codiedev 0.10.0-beta.4 → 0.10.0-beta.5

package/dist/packs/shim.js

@@ -0,0 +1,214 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHIM_EVENTS = void 0;
+exports.unsupportedShimEvents = unsupportedShimEvents;
+exports.shimPacks = shimPacks;
+exports.generateShimSource = generateShimSource;
+exports.writeShim = writeShim;
+const fs = __importStar(require("fs"));
+const store_1 = require("./store");
+exports.SHIM_EVENTS = ["SessionStart", "PreToolUse", "PostToolUse", "Stop"];
+function normalizeHooks(hooks) {
+    const out = {};
+    for (const event of exports.SHIM_EVENTS) {
+        const groups = hooks[event];
+        if (!Array.isArray(groups))
+            continue;
+        const normalized = [];
+        for (const groupValue of groups) {
+            const group = groupValue;
+            if (!group || !Array.isArray(group.hooks))
+                continue;
+            const handlers = [];
+            for (const handlerValue of group.hooks) {
+                const handler = handlerValue;
+                if (!handler || handler.type !== "command" || typeof handler.command !== "string")
+                    continue;
+                handlers.push({
+                    command: handler.command,
+                    ...(typeof handler.timeout === "number" && handler.timeout > 0 ? { timeout: handler.timeout } : {}),
+                });
+            }
+            if (handlers.length === 0)
+                continue;
+            normalized.push({
+                ...(typeof group.matcher === "string" ? { matcher: group.matcher } : {}),
+                hooks: handlers,
+            });
+        }
+        if (normalized.length)
+            out[event] = normalized;
+    }
+    return out;
+}
+function unsupportedShimEvents(packs) {
+    const out = new Map();
+    for (const pack of packs) {
+        const events = Object.keys(pack.hooks ?? {}).filter((e) => !exports.SHIM_EVENTS.includes(e)).sort();
+        if (events.length)
+            out.set(pack.slug, events);
+    }
+    return out;
+}
+function shimPacks(packs) {
+    return packs
+        .map((pack) => ({ slug: pack.slug, root: pack.root, hooks: normalizeHooks(pack.hooks) }))
+        .filter((pack) => Object.keys(pack.hooks).length > 0);
+}
+function generateShimSource(packs) {
+    const data = shimPacks(packs);
+    return `// Managed by \`codiedev pack install\`. Regenerated on every install; do not edit.
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+const PACKS = ${JSON.stringify(data, null, 2)};
+
+// OpenCode tool ids are lowercase; Claude hook matchers use Claude casing.
+const TOOL_NAMES = {
+  bash: "Bash", edit: "Edit", write: "Write", read: "Read", grep: "Grep",
+  glob: "Glob", list: "LS", ls: "LS", webfetch: "WebFetch", websearch: "WebSearch",
+  todowrite: "TodoWrite", todoread: "TodoRead", task: "Task", multiedit: "MultiEdit",
+  patch: "Edit", apply_patch: "Edit",
+};
+
+export function claudeToolName(tool) {
+  const name = String(tool ?? "");
+  if (!name) return "unknown";
+  return TOOL_NAMES[name.toLowerCase()] ?? name.charAt(0).toUpperCase() + name.slice(1);
+}
+
+// Claude semantics: empty or "*" matches everything; otherwise a regex that
+// must match the whole tool name ("Edit|Write", "Notebook.*").
+export function matches(matcher, value) {
+  if (matcher === undefined || matcher === null || matcher === "" || matcher === "*") return true;
+  try {
