
+        windowsHide: true,
+    });
+    const dir = root.status === 0 ? root.stdout.trim() : "";
+    return dir || null;
+}
+async function runSelfUpdate(hookEntry) {
+    const env = process.env;
+    const now = Date.now();
+    const finish = (lastResult, extra = {}) => {
+        const state = { lastAttemptAt: now, lastResult, fromVersion: version_1.CLI_VERSION, ...extra };
+        writeState(state);
+        (0, captureLog_1.appendCaptureLog)({
+            stage: "self-update",
+            sessionId: undefined,
+            outcome: lastResult.startsWith("error") ? "ERROR" : "ok",
+            detail: `result=${lastResult} from=${version_1.CLI_VERSION} to=${extra.toVersion ?? "-"} elapsedMs=${Date.now() - now}`,
+        });
+        return state;
+    };
+    let hookScriptReal;
+    try {
+        hookScriptReal = fs.realpathSync(hookEntry);
+    }
+    catch {
+        return finish("skip:unresolved");
+    }
+    const plan = planSelfUpdate({
+        hookScriptReal,
+        env,
+        platform: process.platform,
+        isContainer: detectContainer(env),
+        viaLauncher: Boolean(env.CODIEDEV_VIA_LAUNCHER),
+        isWritable: (dir) => {
+            try {
+                fs.accessSync(dir, fs.constants.W_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    });
+    if (plan.kind === "skip")
+        return finish(`skip:${plan.reason}`);
+    if (!acquireLock()) {
+        (0, captureLog_1.appendCaptureLog)({ stage: "self-update", sessionId: undefined, outcome: "ok", detail: "result=skip:locked" });
+        return { lastAttemptAt: now, lastResult: "skip:locked" };
+    }
+    try {
+        const latest = await fetchLatest(env);
+        if (!latest)
+            return finish("error:registry");
+        if ((0, versionCheck_1.compareSemver)(version_1.CLI_VERSION, latest) !== -1)
+            return finish("current", { toVersion: latest });
+        const install = installCommand(plan, latest, env);
+        if (!install)
+            return finish("skip:no-installer");
+        const result = (0, child_process_1.spawnSync)(install.cmd, install.args, {
+            stdio: "ignore",
+            timeout: INSTALL_TIMEOUT_MS,
+            env: { ...env, CODIEDEV_NO_AUTO_UPDATE: "1" },
+            shell: install.shell ?? false,
+            windowsHide: true,
+        });
+        if (result.error || result.status !== 0) {
+            return finish(`error:install-exit-${result.status ?? "spawn"}`, { toVersion: latest });
+        }
+        const installed = findInstalledHookScript(plan, hookScriptReal, latest);
+        if (!installed) {
+            return finish("error:not-found-after-install", { toVersion: latest });
+        }
+        if (!(0, launcher_1.recordCurrentInstall)(installed))
+            return finish("error:record", { toVersion: latest });
+        return finish("updated", { toVersion: latest });
+    }
+    finally {
+        try {
+            fs.rmSync(lockPath(), { recursive: true, force: true });
+        }
+        catch {
+        }
+    }
+}

package/dist/skillMarker.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikeSkill = looksLikeSkill;
+exports.stripSkillMarker = stripSkillMarker;
+exports.stampSkillMarker = stampSkillMarker;
+const ID = /^[a-z0-9]{16,64}$/i;
+const LINE = /^[ \t]*<!--\s*codiedev:artifact=[a-z0-9]+\s*-->[ \t]*(?:\r?\n|$)/gim;
+function looksLikeSkill(markdown) {
+    const fm = markdown.match(/^?---\r?\n([\s\S]*?)\r?\n---/);
+    if (!fm)
+        return false;
+    return /^name\s*:/im.test(fm[1]) && /^description\s*:/im.test(fm[1]);
+}
+function stripSkillMarker(markdown) {
+    return markdown.replace(LINE, "");
+}
+function stampSkillMarker(markdown, artifactId) {
+    if (!artifactId || !ID.test(artifactId))
+        return markdown;
+    const body = stripSkillMarker(markdown);
+    const sep = body.endsWith("\n") ? "" : "\n";
+    return `${body}${sep}<!-- codiedev:artifact=${artifactId} -->\n`;
+}