+    return new RegExp("^(?:" + matcher + ")$").test(value);
+  } catch {
+    return false;
+  }
+}
+
+function handlersFor(event, value) {
+  const out = [];
+  for (const pack of PACKS) {
+    for (const group of pack.hooks[event] ?? []) {
+      if (!matches(group.matcher, value)) continue;
+      for (const handler of group.hooks) out.push({ ...handler, root: pack.root });
+    }
+  }
+  return out;
+}
+
+function run(handler, payload) {
+  const cwd = typeof payload.cwd === "string" && existsSync(payload.cwd) ? payload.cwd : undefined;
+  return spawnSync(handler.command, [], {
+    input: JSON.stringify(payload),
+    encoding: "utf8",
+    shell: true,
+    cwd,
+    timeout: (handler.timeout ?? 60) * 1000,
+    env: { ...process.env, CLAUDE_PLUGIN_ROOT: handler.root },
+  });
+}
+
+function sessionId(value) {
+  return value?.sessionID ?? value?.sessionId ?? value?.properties?.sessionID ?? value?.properties?.info?.id ?? undefined;
+}
+
+export const CodiedevPackHooks = async (ctx = {}) => {
+  const cwd = ctx?.worktree || ctx?.directory || process.cwd();
+  const childSessions = new Set();
+  return {
+    "tool.execute.before": async (input, output) => {
+      const tool_name = claudeToolName(input?.tool);
+      for (const handler of handlersFor("PreToolUse", tool_name)) {
+        const result = run(handler, {
+          hook_event_name: "PreToolUse",
+          session_id: sessionId(input),
+          cwd,
+          tool_name,
+          tool_input: output?.args ?? {},
+        });
+        if (result.status === 2) throw new Error(String(result.stderr ?? "").trim() || "Blocked by hook");
+      }
+    },
+    "tool.execute.after": async (input, output) => {
+      const tool_name = claudeToolName(input?.tool);
+      for (const handler of handlersFor("PostToolUse", tool_name)) {
+        run(handler, {
+          hook_event_name: "PostToolUse",
+          session_id: sessionId(input),
+          cwd,
+          tool_name,
+          tool_input: input?.args ?? {},
+          tool_response: output ?? null,
+        });
+      }
+    },
+    event: async ({ event } = {}) => {
+      // OpenCode also emits session.created/idle for subagent (child)
+      // sessions. Claude's SessionStart/Stop are top-level only, so remember
+      // children (info.parentID) and skip them. session.idle carries only the
+      // sessionID, hence the set.
+      const info = event?.properties?.info;
+      if (info?.id && info?.parentID) childSessions.add(info.id);
+      if (event?.type === "session.created") {
+        if (info?.parentID) return;
+        for (const handler of handlersFor("SessionStart", "startup")) {
+          run(handler, { hook_event_name: "SessionStart", session_id: sessionId(event), cwd, source: "startup" });
+        }
+        return;
+      }
+      if (event?.type === "session.idle") {
+        const id = sessionId(event);
+        if (info?.parentID || (id && childSessions.has(id))) return;
+        for (const handler of handlersFor("Stop", "")) {
+          run(handler, { hook_event_name: "Stop", session_id: sessionId(event), cwd, stop_hook_active: false });
+        }
+      }
+    },
+  };
+};
+`;
+}
+function writeShim(file, packs) {
+    if (shimPacks(packs).length === 0) {
+        fs.rmSync(file, { force: true });
+        return null;
+    }
+    (0, store_1.writeFileAtomic)(file, generateShimSource(packs), 0o600);
+    return file;
+}

package/dist/packs/store.js

@@ -0,0 +1,155 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_LEVELS = void 0;
+exports.pluginVersion = pluginVersion;
+exports.writeFileAtomic = writeFileAtomic;
+exports.portableAgentContent = portableAgentContent;
+exports.pluginFiles = pluginFiles;
+exports.writePluginDir = writePluginDir;
+exports.readRegistry = readRegistry;
+exports.writeRegistry = writeRegistry;
+exports.marketplaceDocument = marketplaceDocument;
+exports.writeMarketplace = writeMarketplace;
+const fs = __importStar(require("fs"));
+const skillMarker_1 = require("../skillMarker");
+const path = __importStar(require("path"));
+const paths_1 = require("./paths");
+function pluginVersion(version) {
+    return `${version}.0.0`;
+}
+function writeFileAtomic(file, content, mode = 0o644) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, content, { encoding: "utf8", mode });
+    fs.renameSync(tmp, file);
+}
+exports.AGENT_LEVELS = new Set(["opus", "sonnet", "haiku"]);
+function portableAgentContent(content) {
+    const fm = content.match(/^(\uFEFF?---\r?\n)([\s\S]*?)(\r?\n---[ \t]*(?:\r?\n|$))/);
+    if (!fm)
+        return content;
+    const lines = fm[2].split(/\r?\n/);
+    const kept = lines.filter((line) => {
+        const m = line.match(/^model\s*:\s*["']?([^"'\r\n]*?)["']?\s*$/);
+        return !m || m[1].includes("/");
+    });
+    if (kept.length === lines.length)
+        return content;
+    return fm[1] + kept.join("\n") + fm[3] + content.slice(fm[0].length);
+}
+function pluginFiles(manifest, options = {}) {
+    const files = {};
+    files[path.join(".claude-plugin", "plugin.json")] = JSON.stringify({
+        name: manifest.slug,
+        version: pluginVersion(manifest.version),
+        description: manifest.description || manifest.name,
+    }, null, 2) + "\n";
+    for (const skill of manifest.skills) {
+        files[path.join("skills", skill.name, "SKILL.md")] = (0, skillMarker_1.stampSkillMarker)(skill.content, skill.artifactId);
+    }
+    for (const agent of manifest.agents) {
+        files[path.join("agents", `${agent.name}.md`)] = options.portable ? portableAgentContent(agent.content) : agent.content;
+    }
+    if (manifest.hooksJson) {
+        files[path.join("hooks", "hooks.json")] = manifest.hooksJson;
+    }
+    return files;
+}
+function assertInside(parent, child) {
+    const rel = path.relative(parent, child);
+    if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) {
+        throw new Error(`refusing to write outside the pack dir: ${child}`);
+    }
+}
+function writePluginDir(root, manifest, options = {}) {
+    const target = (0, paths_1.pluginDir)(root, manifest.slug);
+    const parent = (0, paths_1.pluginsDir)(root);
+    assertInside(parent, target);
+    fs.mkdirSync(parent, { recursive: true });
+    const stamp = `${process.pid}-${Date.now()}`;
+    const tmp = path.join(parent, `.${manifest.slug}.tmp-${stamp}`);
+    const old = path.join(parent, `.${manifest.slug}.old-${stamp}`);
+    try {
+        for (const [rel, content] of Object.entries(pluginFiles(manifest, options))) {
+            const file = path.join(tmp, rel);
+            assertInside(tmp, file);
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            fs.writeFileSync(file, content, "utf8");
+        }
+        if (fs.existsSync(target))
+            fs.renameSync(target, old);
+        fs.renameSync(tmp, target);
+    }
+    catch (error) {
+        fs.rmSync(tmp, { recursive: true, force: true });
+        if (!fs.existsSync(target) && fs.existsSync(old))
+            fs.renameSync(old, target);
+        throw error;
+    }
+    fs.rmSync(old, { recursive: true, force: true });
+    return target;
+}
+function readRegistry(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync((0, paths_1.registryPath)(root), "utf8"));
+        if (parsed && typeof parsed === "object" && parsed.packs && typeof parsed.packs === "object") {
+            return { packs: parsed.packs };
+        }
+    }
+    catch {
+    }
+    return { packs: {} };
+}
+function writeRegistry(root, registry) {
+    writeFileAtomic((0, paths_1.registryPath)(root), JSON.stringify(registry, null, 2) + "\n");
+}
+function marketplaceDocument(entries) {
+    const sorted = [...entries].sort((a, b) => a.slug.localeCompare(b.slug));
+    return {
+        name: paths_1.MARKETPLACE_NAME,
+        owner: { name: "Codiedev" },
+        metadata: { description: "Codiedev team starter packs" },
+        plugins: sorted.map((entry) => ({
+            name: entry.slug,
+            source: `./plugins/${entry.slug}`,
+            description: entry.description || entry.slug,
+            version: pluginVersion(entry.version),
+        })),
+    };
+}
+function writeMarketplace(root, entries) {
+    writeFileAtomic((0, paths_1.marketplacePath)(root), JSON.stringify(marketplaceDocument(entries), null, 2) + "\n");
+}

package/dist/packs/sync.js

@@ -0,0 +1,170 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMPTY_RECHECK_MS = exports.NAG_INTERVAL_MS = exports.SYNC_INTERVAL_MS = void 0;
+exports.isPackCiMode = isPackCiMode;
+exports.readStatusCache = readStatusCache;
+exports.writeStatusCache = writeStatusCache;
+exports.autosyncDisabled = autosyncDisabled;
+exports.decideSync = decideSync;
+exports.cliEntry = cliEntry;
+exports.maybeSpawnPackSync = maybeSpawnPackSync;
+exports.packNagLine = packNagLine;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const paths_1 = require("./paths");
+const store_1 = require("./store");
+exports.SYNC_INTERVAL_MS = 60 * 60 * 1000;
+function isPackCiMode(env = process.env) {
+    const ci = (env.CI ?? "").trim().toLowerCase();
+    return (env.CODIEDEV_TOKEN ?? "").trim().startsWith("cdvci_") || ci === "true" || ci === "1";
+}
+exports.NAG_INTERVAL_MS = 24 * 60 * 60 * 1000;
+exports.EMPTY_RECHECK_MS = 24 * 60 * 60 * 1000;
+function readStatusCache(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync((0, paths_1.statusCachePath)(root), "utf8"));
+        if (typeof parsed?.checkedAt !== "number")
+            return null;
+        return {
+            checkedAt: parsed.checkedAt,
+            available: typeof parsed.available === "number" ? parsed.available : 0,
+            outdated: Array.isArray(parsed.outdated) ? parsed.outdated.filter((o) => typeof o?.slug === "string") : [],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeStatusCache(root, cache) {
+    try {
+        (0, store_1.writeFileAtomic)((0, paths_1.statusCachePath)(root), JSON.stringify(cache) + "\n");
+    }
+    catch {
+    }
+}
+function mtime(file) {
+    try {
+        return fs.statSync(file).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+function registryNonEmpty(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync((0, paths_1.registryPath)(root), "utf8"));
+        return Boolean(parsed?.packs && Object.keys(parsed.packs).length > 0);
+    }
+    catch {
+        return false;
+    }
+}
+function autosyncDisabled(env) {
+    const v = (env.CODIEDEV_PACK_AUTOSYNC ?? "").trim().toLowerCase();
+    return v === "0" || v === "false" || v === "off" || v === "no";
+}
+function decideSync(root, env, now) {
+    const last = mtime((0, paths_1.lastSyncPath)(root));
+    if (last !== null && now - last < exports.SYNC_INTERVAL_MS && last <= now)
+        return "throttled";
+    if (!registryNonEmpty(root)) {
+        const cache = readStatusCache(root);
+        if (cache && cache.available === 0 && now - cache.checkedAt < exports.EMPTY_RECHECK_MS)
+            return "no-packs";
+    }
+    return autosyncDisabled(env) ? "spawn-check" : "spawn-install";
+}
+function cliEntry() {
+    return path.join(__dirname, "..", "cli.js");
+}
+function maybeSpawnPackSync(options = {}) {
+    try {
+        if (options.connected === false)
+            return "not-connected";
+        const env = options.env ?? process.env;
+        if (isPackCiMode(env))
+            return "ci";
+        const root = (0, paths_1.packsRoot)(env, options.home ?? os.homedir());
+        const now = options.now ?? Date.now();
+        const decision = decideSync(root, env, now);
+        if (decision !== "spawn-install" && decision !== "spawn-check")
+            return decision;
+        fs.mkdirSync(root, { recursive: true });
+        fs.writeFileSync((0, paths_1.lastSyncPath)(root), String(now));
+        const time = new Date(now);
+        fs.utimesSync((0, paths_1.lastSyncPath)(root), time, time);
+        const args = decision === "spawn-install"
+            ? ["pack", "install", "--quiet"]
+            : ["pack", "status", "--quiet", "--no-prune"];
+        const child = (options.spawn ?? child_process_1.spawn)(process.execPath, [options.cli ?? cliEntry(), ...args], {
+            detached: true,
+            stdio: "ignore",
+            env: { ...env, CODIEDEV_PACK_BACKGROUND: "1" },
+        });
+        child.on?.("error", () => { });
+        child.unref?.();
+        return decision;
+    }
+    catch {
+        return "error";
+    }
+}
+function packNagLine(options = {}) {
+    try {
+        const env = options.env ?? process.env;
+        if (env.CODIEDEV_PACK_BACKGROUND || isPackCiMode(env))
+            return null;
+        const root = (0, paths_1.packsRoot)(env, options.home ?? os.homedir());
+        const now = options.now ?? Date.now();
+        const cache = readStatusCache(root);
+        if (!cache || cache.outdated.length === 0)
+            return null;
+        const last = mtime((0, paths_1.lastNagPath)(root));
+        if (last !== null && now - last < exports.NAG_INTERVAL_MS && last <= now)
+            return null;
+        fs.writeFileSync((0, paths_1.lastNagPath)(root), String(now));
+        const time = new Date(now);
+        fs.utimesSync((0, paths_1.lastNagPath)(root), time, time);
+        const first = cache.outdated[0];
+        const more = cache.outdated.length > 1 ? ` (+${cache.outdated.length - 1} more)` : "";
+        return `Starter pack ${first.name || first.slug}${more} has updates. Run \`codiedev pack install\`.`;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/prUrl.js

@@ -1,9 +1,4 @@
 "use strict";
-// PR/MR URL parser. GitHub uses `/pull/<n>`, GitLab uses `/-/merge_requests/<n>`.
-// Self-hosted GitLab keeps the same path shape on a different host (Sonifi
-// runs git.sonifi.com behind a Cloudflare tunnel, for example). Nested groups
-// land in `owner` as a slash-joined path so we can rebuild the full project
-// path when calling the GitLab API.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parsePrOrMrUrl = parsePrOrMrUrl;
 function parsePrOrMrUrl(url) {

package/dist/repoResolver.js

@@ -1,12 +1,4 @@
 "use strict";
-// Pure resolver — given a captured remoteUrl, an optional client-cached
-// repoId, and the company's current repo list, decide which repoId (if any)
-// the session belongs to. Used both inline by the CLI hook and (mirrored
-// in convex/repoResolver.ts) by the /api/captureSession endpoint so that
-// repos added after the user's last `connect` still get matched.
-//
-// "unmatched" is intentional — the backend will accept the session anyway
-// and surface it for triage rather than silently dropping it.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveRepoForCapture = resolveRepoForCapture;
 function parseRemoteUrl(url) {
@@ -17,12 +9,6 @@ function parseRemoteUrl(url) {
     if (https) {
         return { host: https[1].toLowerCase(), ownerName: https[2].toLowerCase() };
     }
-    // Codie strips SSH userinfo before putting a remote in the gateway header,
-    // so `git@gitlab.com:owner/repo.git` arrives here as
-    // `gitlab.com:owner/repo.git`. Accept both forms; otherwise every SSH-cloned
-    // Harness checkout loses its repoId even though transcript capture can
-    // resolve the same raw remote correctly. Check this after URL forms so the
-    // colon in `https://` is never mistaken for an SCP separator.
     const scp = s.match(/^(?:[^@\s]+@)?([^:/\s]+):([^/]+\/.+)$/);
     if (scp) {
         return { host: scp[1].toLowerCase(), ownerName: scp[2].toLowerCase() };
@@ -31,11 +17,6 @@ function parseRemoteUrl(url) {
 }
 function resolveRepoForCapture(input) {
     const { remoteUrl, providedRepoId, companyRepos } = input;
-    // The remoteUrl is the ground truth of where the work happened — resolve it
-    // FIRST. A buggy client can send a wrong-but-valid providedRepoId (the Sonifi
-    // case: client matchRepo stamped every session with the org's first repo), so
-    // we must not blindly trust it over the URL. Keep providedRepoId only when it
-    // AGREES with the URL match, or when the URL can't be resolved at all.
     const parsed = remoteUrl ? parseRemoteUrl(remoteUrl) : null;
     const urlMatch = parsed
         ? companyRepos.find((r) => `${r.owner}/${r.name}`.toLowerCase() === parsed.ownerName)

package/dist/secret.js

@@ -1,7 +1,4 @@
 "use strict";
-// Display helpers for credential-shaped strings. Use anywhere a token /
-// secret might end up in user-visible output (logs, success lines, error
-// messages) so a stray `console.log` can't leak the full value.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.maskToken = maskToken;
 const PREFIX_LEN = 12;

package/dist/security.js

@@ -42,9 +42,6 @@ exports.buildSecurityWorkflowEvent = buildSecurityWorkflowEvent;
 exports.buildSecurityPromptEvent = buildSecurityPromptEvent;
 exports.buildBlockedSecurityPromptEvent = buildBlockedSecurityPromptEvent;
 const crypto = __importStar(require("crypto"));
-// Advances only when endpoint enforcement behavior changes. This is
-// intentionally independent from the package version so security coverage can
-// remain current across unrelated CLI releases.
 exports.SECURITY_RUNTIME_VERSION = 1;
 function withEndpointIdentity(event, identity) {
     return {
@@ -140,12 +137,6 @@ function containsSecretValue(text) {
     SECRET_ASSIGNMENT.lastIndex = 0;
     return false;
 }
-/**
- * Runs before a user prompt reaches the model. This is intentionally narrow:
- * block credential material, but allow safe references such as
- * `$OPENAI_API_KEY` so developers can ask agents to use environment variables
- * without pasting their values.
- */
 function evaluatePromptSecurity(prompt, policy, source) {
     if (!prompt || !containsSecretValue(prompt))
         return { action: "allow" };
@@ -210,7 +201,6 @@ function destructiveTargetOutsideWorkspace(command, cwd) {
     const normalizedCwd = cwd.replace(/\/+$/, "");
     return target !== normalizedCwd && !target.startsWith(`${normalizedCwd}/`);
 }
-/** Runs synchronously before a tool executes. No network or model is involved. */
 function evaluateToolSecurity(input, phase, policy, source, sessionContext) {
     if (phase !== "pre")
         return { action: "allow" };
@@ -324,8 +314,6 @@ function redactString(value) {
             return `[REDACTED_SECRET:${fingerprint(match)}]`;
         });
     }
-    // Keep hook payloads bounded. Full transcripts already use Codie's existing
-    // capture path; the detector only needs immediate causal context here.
     if (redacted.length > 16_384)
         redacted = `${redacted.slice(0, 16_384)}[TRUNCATED]`;
     return { value: redacted, count };
@@ -386,12 +374,6 @@ function buildSecurityWorkflowEvent(input, phase, source, now = Date.now) {
         redactionCount: sanitized.count,
     };
 }
-/**
- * Captures the intent side of the causal chain without weakening the local
- * privacy boundary. A prompt that the deterministic policy blocks never
- * becomes an uploadable event; allowed prompts are redacted and bounded using
- * the same sanitizer as tool payloads.
- */
 function buildSecurityPromptEvent(input, source, now = Date.now, policy) {
     const sessionId = input.session_id ?? input.sessionId ?? "";
     if (!sessionId || !input.prompt) {
@@ -415,8 +397,6 @@ function buildSecurityPromptEvent(input, source, now = Date.now, policy) {
         localCategory: decision.action === "alert" ? decision.category : undefined,
     };
 }
-/** Audit-safe evidence for a blocked prompt. The secret-bearing prompt is
- * intentionally omitted; administrators still see that prevention occurred. */
 function buildBlockedSecurityPromptEvent(input, source, category, now = Date.now) {
     const sessionId = input.session_id ?? input.sessionId ?? "";
     if (!sessionId)